Ghana Grid Company LTD. (GRIDCo) is committed to protecting the privacy and personal data of its employees and their dependents. This Privacy Policy explains how the GRIDCo HospitalClaim App (the “App”) collects, uses, stores, and safeguards personal information in connection with the processing of employee medical claims and related welfare benefits.

By using the App, you acknowledge that you have read and understood this Privacy Policy. This policy applies to all GRIDCo staff members and authorised users who access the App.

The data controller responsible for your personal information is:

Ghana Grid Company LTD. (GRIDCo)

P.O. Box CS7979, Tema, Ghana

Website: https://gridcogh.com

Data Protection Contact: gridco@gridcogh.com

The App processes the following categories of personal data:

Employee Data (Pre-existing Records)

The following information is drawn from GRIDCo’s existing HR and payroll databases and is not newly collected through the App:

• Full name and staff number

• Contact details (Email address)

Dependent Data (Pre-existing Records)

The App also draws on existing records for registered dependents, which may include:

• Full names and relationship to employee

• Date of birth

Data Collected Through the App

The following data is actively captured through the App during claim submission:

• Photographs of medical receipts, drug packaging, prescription labels, and related supporting documents

• Medical facility name, date of visit, and treatment type (as shown on uploaded receipts)

• Claim amount and itemised costs

• Date and time of claim submission

• Device metadata associated with image capture (if applicable)

The photographs and claim details you submit may reveal sensitive health information, including prescribed medications, and the nature of medical treatment received by you or your dependents. GRIDCo treats this as sensitive personal data and handles it with the highest level of care.

GRIDCo processes your personal data solely for the following purposes:

• Verifying the legitimacy of medical claims submitted through the App

• Processing welfare payments and reimbursements to eligible staff and hospitals

• Maintaining accurate records of medical benefit utilisation per employee

• Ensuring compliance with GRIDCo’s staff welfare policy and applicable regulations

• Conducting internal audits and benefit reviews

• Resolving disputes relating to claim submissions

Your data will not be used for any purpose other than those listed above without your prior knowledge or consent.

GRIDCo processes your personal data in accordance with the Ghana Data Protection Act, 2012 (Act 843). The legal bases for processing are:

• Performance of an employment contract: Processing is necessary to administer your employment benefits and obligations.

• Legitimate interests: Processing supports GRIDCo’s responsibility to manage welfare expenditure, prevent fraud, and maintain benefit records.

• Consent: Where you voluntarily submit photographs and claim details, you are consenting to their processing for claim verification and payment purposes.

Access to your personal data is strictly limited to authorised personnel with a need to process it. This includes:

• Human Resource staff responsible for welfare administration

• IT staff responsible for maintaining the App and its infrastructure

• Senior management where escalation of a claim is required

GRIDCo does not sell, rent, trade, or share your personal data with any third party outside the organisation, except where required by Ghanaian law or a valid legal order.

Personal data collected through the App is retained for as long as is necessary to fulfil the purposes described in this policy, or as required by GRIDCo’s internal records retention schedule and applicable Ghanaian law.

Claim-related photographs and supporting documents are retained for a minimum of seven (7) years in line with financial record-keeping requirements, after which they are securely deleted.

GRIDCo implements appropriate technical and organisational measures to protect your personal data against unauthorised access, disclosure, alteration, or destruction. These measures include:

• Access controls restricting data to authorised personnel only

• Secure transmission of data between the App and GRIDCo’s servers

• Storage of data on GRIDCo’s internal IT infrastructure, subject to the company’s information security policies

• Regular review of access privileges

In the event of a personal data breach that is likely to result in a risk to your rights and freedoms, GRIDCo will take prompt steps to contain the breach and notify affected individuals as required by law.

Under the Ghana Data Protection Act, 2012 (Act 843), you have the following rights with respect to your personal data:

• Right of access: You may request a copy of the personal data GRIDCo holds about you.

• Right to correction: You may request that inaccurate or incomplete data be corrected.

• Right to object: You may object to processing of your data in certain circumstances.

• Right to erasure: You may request deletion of your data where retention is no longer necessary, subject to legal obligations.

To exercise any of these rights, please contact the Human Resource Department or submit a written request to the Data Protection Contact listed in Section 2.

The App may process data relating to your registered dependents, including minor children. By registering a dependent in the system and submitting claims on their behalf, you confirm that you are authorised to do so as their parent, guardian, or next of kin. GRIDCo will handle dependent data with the same care and protections applied to employee data.

GRIDCo reserves the right to update this Privacy Policy from time to time. Any material changes will be communicated to staff through official internal channels. The effective date at the top of this document will be updated accordingly.

If you have any questions, concerns, or complaints regarding this Privacy Policy or the handling of your personal data, please contact:

Director, Human Resource

Ghana Grid Company Limited (GRIDCo)

P.O. Box CS 7979, Tema, Ghana

Email: gridco@gridcogh.com

You also have the right to lodge a complaint with the Data Protection Commission of Ghana if you believe your data has been handled in a manner inconsistent with applicable law.