Privacy Policy
Plain English explanations of how we collect, use, and fiercely protect your personal and health information.
Welcome to Heala Health. This policy explains our data practices. Please review this document alongside our Terms of Service.
Questions? Contact our team at contact@healahealth.com.
1. Who We Are
Heala Health Ltd is a digital healthcare platform incorporated and operating across Nigeria. We act as the Data Controller for your information under the NDPR.
This means we determine how and why your personal data is processed. Our goal is to provide a unified, secure health ecosystem for patients and doctors.
If you have any questions regarding your data, you can reach our Data Protection Officer directly at dpo@healahealth.com.
2. What Data We Collect
We collect account details (name, email), health information (symptoms, history), and basic device analytics to make the platform work.
- Account Info: Name, email address, phone number, date of birth, and location.
- Health Info (Sensitive Data): Symptoms, medical history, prescriptions, allergies, lab results, consultation notes, AI symptom-checker conversations, and health records you upload.
- Payment Info: Processed securely via Paystack. We do not store your actual card numbers on our servers.
- Automated Data: Device type, IP address, and crash reports to fix technical issues.
3. How We Use Your Data
We only use your data to connect you with doctors, maintain your digital health wallet, and improve our AI triage system.
We use your information strictly to provide the service you signed up for. We never sell your personal or health data to third parties, and we do not use your health data for advertising.
- Managing your unique Heala Health ID.
- Operating the AI symptom checker for early health guidance.
- Sending appointment reminders and digital prescriptions.
- Detecting and preventing fraud or misuse.
4. Health Data & Security
Your medical records are protected with bank-grade encryption. Only you and the doctors you authorize can view your files.
- Sensitive health fields — including symptoms, AI triage conversations, diagnoses, prescriptions, allergies, clinical notes, and text extracted from uploaded records — are protected with field-level encryption at rest using AES-256-GCM authenticated encryption. This means that even in the event of a database breach, these fields remain unreadable ciphertext.
- Uploaded files and documents are stored with AES-256 server-side encryption.
- All data in transit is protected with TLS (HTTPS).
- Access to your records is controlled: only you and the doctors you explicitly authorise can view your files, and you can revoke a doctor's access at any time.
- Accounts are protected with two-factor authentication (2FA), and access to your data is logged.
5. Who We Share Data With
We share your data only with the doctors you choose, and the secure cloud providers (like AWS and Paystack) that power our app.
We rely on trusted infrastructure providers to operate safely. These include Amazon Web Services (AWS) for secure cloud hosting and storage, AWS Bedrock (running Anthropic's Claude models within AWS) for AI symptom guidance, and Paystack for payment processing. Your AI triage data is processed within our AWS environment and is not used to train third-party models. All providers are bound by strict data processing agreements.
We may also disclose data if legally required by a Nigerian court order or in emergency situations to protect your life.
6. Your Rights (NDPR)
You have the right to access, correct, or completely delete your data from our servers at any time.
Under the Nigeria Data Protection Regulation (NDPR) 2023, you have the right to be forgotten. If you request account deletion, we will wipe your personal data within 30 days (except where medical retention laws require otherwise).
To exercise your rights, email contact@healahealth.com.
Contact Our Privacy Team
We take your privacy seriously. If you need to request a data deletion or have specific security concerns, contact our Data Protection Officer.