​Privacy
Statement

Last updated: August 2026

 

Twogere Centre for Mental Health (“Twogere”, “we”, “us” or “our”) respects your privacy and is committed to protecting the personal information entrusted to us by young people, parents and guardians, schools, partners, volunteers, donors, staff and other people who interact with our work.  This Privacy Policy explains what personal information we may collect, why we collect it, how we use and protect it, when we may share it, and the rights available to you. Twogere processes personal information in accordance with applicable Ugandan data-protection law, including the Data Protection and Privacy Act, 2019, and relevant regulations and guidance issued by the Personal Data Protection Office (PDPO).

​

Information we collect

The information we collect depends on how you interact with Twogere.

 

• Programme and beneficiary information: When we deliver school-based mental health programmes and related activities, we may collect information necessary to provide support, monitor our programmes and understand their effectiveness. This may include:

  • Name, age or age range and contact information;

  • School and programme information;

  • Participation and attendance information;

  • Feedback, wellbeing information or screening information where relevant to the programme;

  • Information relating to referrals, support needs or safeguarding concerns where necessary.

  • Health and mental health information is particularly sensitive personal data and is handled with additional safeguards.

 

• Website and contact information: When you contact us, register for an event, volunteer, apply for an opportunity, request information or otherwise interact with our website, we may collect information such as:

  • Name;

  • Email address;

  • Telephone number;

  • Organisation or school;

  • Information contained in your message or application; and

  • Other information you voluntarily provide.

 

• Donor and partner information: If you donate to Twogere, partner with us or otherwise engage with our organisation, we may collect information necessary to administer that relationship, such as contact details, organisation details, donation information and relevant transaction or administrative records. Payment information may be processed directly by third-party payment providers. Twogere does not need to retain full payment-card details where these are handled by the payment provider.

 

• Technical and website information: When you use our website, we may collect limited technical and usage information through cookies and similar technologies. This may include information such as browser type, device information, approximate location, pages visited and interactions with the website. For more information, please see our Cookie Policy.

 

2. How we use personal information

We use personal information only for purposes that are necessary, appropriate and relevant to our work. These may include:

• Delivering and managing school-based mental health programmes;

• Providing or coordinating appropriate support and referrals;

• Identifying and responding to safeguarding concerns;

• Communicating with young people, parents or guardians, schools, partners, volunteers and donors;

• Managing applications, events, volunteering and partnerships;

• Processing donations and maintaining appropriate financial records;

• Monitoring, evaluating and improving our programmes;

• Producing reports for funders, partners and other stakeholders;

• Conducting research, learning and evaluation where appropriate safeguards are in place;

• Improving our website and digital services; and

• Meeting legal, regulatory, accounting or safeguarding obligations.

 

Where we use information for reporting, research or learning, we seek to use aggregated, de-identified or otherwise appropriately protected information wherever individual identification is not necessary.

 

3. Young people and children's data

Twogere works with young people, including children, and recognises the additional responsibilities involved in handling their personal information. We collect and process children's personal information only where there is an appropriate legal basis to do so, including consent from a parent, guardian or other person authorised to make decisions on behalf of the child where required by law, or another lawful basis permitted under applicable data-protection legislation. We seek to communicate information about data collection and use in language that is appropriate to the age and understanding of the young person. Where consent is the basis for processing, we explain how information will be used and provide appropriate mechanisms for withdrawing consent, subject to circumstances where we have another lawful basis or a legal obligation to continue processing the information.

 

4. Confidentiality and safeguarding

Twogere takes the confidentiality of personal and mental health information seriously. Information collected through our programmes is not routinely shared with teachers, school administrators, parents, partners or other third parties simply because they are involved in a young person's education or support. However, confidentiality is not absolute. We may share information without consent where this is necessary and permitted or required by law, including where there is a serious safeguarding concern, a risk of significant harm, or a legal obligation to disclose information. Where disclosure is necessary, we aim to share only the information required to address the concern and, where appropriate, with the relevant safeguarding, health, child-protection or law-enforcement professionals.

