Privacy Policy

Document Reference: VS-DRC-PP-001  ·  Version 1.0 — July 2026

Issued by	Ministry of Public Health, Hygiene and Social Welfare, Democratic Republic of the Congo
Operated by	Dure Technologies, on behalf of the Ministry of Public Health, Hygiene and Social Welfare, DRC
Applicable System	Voyage Santé+ DRC — Ebola & Epidemic Disease Screening Platform
Deployment Site	Designated Points of Entry, DRC (specific site(s) to be confirmed by the Ministry)
Languages	French (primary) | English (secondary)
Classification	Public — available on request at all screening points

1. Introduction

Voyage Santé+ DRC is a digital health screening system operated at designated Points of Entry in the Democratic Republic of the Congo (DRC), including international airports, river/seaports, and land border crossings. It is commissioned and governed by the Ministry of Public Health, Hygiene and Social Welfare of the DRC (hereafter "the Ministry") and operated by Dure Technologies (hereafter "Dure") as the technical service provider.

The system screens arriving travellers for Ebola and other epidemic diseases, generates a Traveller Health Pass, and transmits surveillance data in real time to COUSP (Centre des Opérations d'Urgences de Santé Publique), the national public health emergency operations centre operated under the Institut National de Santé Publique (INSP). Screening may be completed by the traveller via WhatsApp (Self-Screening — Flow 1) or by a health officer on the traveller's behalf using the Converse application (Assisted Screening — Flow 2).

This Privacy Policy explains what personal and health data is collected during screening, how it is used, who it is shared with, how it is protected, and what rights travellers have over their data. By proceeding with screening, travellers acknowledge this policy. Screening is mandatory under Ministry regulations at designated Points of Entry.

2. Data Controller and Data Processor

Data Controller: Ministry of Public Health, Hygiene and Social Welfare, Democratic Republic of the Congo. The Ministry determines the purposes and means of processing personal data collected by Voyage Santé+ DRC. All data collected remains the property of the Ministry.

Data Processor: Dure Technologies, Geneva, Switzerland (with technical operations in India). Dure processes data solely on behalf of and under the instructions of the Ministry. Dure has no independent right to use traveller data for any purpose beyond operating and maintaining the Voyage Santé+ DRC system.

3. What Data We Collect

3.1 Identity Data (from Passport / Travel Document)

The following fields are extracted via Optical Character Recognition (OCR) from the traveller's passport bio-page, or entered manually where OCR is unavailable:

• Full name
• Sex (M/F)
• Date of birth
• Nationality
• Passport / travel document number (stored as a hash; plain-text number is never retained)
• Document type
• Document expiry date (optional; for data warehouse record only)

3.2 Travel Information

• Point of entry (airport, port, or land border crossing)
• City and date/time of arrival (auto-captured from session)
• Flight or vehicle number
• Country of immediate origin
• All countries visited in the previous 21 days

3.3 Health Screening Data

Answers to the Ministry's Health Screening Form for Travellers at Points of Entry, specifically:

• Nine symptom questions (fever, vomiting, diarrhoea, weakness, cough, difficulty breathing, jaundice, skin rash, unusual bleeding) — Yes/No responses
• Two exposure questions (contact with a sick or deceased person; visit to an epidemic-affected area in the last 21 days) — Yes/No responses plus free-text epidemic detail if applicable
• Two vaccination questions (Yellow Fever vaccination status and date; other recent vaccinations) — informational only, no risk impact
• Measured body temperature in °C (entered by a health officer for all screenings)

3.4 Contact & Session Data

• WhatsApp phone number (Self-Screening) — used to deliver the Traveller Health Pass and communicate session status
• Session ID, session timestamps, and session type (Self-Screening or Assisted)
• Worker ID for health officers completing or assisting with screenings
• Declaration timestamp — the moment the traveller confirms and submits their answers

3.5 System and Audit Data

• IP address and device identifiers of health officer devices (Converse app/web)
• Audit log entries: every create, read, update, and delete action, with actor ID and UTC timestamp

The system does NOT collect biometric data (fingerprints, facial images), payment information, or any data beyond what is described above.

