Privacy Policy

1 Who we are

Elroi Careers (referred to in this policy as "Elroi", "we", "us", or "our") is a Ugandan digital platform connecting medical and healthcare professionals with employment opportunities and scholarships across Uganda and East Africa.

Our platform is accessible at elroi.careers and elroi.co.ug.

We are registered under the laws of Uganda and are required to comply with the Data Protection and Privacy Act, 2019 (PDPA) and its regulations. We are registered with the National Information Technology Authority Uganda (NITA-U) as a data collector and data processor.

For any privacy-related enquiries, contact us at: privacy@elroi.careers

2 What information we collect

We only collect information that is necessary to provide our services. Here is exactly what we collect and why:

Category	Specific data	Why we collect it
Account information	Full name, email address, password (hashed — we cannot read it)	To create and manage your account
Contact details	Phone number, location/district	So employers can contact you; for location-based job matching
Professional profile	Qualifications, work experience, technical skills, specialisations (modalities)	To match you with relevant jobs and send your profile to employers when you apply
Application data	Jobs you have applied for, application channel used (platform/email/WhatsApp)	To track your applications and show you your application history
Saved content	Jobs you have saved, scholarship checklists you have started	To remember your saved content between sessions
Usage data	Pages visited, search terms entered, device type (desktop/mobile), approximate session time	To improve the platform — understand what users find useful and what is missing
Feedback	Ratings, written feedback messages, NPS responses	To improve our service quality

We do not collect: national ID numbers, financial account details, health records, political opinions, religious beliefs, or biometric data.

3 How we use your information

We use your information only for the following purposes:

Providing the service: showing you relevant jobs and scholarships, processing your applications, sending your profile to employers you apply to
Account management: creating and maintaining your account, password resets, login security
Communication: weekly scholarship digest emails (if you have opted in), important service updates, responses to your feedback
Platform improvement: analysing usage patterns (anonymised and aggregated) to understand what features are useful and what content is missing
Safety and security: detecting fraudulent accounts, preventing abuse of the platform
Legal compliance: maintaining records as required by Ugandan law

We will never use your data for advertising profiling, sell it to data brokers, or share it with any third party for their own marketing purposes.

4 Who we share your information with

We share your personal data only in the following circumstances:

Employers you apply to: when you submit an application, we send your name, contact details, qualifications, and experience to the employer you applied to. You review this information before submitting.
Email service provider: we use an email service to send transactional emails (application confirmations, scholarship digests). This provider processes your email address only for sending these messages and is contractually prohibited from using it for any other purpose.
Legal requirement: if required by a court order, law enforcement authority, or other legal process under Ugandan law, we may disclose data as required. We will notify you where legally permitted to do so.

We do not sell, rent, or trade your personal data. We do not share it with social media platforms, advertisers, or data aggregators.

5 How long we keep your data

Active accounts: we retain your data for as long as your account is active
After account deletion: we permanently delete all your personal data within 30 days of your deletion request. Application records are anonymised rather than deleted so that employers retain their hiring records.
Usage/analytics data: retained for 12 months in anonymised, aggregated form
Feedback data: retained for 24 months to monitor platform quality trends
Legal hold: if there is an ongoing legal matter involving your account, we may retain relevant data until the matter is resolved

6 How we protect your data

Passwords: all passwords are hashed using bcrypt — we cannot see your actual password
HTTPS: all data transmitted between your browser and our servers is encrypted using TLS/SSL
Access controls: database access is restricted to authorised systems only and is not publicly accessible
CSRF protection: all forms include security tokens to prevent cross-site request forgery
Input sanitisation: all database queries use prepared statements to prevent SQL injection
Rate limiting: repeated failed login attempts and form submissions are automatically blocked

Data breach notification: in the event of a data breach that may affect your personal data, we will notify you and the NITA-U Personal Data Protection Office within 72 hours of becoming aware of the breach, as required by the PDPA 2019.

7 Your rights under the PDPA 2019

Under the Uganda Data Protection and Privacy Act 2019, you have the following rights regarding your personal data:

Right of access

Request a copy of all personal data we hold about you

Right to correction

Ask us to correct inaccurate or incomplete data

Right to deletion

Request permanent deletion of your account and personal data

Right to withdraw consent

Unsubscribe from emails or withdraw consent for any processing at any time

Right to object

Object to processing of your data for any purpose beyond essential service delivery

Right to complain

Lodge a complaint with NITA-U if you believe your rights have been violated

To exercise any of these rights, email us at privacy@elroi.careers or use the account deletion feature in your profile settings. We will respond within 14 days.

To file a complaint with the regulator: National Information Technology Authority Uganda (NITA-U), Personal Data Protection Office, Parliamentary Avenue, Kampala. Email: pdpo@nita.go.ug

8 Cookies and tracking

We use only the following cookies:

Session cookie: stores your login state so you do not have to log in on every page. This cookie is deleted when you close your browser or log out. It contains no personal data — only a random session identifier.
Security token: a CSRF token used to protect form submissions from cross-site attacks

We do not use advertising cookies, third-party tracking pixels, or Google Analytics. Our usage analytics are collected server-side using our own systems and contain no personal identifiers.

9 Children's privacy

Elroi is a professional employment platform intended for adults (18 years and older). We do not knowingly collect personal data from persons under 18 years of age. If you believe a child has registered on our platform, please contact us at privacy@elroi.careers and we will promptly delete the account.

10 Changes to this policy

We may update this Privacy Policy from time to time. When we make significant changes, we will notify you by email (if you have an account) and display a prominent notice on the platform. Continued use of Elroi after such notice constitutes acceptance of the updated policy.

The date at the top of this page shows when this policy was last updated. We recommend reviewing it periodically.

11 Contact and complaints

If you have any questions about this Privacy Policy, or want to exercise your data rights, please contact us:

Elroi Privacy Team

We aim to respond to all privacy enquiries within 14 days. For urgent matters regarding a suspected data breach, please mark your message as URGENT.

privacy@elroi.careers hello@elroi.careers

Elroi Careers · Kampala, Uganda · Registered under the laws of Uganda