Privacy Policy | Global Foundation for Community Health

Last updated: 17 October 2026.

The 5-2035 Global Foundation for Community Health (GFCH, “we”, “us” or “our”) operates gfchealth.org. This policy explains how we handle personal information when you visit our website, contact us, subscribe to updates, volunteer or make a donation. Personal information is information that identifies you or can reasonably be linked to you.

Questions or requests about your information can be sent to info@gfchealth.org, with “Privacy request” in the subject line, or through our contact page.

1. What this policy covers

GFCH decides why and how personal information is used for its website and related communications. In data protection law, this role is called a controller. Mauritius’s Data Protection Act 2017 applies to processing within its scope. Other privacy laws may also apply, depending on the activity and the people involved.

This website provides information about our community-health mission. It is not a patient portal or a way to obtain medical care. A clinical service, research study or community programme that collects health information needs its own privacy information and any necessary consent. This website policy does not provide consent to participate in those activities.

2. Information we collect

We receive information directly from you when you complete a form, email us or donate. A person helping with a volunteer application or a team profile may also provide information on your behalf.

Enquiries and resource requests: your name, email address, telephone number, country or region, and the contents of your message, depending on the form you use.
Subscriptions and volunteering: your contact details, communication preferences, interests, experience and any other information you choose to provide.
Donations: donor and billing details, donation amount and currency, payment method, transaction references and payment status. Payment providers also process information needed to authorise payments and prevent fraud.
Public contributions: profile details, photographs, biographies, testimonials or other material you provide for publication.
Website use: IP address, browser and device information, pages visited, referring pages, dates and times, cookie identifiers and interactions with forms or donation pages. Hosting, security, statistics and embedded services can receive this information automatically.

Providing information through a form is voluntary. Fields marked as required are needed to complete that particular request. If you leave them blank, we may be unable to respond, deliver a requested resource or process a donation. You can browse our public information without completing a form.

Please do not put medical records, identification documents, full payment-card details or other sensitive information into ordinary contact forms or email. If your enquiry needs sensitive information, contact us first to discuss an appropriate way to provide it.

3. Why we use information

We use information to answer enquiries, send requested resources, coordinate volunteering, administer donations and receipts, maintain our records, protect the website and understand how it is used.

Where a legal basis is required, it depends on the purpose:

Responding to enquiries and coordinating participation: our legitimate interests in communicating with people who contact GFCH and organising our charitable work, balanced against their privacy rights.
Administering donations: our legitimate interests in receiving and recording donations, and legal obligations that apply to accounting, tax and financial records. Where a particular transaction involves a contract, processing may also be necessary to perform it.
Optional updates and publication of profiles or stories: consent where required. You may withdraw that consent using the contact details above or an unsubscribe option in a message.
Website operation and security: our legitimate interests in keeping the website available and preventing misuse. Tracking that requires consent must have that consent separately; a legitimate interest does not replace it.

Visiting the website, contacting us or making a donation does not by itself mean that you consent to unrelated marketing or the publication of your information. Withdrawal of consent does not affect processing that was lawful before withdrawal, or records we must retain under another lawful basis.

4. Donations and payment information

Our donation system uses WooCommerce. Available payment methods include bank transfer and a card-payment gateway using Mastercard Payment Gateway Services. The payment provider and participating financial institutions process payment information under their own privacy and security terms.

GFCH receives the donor and transaction information needed to administer a donation, answer payment queries and issue receipts. Do not send card numbers or security codes through our contact forms or email. A donation does not itself authorise us to publish your name, donation amount or story.

5. Who receives information

Information may be accessed by GFCH team members and authorised volunteers who need it to handle an enquiry, administer donations, coordinate participation or maintain the website.

Services used for the website and its communications include:

Hostinger: website hosting and infrastructure.
Automattic services, including Jetpack and WooCommerce: forms, website features, statistics, security and donation administration. See Automattic’s visitor privacy notice.
HubSpot: embedded subscription and other forms, contact management and website tracking where those features are active. See HubSpot’s privacy policy.
Google services: email and collaboration services, externally hosted fonts and reCAPTCHA on protected forms. reCAPTCHA processes device and interaction information to help detect automated abuse. See Google’s privacy policy.
Payment providers and banks: payment authorisation, settlement and fraud prevention.

Some providers process information on our instructions. Others, such as banks and social networks, also make their own decisions about processing and have their own legal obligations. Their privacy notices explain those activities.

We may disclose information where legally required, to respond to a valid legal request, or where necessary and lawful to protect people, investigate fraud or establish, exercise or defend legal claims.