4. How We Use Your Data

Voyage Santé+ DRC uses traveller data for the following purposes only:

• Health screening: running the rule-based risk scoring engine to determine whether a traveller is cleared (Green Pass) or high-risk (Red Alert), in accordance with the Ministry's clinical case definitions.
• Traveller Health Pass generation and delivery: sending the Green Pass or Red Alert to the traveller via WhatsApp; displaying it on the health officer's Converse device.
• Public health surveillance: transmitting anonymised and aggregated screening records to the Centralized Data Warehouse and the COUSP national command centre in real time, to support epidemic monitoring and response.
• High-risk alert notification: automatically notifying on-site health officers and the COUSP dashboard when a Red Alert is issued, to enable immediate clinical follow-up.
• Quality assurance and system integrity: audit logging of all system actions to ensure data accuracy and to support investigation of any errors or disputes.

Traveller data is NOT used for commercial profiling, marketing, advertising, or any purpose unrelated to public health screening and surveillance.

5. WhatsApp as a Data Channel

The Self-Screening flow operates over WhatsApp, using the Meta WhatsApp Business API. Travellers initiate the screening by scanning a QR code and messaging the Voyage Santé+ DRC WhatsApp Business number. The following applies to this channel:

• The traveller's WhatsApp phone number is collected and used as the delivery address for the Traveller Health Pass. It is also stored as part of the screening record.
• Meta (WhatsApp's parent company) processes messages in transit in accordance with Meta's own privacy policy and terms of service. Travellers should be aware that Meta's infrastructure handles their messages as part of the WhatsApp platform.
• Message content entered by the traveller — including symptom answers, passport photos, and travel details — is transmitted to the Voyage Santé+ DRC backend server via the WhatsApp Business API. Processing (including OCR) occurs server-side, not within WhatsApp's infrastructure.
• No personal health screening data is retained within WhatsApp's message history beyond the active session window.
• Template messages (Welcome, Pass delivery, High-risk alert) are pre-approved by Meta as required by the WhatsApp Business API policy.

6. Passport Scanning and OCR Processing

When a traveller uploads a photo of their passport bio-page during Self-Screening, the image is transmitted over an encrypted connection to the Voyage Santé+ DRC backend server. The server forwards the image to a commercial OCR service (Google Vision API or AWS Textract) solely to extract the identity fields listed in Section 3.1.

• The passport image is deleted from all server storage immediately after extraction — before any other processing occurs.
• The OCR service provider processes the image under a data processing agreement with Dure and is prohibited from using the image for any other purpose.
• Passport numbers are stored only as a bcrypt hash plus the last three digits. The full passport number in plain text is never stored in any database, log, or backup.
• If OCR confidence is below 70% for any mandatory field, the traveller is prompted to enter that field manually. After three failed upload attempts, all fields switch to manual entry.
• Assisted Screening (Flow 2) supports barcode/chip scanning of the passport via the health officer's device as an alternative to OCR.

7. How We Share Your Data

Voyage Santé+ DRC shares traveller data only as described below. No data is sold to third parties.

7.1 Ministry of Public Health, Hygiene and Social Welfare, DRC

All screening records are transmitted to the Ministry's Centralized Data Warehouse and made available to authorised Ministry officials and COUSP analysts. High-risk alerts are transmitted within five seconds of issuance. The Ministry is the Data Controller and has full access to all records.

7.2 On-Site Health Officers and Port Supervisors

Health officers at each point of entry can view screening sessions submitted at their port during their shift. Port Supervisors have additional access to override pass outcomes within one hour of issuance, with a mandatory reason code. Officers cannot view records from other ports or other officers' sessions unless assigned the Supervisor role.

7.3 OCR Service Providers

Passport images are shared with the contracted OCR provider (Google Vision API or AWS Textract) solely for the purpose of identity field extraction. Images are deleted immediately after processing and are not retained by the OCR provider beyond their standard processing pipeline.

7.4 WhatsApp / Meta

As described in Section 5, Meta processes WhatsApp messages as part of the platform infrastructure. This is inherent to the use of WhatsApp as a delivery channel.

7.5 Legal Disclosure

Data may be disclosed to competent authorities if required by the laws of the Democratic Republic of the Congo, international health regulations (IHR 2005), or a lawful order from a court or regulatory body. Disclosure will be limited to what is legally required and, where possible, the Ministry will be notified in advance.

