Data Governance Framework

1. Overview

The XeraCore Data Governance Framework establishes the principles, policies, and procedures that govern how data is collected, managed, used, and protected within the XeraCore digital health platform and research programme.

This framework ensures that all data activities align with ethical standards, legal requirements, and the rights and interests of beneficiaries, partner organisations, and research participants.

2. Governance Structure

2.1 Platform Ownership

XeraCore is a proprietary platform developed and owned by PROTUS. PROTUS maintains platform ownership and overall programme governance of the XeraCore initiative and its associated intellectual property.

2.2 Joint Data Ownership

Data collected through XeraCore deployments is governed through formal agreements between PROTUS and partner organisations. These agreements define data stewardship, access rights, permitted uses and responsibilities for data protection and compliance.

• Neither party can utilise data unilaterally
• All research applications require mutual consent
• Both parties share responsibility for data protection and compliance
• Benefits from data use are equitably distributed

2.3 Independent Oversight Alliance

An independent oversight alliance—including the SEB Foundation and MaineStream Consulting—actively monitors XeraCore's data pipelines. This collaborative governance ensures that all field data collection, linguistic curation, and research insights adhere to the highest international ethical standards and localised data sovereignty laws.

3. Core Governance Principles

4. Data Classification

XeraCore data is classified into the following categories, each with specific handling requirements:

5. Data Access and Use Policies

5.1 Access Control

Access to XeraCore data is governed by role-based access controls:

• Field Agents: Can capture and view data for beneficiaries they serve
• Clinicians: Can access identifiable health data for clinical decision-making
• Researchers: Can access pseudonymised datasets with appropriate ethical approval
• Programme Administrators: Can access aggregated data for monitoring and evaluation

5.2 Research Data Use

All research use of XeraCore data must:

• Receive approval from relevant ethical review boards
• Obtain consent from both joint data owners (PROTUS and partner organisation)
• Use pseudonymised or aggregated data wherever possible
• Comply with data sharing agreements and protocols
• Acknowledge data sources and contributors in publications

5.3 Prohibited Uses

XeraCore data may not be used for:

• Commercial purposes without explicit consent from data owners
• Discriminatory practices or profiling
• Re-identification of pseudonymised individuals
• Purposes incompatible with the original collection purpose

6. Data Security Measures

XeraCore implements comprehensive security measures:

• Encryption: All data encrypted in transit and at rest
• Offline Storage: Clinical data stored locally on secure devices
• Multi-Factor Authentication: Required for all user access
• Regular Security Audits: Independent security assessments conducted annually
• Incident Response: Documented procedures for data breach response
• Device Security: Rugged tablets with hardware-level security features

7. Compliance Framework

XeraCore maintains compliance with:

• GDPR: European data protection standards
• Ghana Data Protection Act (Act 843): National data protection requirements
• Zimbabwe Data Protection Act: National data sovereignty mandates
• POTRAZ Regulations: Telecommunications and data protection in Zimbabwe
• ISO 27001: Information security management standards (certification in progress)
• Good Clinical Practice (GCP): International clinical research standards

8. Data Quality and Integrity

To ensure data quality and integrity, XeraCore:

• Implements validation rules at the point of data capture
• Uses conflict resolution mechanisms for multi-device synchronisation
• Maintains immutable audit trails for all data modifications
• Conducts regular data quality assessments
• Provides training to field agents and clinicians on data collection standards

9. Governance Review and Updates

This Data Governance Framework is reviewed annually and updated as needed to reflect:

• Changes in legal and regulatory requirements
• Technological advancements and platform updates
• Lessons learned from programme implementation
• Feedback from beneficiaries, partners, and oversight bodies

10. Contact and Reporting

For questions about data governance or to report concerns: