Privacy Notice
GHI Portal · Galilee Health Institute, Uganda · Last updated 29 October 2026
Galilee Health Institute (“GHI”, “we”) runs the GHI Portal to admit and teach students, keep academic and fee records, and run the Institute. This notice explains what personal data we hold, why, who sees it, how long we keep it and what you can ask us to do. We handle personal data in line with Uganda’s Data Protection and Privacy Act, 2019.
What we collect
- Applicants: name, date of birth, gender, phone, email, address, national ID number, previous school and qualifications, next of kin, and the certificates you upload.
- Students: everything above plus student and HTIN numbers, photo, class and enrolment history, results, attendance and placement records, disciplinary records where they exist, and fee invoices and payments.
- Staff and office holders: name, contact details, role, qualifications and the records of the work done in the portal.
- Technical data: sign-in times, network address and browser type (for security and fault-finding), and a session cookie that keeps you signed in.
Why we use it
- To process applications, enrol and teach students, mark and publish results and issue transcripts (performing our contract with you).
- To raise invoices, record payments and issue receipts and statements (contract and legal record-keeping).
- To meet reporting duties to regulators and examining bodies (legal obligation).
- To keep the system secure, prevent fraud and investigate incidents (legitimate interest).
- Anything else only with your consent, which you may withdraw.
Who sees it
Only people who need it for their job, and only the parts they need: for example the registrar sees student records, the accountant sees fee records, lecturers see their own classes, and you see your own record. We do not sell personal data. The portal is hosted on a commercial web-hosting provider, and your sign-in is shared with our Moodle learning site (same Institute, same domain) so you do not need two passwords. We share data with regulators, examining bodies or placement sites only where required or where you have been told.
How we protect it
Encrypted connections (HTTPS), strong password rules, limits on repeated sign-in attempts, two-step verification for administrators, role-based access, an audit trail on fee records, regular verified backups, and logging of security-relevant events. No system is perfectly secure; if a breach affecting you occurs we will tell you and the Personal Data Protection Office as the law requires.
How long we keep it
Academic records are kept permanently because transcripts and verification are needed for life. Fee records are kept for at least seven years. Unsuccessful applications are kept for up to two years. Security logs are kept for about one year. Backups are rotated every few weeks.
Cookies
We use one essential cookie to keep you signed in and a small browser-storage entry to remember your chosen colour theme. We do not use advertising or tracking cookies.
Your rights
You may ask to see the personal data we hold about you, to have mistakes corrected, to object to or restrict some uses, and — where we have no legal need to keep it — to have it deleted. You may also complain to Uganda’s Personal Data Protection Office. To exercise a right, contact the GHI administration office (galileleehealthinstitute@gmail.com).
This notice may be updated; the date above shows the latest version.