Privacy Policy

NurseHostel ("we," "us," or "our") operates the managed student accommodation marketplace platform hosted at NurseHostel.com. For the purposes of the Ghana Data Protection Act, 2012 (Act 843), NurseHostel acts as the Data Controller. We are fully committed to protecting the privacy, dignity, and fundamental rights of our users — including student applicants ("Students") and property accommodation providers ("Hosts").

In strict compliance with Section 17 of Act 843, we process all personal data under the eight foundational principles of data protection:

• Accountability: We assume full responsibility for the data files under our possession.
• Lawfulness of Processing: Data is collected only with your explicit, unambiguous consent.
• Specification of Purpose: Data is captured solely to facilitate safe housing matching.
• Compatibility of Further Processing: We do not reuse your files for unauthorized third-party marketing.
• Quality of Information: We provide self-service dashboard tools to ensure your data files stay accurate.
• Openness: We maintain absolute transparency regarding how tracking and telemetry logs are processed.
• Data Security Safeguards: We deploy automated pipeline sandboxes to eliminate structural file vulnerabilities.
• Data Subject Participation: We provide clear, direct channels for data erasure and access requests.

• Account Information: Full legal names, institutional affiliation, academic registration details, active telephone numbers, email addresses, and encrypted authentication tokens.
• Property Listing Inventory Assets: Physical addresses, geo-coordinates, booking availability matrix arrays, rental pricing thresholds, and media graphics (uploaded photographs).
• Automated Network Telemetry & Geolocation Logs: Raw IP addresses, device browser fingerprints, and country location headers (cf-ipcountry) generated automatically at the network edge to establish localized regional fallbacks.

Media File Hardening Pipeline (Content Disarm & Reconstruction): To prevent severe network exploitation and protect our infrastructure, all user-submitted media uploads pass through an automated serverless processing loop. This pipeline intercepts the file stream, validates raw header magic bytes, strips out 100% of hidden EXIF metadata or location-tracking coordinates, and re-encodes the image into flat WebP graphics assets stored in isolated storage layers.

Deterministic Server-Side Branding Composites: To protect listing assets from commercial scraping, the server permanently flattens our signature transparent corporate brand logo directly into the pixel coordinates of host images before pushing them to cloud storage.

Persistence & Database Separation: Text-based structural data records reside within heavily encrypted production databases, completely isolated from binary image file buckets.

We process your personal data under the following lawful grounds established under Section 24 of Act 843:

• Explicit Consent: By registering an account and choosing to upload photos or browse listings, you grant us permission to process your records under these rules.
• Contractual Necessity: Processing your identity and contact details is mandatory to establish matching communication pipelines between Students and Hosts.
• Legal Obligation: Processing may be performed to satisfy regulatory compliance requirements, financial audits, or direct lawful orders issued by the Ghana Data Protection Commission.

• No Commercial Monetization: We do not sell, rent, trade, or lease user data records to third-party advertising brokers.
• Functional Integration Service Partners: Data is shared strictly with essential technical service infrastructure partners (such as secure SMS transaction notification channels, text analytics microservices, and certified digital payment clearance engines).
• Cross-Border Transfers (Act 843, Section 45): Because our platform provides multi-country regional adjustments spanning Ghana, Nigeria, and Kenya, data files may be processed across secure edge networks. We ensure all cross-border data routing conforms to stringent security protocols.

We retain personal data files only for as long as your platform profile remains actively registered. If an account remains completely dormant for a continuous period of 24 months, or upon explicit deletion request, all linked personal metadata records are permanently purged or rendered completely anonymous within our production databases. Residual static media assets residing inside backup storage arrays are overwritten in standard cycling schedules.

As a recognized data subject under Ghana's legal framework, you possess the following explicit, enforceable rights:

• Right of Access (Section 28): You have the right to request full confirmation regarding whether we hold your personal records and receive an explicit description of those files.
• Right to Rectification (Section 31): You can demand the instant correction of inaccurate, incomplete, or outdated personal information via your account dashboard or by contacting us directly.
• Right to Object to Processing (Section 32): You may object at any time to the processing of your data for purposes of direct marketing or automated profiling.
• Right to Erasure / Destruction (Section 33): You have the right to request the permanent deletion of your personal records from our active operational systems.

To exercise any of these rights, submit a formal request to our designated privacy processing desk at info@nursehostel.com. We will process and respond to all verified requests within twenty-one (21) business days.