 

5. How we protect personal information

Twogere takes reasonable technical and organisational measures to protect personal information against unauthorised access, loss, misuse, alteration or disclosure. Depending on the nature and sensitivity of the information, safeguards may include:

• Access controls and role-based permissions;

• Password protection and multi-factor authentication where available;

• Secure cloud-based systems and other appropriate technical safeguards;

• Staff and programme personnel confidentiality requirements;

• Data minimisation and controlled access to sensitive information; and

• Procedures for responding to suspected data breaches and security incidents.

• Access to sensitive programme information is limited to people who need it for legitimate and authorised purposes.

 

6. How long we keep personal information

We retain personal information only for as long as reasonably necessary for the purposes for which it was collected, to provide appropriate support, to meet safeguarding or legal obligations, or to fulfil legitimate organisational, financial, monitoring, evaluation or research requirements. When information is no longer required, we take reasonable steps to securely delete, destroy or de-identify it in accordance with our internal procedures and applicable legal requirements.

 

7. When we share personal information

Twogere does not sell, rent or trade personal information. We may share personal information where necessary and lawful, including:

• With authorised staff or programme personnel who need the information to perform their responsibilities;

• With schools or programme partners where sharing is necessary for the delivery or coordination of services and is permitted by law;

• With health, safeguarding or child-protection professionals where necessary to protect a young person;

• With service providers who process information on our behalf, such as technology, communications, hosting, analytics or payment providers;

• Where required by law, regulation or a valid legal process; or

• Where otherwise permitted by applicable data-protection law.

• Where we use third-party service providers, we seek to ensure that appropriate safeguards are in place for the personal information they process on our behalf.

 

8. International or third-party processing

Some of the technology and service providers used by Twogere may process information outside Uganda. Where personal information is processed or transferred outside Uganda, Twogere will take reasonable steps to ensure that appropriate data-protection safeguards are in place and that such processing is consistent with applicable Ugandan data-protection requirements.

 

9. Your rights

Subject to applicable law and any lawful limitations, you may have the right to:

• Know whether we hold personal information about you;

• Request access to personal information we hold about you;

• Request correction of inaccurate, incomplete or outdated information;

• Request deletion of personal information where applicable;

• Request restriction of certain processing where applicable;

• Withdraw consent where consent is the basis for processing;

• Object to certain uses of your personal information where applicable; and

• Raise a complaint about how your personal information has been handled.

• Some requests may be subject to legal, safeguarding, contractual or other legitimate requirements that require us to retain or continue processing certain information.

 

10. Data breaches

If Twogere becomes aware of a personal data breach, we will take appropriate steps to assess, contain, investigate and address the breach. Where required by applicable law, we will notify the relevant authorities and/or affected individuals in accordance with the applicable requirements.

 

11. Third-party websites and services

Our website may contain links to websites or services operated by third parties. These may include social-media platforms, payment providers, video services, mapping services or other external websites. Twogere is not responsible for the privacy practices of third-party websites. We encourage you to review the privacy policies of those services before providing them with personal information.

 

12. Complaints

If you have concerns about how Twogere has collected, used or protected your personal information, we encourage you to contact us first so that we can investigate and respond to your concern. You also have the right to lodge a complaint with Uganda's Personal Data Protection Office (PDPO) where you believe your data-protection rights have been infringed. The PDPO is the independent authority responsible for overseeing implementation and enforcement of Uganda's data-protection framework.

 

13. Contact us

If you have questions about this Privacy Policy, want to exercise your data-protection rights, or have a concern about how your personal information has been handled, please use our contact page to contact us:

 

14. Changes to this Privacy Policy

We may update this Privacy Policy from time to time to reflect changes in our programmes, technology, legal requirements or data-protection practices. When we make changes, we will update the “Last updated” date at the top of this page.

We encourage you to review this policy periodically to understand how Twogere protects personal information.