Privacy notice | HEOR Africa Academy

Who is responsible

HEOR Africa, with offices in Kigali, Rwanda, and Addis Ababa, Ethiopia, is the data controller for HEOR Africa Academy. Contact us athello@heorafrica.com with any privacy question or request.

The laws that apply

Rwanda: Law No. 058/2021 of 13/10/2021 relating to the protection of personal data and privacy.
Ethiopia: Personal Data Protection Proclamation No. 1321/2024.

What we collect and why

Data	Purpose	Lawful basis
Name, email address, password (stored only in hashed form)	To create and secure your account	Performance of our contract with you
Country and organisation	To show prices and content suited to you, and to understand who our learners are	Your consent, given at sign-up
Enrolments, lesson progress, quiz results, certificates	To deliver courses, unlock lessons and issue certificates	Performance of our contract with you
Payment records: amount, date, method and reference	To give access after payment, handle refunds and keep accounts	Performance of our contract; legal obligations
Questions and comments you post	To answer you and, once approved, show the comment to other learners on that lesson	Your consent
Technical records such as sign-in times	To keep the service secure and prevent misuse	Our legitimate interest in a secure service

We do not receive or store your card number or mobile money PIN. Payment providers handle those details.

Video watermark

While you watch a lesson, your account's email address is shown on the video. It discourages copying and is visible only to you, unless you record or share your screen.

Certificates

Each certificate has a web address that shows your name, the course and the date of issue to anyone who has the address. You decide who to share it with.

Service providers

We use these providers to run the Academy. Each processes data only on our instructions.

Supabase: accounts and database, hosted in Frankfurt, Germany.
Cloudflare: website hosting and security.
Bunny: video streaming.
Resend: sending account and payment emails.
The webR project (r-wasm.org): R exercises download R from this service to your browser. Your code runs on your own device and is not sent to it or to us.
Flutterwave and Chapa: card and mobile money payments, when you choose them.

This means personal data is processed outside Rwanda and Ethiopia. We transfer it only in line with the cross-border transfer requirements of the Rwanda and Ethiopia data protection laws. This paragraph, and the registration position with each authority, will be confirmed during legal review.

How long we keep data

Account and learning records: while your account is open, and then deleted or anonymised on request.
Certificate records: kept so that certificates can still be verified, unless you ask us to remove them.
Payment records: for as long as accounting and tax law requires.

Your rights

You have the right to be informed, to access your data, to have it corrected or erased, to object to or restrict processing, and to data portability. You can correct your profile in your account at any time. To use any other right, email us. If you are not satisfied with our answer, you can complain to the National Cyber Security Authority of Rwanda or the Ethiopian Communications Authority.

Cookies

The Academy uses only the cookies needed to keep you signed in, and your browser's storage to remember your light or dark theme. It does not use advertising or tracking cookies.

Changes

If we change this notice in a way that affects you, we will tell you by email or when you next sign in.