Privacy notice
Applies to the MedEd Reach website, the MedEd Reach app for Android and iOS, and the SMS, USSD and voice services. Last updated August 29, 2026.
Who is responsible
MedEd Reach is operated by MSSI Ghana — the Medical Simulation Skills Institute (the data controller), which authors and clinically approves every course. The software is built and run on MSSI’s behalf by Kaydat Company Limited (a data processor), which also publishes the mobile app. Questions and requests: use contact support in the app or on the website, or write to the MSSI Ghana data-protection contact given in your country’s consent text at sign-up.
What we hold and why
Your name, phone number, cadre and, where you give it, professional licence number — to create your account, sign you in by text code or password, and report the CPD credits you earn to your professional council when your country’s council accepts them. If you choose to give one, your e-mail address — it is optional, you can remove it at any time, and nothing is sent to it until you have confirmed it by opening a link we e-mail you. Your language, channel and reminder preferences — to deliver lessons the way you asked. Your course activity (lessons opened, time spent, test answers and scores, certificates) — this is the evidence behind your credits and certificates, and, aggregated without names, it tells MSSI and its sponsors whether the programme works. If you use the app, the push-notification token of your phone — to send you reminders and results as notifications instead of text messages when you prefer that. If you contact support or use the help assistant, the messages you send. We hold no patient data.
What the app does on your phone
The app stores your sign-in tokens in the phone’s secure store, and — only if you choose “Save for offline” — course lessons, videos and slides in the app’s private storage so you can learn without a connection. Activity recorded while offline is kept on the phone and sent when a connection returns. The app uses the camera or your photo library only at the moment you choose to add a profile picture, and only for that — if you never add one, it never asks. Nothing else on the phone is read: not your contacts, your location or your microphone. There is no advertising and no third-party tracking. Signing out removes downloaded content and the phone’s push token from our records.
Who sees it
MSSI staff with a role that needs it (educators, country managers, the help desk), always under access rules enforced by the platform and logged. Your employer or sponsoring organisation, if it enrolled you, sees your progress and completion for the courses it assigned — not your test answers. Your professional council receives the credit records you earn, where a reporting agreement exists. Message delivery providers (SMS, voice, WhatsApp, push) receive your phone number and the message text needed to deliver it; where you have confirmed an e-mail address and agreed to be contacted by e-mail, the mail relay carries that address, and — if your institution has switched certificate delivery on — your certificate as an attached PDF, which names you, your cadre, your registration number where you gave one and your score. E-mail is not a private channel and a message cannot be recalled once it has left; you can switch e-mail off, or remove the address, at any time. No data is sold or used for advertising.
Where it is kept and for how long
The platform runs on servers operated for MSSI Ghana, with encrypted backups. Credit records and certificates are kept for at least seven years (or longer where a council requires it); identity data for the life of your account plus 90 days; test attempts for seven years as evidence for credits; raw activity events for twelve months, then only as aggregates; message records, including e-mail, for 24 months; a confirmed e-mail address for the life of your account, and the record that it was confirmed for seven years without the address itself; consent records for the life of the account plus seven years. A certificate that has already been e-mailed to you is in your mailbox and beyond our reach: closing your account cannot recall it. Chat sessions with the assistant are discarded at the end of the session unless you ask to keep them.
Your rights and how to delete your account
You can see and correct your details on your profile, change your channel preferences and withdraw consent to non-essential messages at any time. You can ask for a copy of your data or for your account to be closed: in the app, open Profile → Delete my account; on the website, use contact support. The help desk confirms your identity and closes the account within 30 days; your personal details are erased, and your credit and certificate records are kept in a form that no longer identifies you where a council requires that evidence. Under the Data Protection Act 2012 (Ghana), the Data Protection Act 2019 (Kenya), Senegal’s Law 2008-12 and comparable laws elsewhere you may also complain to your national data-protection authority.
Consent text shown at sign-up is specific to your country and prevails where it is more specific than this notice.