6. Cookies, statistics and embedded services

Cookies and similar technologies support website functions and record website activity. Optional statistics and external embeds are blocked until you allow their category; security checks and donation functions remain available. They are not necessarily anonymous. The site uses the following types:

Sessions and donation functions: cookies such as pdb-sess, wp_woocommerce_session_*, woocommerce_items_in_cart and woocommerce_cart_hash support sessions and donation functionality. Their presence depends on the page and interaction.
Statistics and attribution: Jetpack/Automattic technologies and WooCommerce referral cookies, including tk_* and sbjs_*, record visits, referral sources or donation journeys. HubSpot tracking code is loaded only when you allow website statistics.
Form protection: reCAPTCHA and provider security cookies help detect abuse.
External content: fonts, images and social-sharing features can connect your browser to external providers. Facebook sharing features can contact Meta after you allow external content, even before you choose to share a page.

Session cookies generally last for a browsing session. Other cookies have an expiry date and may persist longer. Provider settings and your browser affect their duration. HubSpot’s cookie information explains its cookie names and durations.

Use Cookie settings in the footer to accept or reject optional website statistics and external content. Both are off until you choose to allow them. You can accept all, reject optional cookies or save a choice for each category. We remember your choice for six months using the essential gfch_cookie_consent cookie. You can reopen the settings at any time; withdrawing permission stops those optional services on subsequent page loads and removes their known accessible first-party cookies. It does not undo information already received by a provider or erase cookies held on another provider’s domain.

You can also review, block or delete cookies through your browser settings. Blocking cookies or external scripts may prevent forms, security checks or donation features from working. Email us if you need another way to contact GFCH. Browser settings do not replace any consent the law requires us to obtain before using a technology. Reading this policy or continuing to browse is not consent to optional tracking.

7. International processing

GFCH’s team and service providers may access or process information outside Mauritius, including through hosting, email, contact-management and payment services. The destination depends on the service and its arrangements; another country may have different privacy laws.

International transfers must meet the requirements of the law that applies to the information. These may require appropriate safeguards, a recognised adequacy decision or a permitted exception. Consent to receive updates is not blanket consent to international transfers. Contact us for information about the destinations and safeguards relevant to your information, or to request a copy of applicable safeguards.

8. How long information is kept

Retention depends on why information was collected and any legal requirements:

Enquiries and resource requests are needed while we handle the request and any necessary follow-up or dispute.
Volunteer information is needed while participation is active and for any justified administration or record-keeping afterward.
Subscription information is needed to manage your preferences. A minimal record of an opt-out may be needed to avoid contacting you again.
Donation records may need to be retained for accounting, tax, financial compliance or legal claims, even after a deletion request.
Technical logs, provider records, backups and public-content revisions have separate retention arrangements.

We assess retention by the purpose, sensitivity of the information, legal requirements and any unresolved issue. Information should be deleted or anonymised when it is no longer needed. Ask us about the retention period for a particular record. Removal from the public website does not necessarily erase an uploaded file, revision or backup, or a copy held by a search engine or another person.

9. Your choices and rights

Depending on the law that applies, you may ask to access your information, correct it, delete it, restrict its use, object to processing, withdraw consent, or receive a portable copy where that right applies. You can object to direct marketing at any time. These rights have legal conditions and exceptions; for example, required financial records may need to be retained.

To make a request, email info@gfchealth.org with “Privacy request” in the subject line. Describe what you need and the email address or interaction that will help us locate the information. Do not send identity documents with your initial request. We may ask for proportionate verification or evidence that you are authorised to act for someone else.

We will respond without undue delay and within the deadline required by applicable law. Where the EU or UK GDPR applies, this is normally within one month, subject to lawful extensions. If we cannot fulfil a request, we will explain the reason and any available complaint route. Requests are normally free; any lawful exception will be explained.

For optional emails, use an unsubscribe link where provided or contact us. Necessary replies about an enquiry or donation are separate from promotional updates. To request removal of a public profile, image or story, include the page URL.

10. Security and incidents

We use HTTPS on the website. Security also depends on access controls, service-provider protections and how information is handled by people. No internet service can guarantee complete security. Avoid sending sensitive information through ordinary forms or email.

If a personal-data breach occurs, we will assess it and make notifications to regulators and affected people where required by the applicable law.

11. Children and automated decisions

Our general contact, subscription and donation services are intended for adults. Please contact us if you believe a child has provided information without appropriate authorisation, so we can assess it and arrange any necessary removal. We do not ask children to submit health information through this website. Any activity intentionally involving children requires suitable privacy information and the consent or other authorisation required by law.

The website’s ordinary enquiry and donation processes are not intended to make decisions with legal or similarly significant effects based solely on automated processing. Security tools and payment providers may use automated fraud or spam checks. If a decision affects your request, contact us so we can investigate and explain the available review options.

12. Questions, complaints and changes

Contact info@gfchealth.org about a privacy concern. You may also complain directly to the Mauritius Data Protection Office at dpo@govmu.org, or to the privacy regulator with jurisdiction over your concern. You do not have to contact GFCH before approaching a regulator. Where the EU or UK GDPR applies, you may complain to the appropriate supervisory authority.

We will update this page when our practices or applicable requirements change. The date at the top identifies the current version. If a change requires a separate notice or fresh consent, publishing revised wording alone will not replace that requirement.