Legal

Privacy Policy

How the Imara Sickle Cell Framework website collects, uses, shares and protects your personal data.

Last updated: [TO CONFIRM: effective date]

Draft for legal review. This policy is a starting point prepared to reflect how the website is built. It has not been reviewed by legal counsel. Items marked [TO CONFIRM] must be verified and completed by the data controller and their legal / data-protection adviser before this page is published.

1. Who we are

This website is operated on behalf of the Imara Sickle Cell Framework. For the purposes of data-protection law, the data controller is [TO CONFIRM: full legal name of the controlling organisation], of [TO CONFIRM: registered address].

If you have any question about this policy or how your data is handled, you can contact us at info@imaraframework.com [TO CONFIRM: correct privacy contact address]. Our data protection officer / privacy contact is [TO CONFIRM: name and contact details, if one has been appointed].

2. What information we collect

Information you give us

When you use the partnership enquiry form on this site, we collect the details you enter: your name, email address, your organisation (optional) and the message you write. We also record that you ticked the box confirming you agree to be contacted, together with the date and time of that consent.

Information collected automatically

When you visit the site, our hosting infrastructure may record standard technical information in server logs — such as your IP address, browser type, the pages requested and timestamps. This is used to operate and secure the website.

If you agree to analytics (see section 4), limited information about how you use the site is also collected. If you do not agree, no analytics data is collected.

3. How and why we use it

We use your information only for the following purposes:

To respond to your enquiry and to discuss and manage a possible partnership with you. Legal basis: your consent, and/or our legitimate interest in responding to people who contact us, and/or taking steps at your request before entering into an arrangement. [TO CONFIRM: preferred legal basis per jurisdiction]
To operate and secure the website (for example, to prevent abuse and keep the service running). Legal basis: our legitimate interests.
To understand how the site is used, through privacy-friendly analytics, so we can improve it. Legal basis: your consent.

We do not use your information for advertising, and we do not sell it.

4. Cookies & analytics

This site uses a small number of cookies. Analytics are switched off until you actively agree through the cookie banner, and can be declined. For the full list of cookies and how to manage your choice, see our Cookie Policy.

Where analytics are enabled, the site uses Google Analytics 4 with IP-address anonymisation, and only after you consent.

We share personal data only with service providers who help us run the site and respond to you, and only as far as needed. These currently include:

Hosting & infrastructure — the website and the enquiry form are hosted and processed on infrastructure operated by Well Run on the project's server. [TO CONFIRM: hosting provider, data-centre location and any sub-processor]
Email delivery — enquiry notifications and our replies are sent using an email delivery service, Brevo (Sendinblue). [TO CONFIRM: email provider and that a data-processing agreement is in place]
Analytics — if analytics are enabled and you consent, usage data is processed by Google (Google Analytics 4). [TO CONFIRM: Google contracting entity, e.g. Google Ireland Ltd]

We may also disclose information where required by law, or to protect our rights, safety or property. [TO CONFIRM: any other recipients — e.g. government or coalition partners the data is passed to]

6. International transfers

Some of our service providers may store or process data outside your country. Where that happens, we rely on appropriate safeguards for the transfer. [TO CONFIRM: transfer mechanism — e.g. standard contractual clauses — and the countries involved]

7. How long we keep it

We keep enquiry details for as long as needed to respond to you and to manage any resulting relationship, and then delete or anonymise them. Analytics data is retained according to the analytics provider's settings. [TO CONFIRM: specific retention periods for enquiries and analytics]

8. Your rights

Depending on where you live, you may have the right to access the personal data we hold about you, to have it corrected or deleted, to restrict or object to how we use it, to receive a copy in a portable format, and to withdraw consent at any time (without affecting processing already carried out). To exercise any of these, contact us at info@imaraframework.com [TO CONFIRM].

You also have the right to complain to a data-protection authority — for example [TO CONFIRM: the Office of the Data Protection Commissioner (Kenya), the Personal Data Protection Office (Uganda), and/or the relevant authority for other regions where the site operates].

9. Security

We take reasonable technical and organisational measures to protect your personal data against loss, misuse and unauthorised access. No method of transmission or storage is completely secure, however, and we cannot guarantee absolute security.

10. Children

This website is intended for organisations and adults interested in partnering with the framework. It is not directed at children, and we do not knowingly collect personal data from children. [TO CONFIRM: age threshold and any specific wording required in each jurisdiction]

11. Changes to this policy

We may update this policy from time to time. When we do, we will change the "last updated" date above, and, where appropriate, provide a more prominent notice.

12. Contact us

For any question about this Privacy Policy or your personal data, contact us at info@imaraframework.com [TO CONFIRM: final contact address and postal address].