8. Data Retention

Data Type	Retention Period & Treatment
Passport image	Deleted immediately after OCR extraction — not stored
Passport number (plain text)	Never stored — replaced with bcrypt hash + last 3 digits at time of capture
Screening records (health data, identity fields, travel data)	90 days from date of collection, then anonymised per Ministry data governance policy
Anonymised surveillance data	Retained indefinitely for public health research and epidemic monitoring
Audit logs	Retained for a minimum of 2 years for regulatory compliance and dispute resolution
Traveller Health Pass	Valid for 6 days from issuance. Pass token invalidated on expiry.

9. Security

Voyage Santé+ DRC implements the following technical and organisational security measures:

• Encryption at rest: all stored data is encrypted using AES-256.
• Encryption in transit: all API communications and webhook endpoints use TLS 1.2 minimum (HTTPS enforced).
• Authentication: all API calls use JWT Bearer tokens with 8-hour expiry. Role-based access control restricts data visibility by port, role, and shift.
• Passport data: images deleted immediately post-OCR; numbers stored only as bcrypt hash. No plain-text PII in any log file.
• Server-side OCR only: passport images are never processed client-side. They leave the traveller's device only via an encrypted connection to the screening backend.
• Audit logging: every data access, creation, update, and deletion is logged with actor ID and timestamp.
• Offline data: Converse app offline cache is stored on the health officer's device only for the duration of the connectivity gap and is synced and cleared upon reconnection.
• Penetration testing and vulnerability monitoring: the system is subject to regular security assessments in accordance with Dure's security programme.

10. Traveller Rights

Travellers have the following rights with respect to their data, subject to applicable law and the Ministry's data governance policy:

• Right of access: you may request a copy of the screening record associated with your session. Requests should be directed to the health officer at the point of entry at the time of screening, or to the Ministry contact listed in Section 12.
• Right to correction: if you believe any field in your screening record is inaccurate, you may request correction before submission (via the Edit Answers function in the chatbot or the health officer's review screen). Post-submission corrections require a formal request to the Ministry.
• Right to explanation: you may request an explanation of the risk scoring outcome that produced your pass result. The scoring rules are rule-based and deterministic (no machine learning); the hard flags that triggered a Red Alert can be shared with you on request.
• Right to a human review: if you receive a Red Alert, you have the right to a clinical assessment by a health officer before any further action is taken.

Please note: as screening is mandatory under Ministry regulations at designated Points of Entry, the right to withdraw consent or to object to processing does not apply to the core screening function. Data processed purely for surveillance and research purposes (after anonymisation) falls outside individual traveller rights.

11. Legal Basis for Processing

Processing of traveller data by Voyage Santé+ DRC is based on the following grounds:

• Public health mandate: the Ministry of Health is authorised under national legislation and the International Health Regulations (IHR 2005) to collect health screening data from travellers at Points of Entry during declared or potential epidemic events.
• Legal obligation: submission of health screening data is mandatory for arriving travellers at designated Points of Entry in the Democratic Republic of the Congo during periods of elevated epidemic risk.
• Vital interests: processing is necessary to protect the vital interests of travellers and the public in the context of Ebola and other epidemic disease risk.

12. Contact and Complaints

For questions about this Privacy Policy or your data, please contact:

Ministry of Public Health, Hygiene and Social Welfare, Democratic Republic of the Congo
Designated Data Protection Officer: Ministry of Public Health, Hygiene and Social Welfare, Kinshasa, Democratic Republic of the Congo
Email: data-protection@sante.gouv.cd (to be confirmed by Ministry)
On-site: speak to a health officer or port supervisor at any Voyage Santé+ DRC screening point.

Technical Operator:
Dure Technologies | Geneva, Switzerland | support@duretech.com

13. Updates to this Policy

The Ministry may update this Privacy Policy to reflect changes in the system, legal requirements, or data processing practices. The version number and date on this document will be updated accordingly. Significant changes will be communicated to travellers via notices at screening points and on the Voyage Santé+ DRC WhatsApp Business profile.

This policy is available in French and English at all Voyage Santé+ DRC screening points and on request from Ministry staff.