Privacy Policy

1. Introduction

Myndora Care is a community health worker (CHW)-powered home health monitoring and care coordination platform designed to help families monitor loved ones through verified remote checks, physical home visits, vitals reporting, and family dashboard visibility.

We are committed to protecting your privacy and handling personal and health-related information responsibly, in accordance with applicable data protection laws in Nigeria, including the Nigeria Data Protection Regulation (NDPR) and related guidance issued by the Nigeria Data Protection Commission (NDPC), where applicable.

By accessing or using our Services, you acknowledge that you have read and understood this Privacy Policy. If you do not agree with this policy, please do not use the Services.

2. Data Controller

The data controller responsible for your personal information is:

For privacy-related inquiries, data subject requests, or complaints, please contact us using the details above.

3. Information We Collect

Data minimization principle: We collect only the information necessary for health monitoring, service reporting, visit verification, safety escalation, and platform operations. We do not collect more data than is reasonably required for these purposes.

3.1 Basic demographics

We may collect limited demographic and profile information, including:

• Full name and preferred name
• Age or age range
• General location or service area (not full private addresses exposed to unauthorized parties)
• Emergency contact details
• Caregiver and sponsor relationship information
• Preferred language (e.g., English or Yoruba)

3.2 Health vitals for monitoring

For ongoing health monitoring, we collect only basic health vitals and related context, including:

• Blood Pressure readings
• Blood Sugar readings
• Date, time, and method of measurement
• CHW or device-reported contextual notes related to the reading
• Abnormal-reading flags and escalation status

We do not require or routinely collect extensive medical histories, laboratory results, imaging, or other clinical records unless specifically needed and authorized for a supported service pathway.

3.3 Service verification data

To verify that care was actually delivered, we may collect:

• GPS location data at check-in (for physical visits, where enabled and consented)
• Timestamps of remote checks and home visits
• OTP, SMS, WhatsApp, or in-app confirmation records
• Visit codes, checklist completion status, and proof-of-service metadata
• CHW identity and assignment records

3.4 Account, consent, and technical data

• Account credentials and contact information (phone number, email address)
• Consent records, including date, method, and scope of consent
• Device identifiers, session logs, and audit trails for security-sensitive actions
• Communications with our support team
• Website usage data (e.g., pages visited) when you browse this site

4. Legal Basis and Patient Consent

We process personal and health-related information based on one or more of the following legal bases, as applicable under Nigerian data protection law:

• Explicit consent — particularly for processing health vitals and sharing health updates with family sponsors
• Contractual necessity — to deliver the Services you or your sponsor have requested
• Legitimate interests — to verify service delivery, prevent fraud, and maintain platform safety, balanced against your rights
• Legal obligation — where required by applicable law or regulatory authority

Consent may be captured through in-app confirmation, SMS or WhatsApp verification, OTP, signed acknowledgment, or other approved methods documented in our system.

You or the authorized patient/caregiver may withdraw consent at any time by contacting privacy@myndorasolutions.com. Withdrawal may limit or prevent continued use of certain Services where processing is necessary to deliver care coordination. We will explain any operational impact at the time of withdrawal.

5. How We Use Your Information

We use collected information for the following purposes:

• Delivering CHW-led remote checks and physical home visits
• Recording, displaying, and trending health vitals on authorized dashboards
• Sending notifications to sponsors, caregivers, and patients about completed services, missed checks, and abnormal readings
• Verifying visit proof and maintaining an audit trail of care delivery
• Escalating abnormal readings or reported symptoms to authorized parties for follow-up
• Vetting, assigning, and monitoring community health workers
• Resolving disputes, improving service quality, and preventing fraud
• Complying with legal obligations and responding to lawful requests
• Operating, securing, and improving the Myndora Care platform and website

6. Data Sharing and Disclosure

We do not sell your personal or health data. We may share information only as follows:

• Authorized family sponsors — only after valid patient or caregiver consent, and only for the patient they are authorized to monitor
• Assigned community health workers — limited to patients they are approved and assigned to serve
• Authorized caregivers — where consent and role permissions allow
• Admin and care coordinators — for vetting, quality oversight, dispute resolution, and escalation management
• Licensed clinician partners — only for flagged cases requiring clinical review within their licensed scope and authorized subscription pathway
• Service providers — trusted vendors who assist with hosting, SMS/WhatsApp delivery, payments, or identity verification, under contractual confidentiality and data protection obligations
• Legal and safety disclosures — where required by law, court order, or to protect the rights, safety, or security of individuals

All access is governed by role-based permissions. Users may only view records they are authorized to access.

7. Data Security

We implement technical and organizational measures designed to protect your information, including:

• Local secure caching — health metrics and sensitive visit data may be securely cached locally on CHW mobile devices to support offline-first field work, with protection via device-level security and app session controls where feasible
• Encrypted transmission — data transmitted between devices and our servers is sent via encrypted channels (such as TLS/HTTPS)
• Access controls — role-based access limits who can view, edit, or export personal and health data
• Audit logging — sensitive actions (including consent changes, record edits, and privileged admin operations) are logged with user, timestamp, and entity information
• Identity document protection — sensitive CHW identity and credential documents are restricted to authorized administrative users

No method of transmission or storage is completely secure. While we strive to protect your information, we cannot guarantee absolute security. Please notify us immediately at privacy@myndorasolutions.com if you suspect unauthorized access to your account or data.

8. Medical and Service Boundaries

Community health workers using the platform are strictly restricted from:

• Diagnosing medical conditions
• Prescribing medications or treatments
• Altering, recommending changes to, or discontinuing existing treatments
• Representing themselves as physicians or licensed clinicians unless they hold that qualification and operate within an authorized scope

Health vitals and alerts provided through Myndora Care are for monitoring and coordination purposes. They are not a substitute for professional medical advice, emergency care, or in-person clinical evaluation. If you believe someone is experiencing a medical emergency, contact local emergency services immediately.

9. Data Retention

We retain personal and health information only for as long as necessary to:

• Provide the Services and maintain care history for authorized users
• Meet legal, regulatory, and audit requirements
• Resolve disputes and enforce our agreements
• Maintain security and fraud-prevention records

When information is no longer needed, we will delete or anonymize it in accordance with our retention schedule and applicable law, unless a longer retention period is required or permitted.

10. Your Rights

Subject to applicable Nigerian data protection law (including the NDPR), you may have the following rights regarding your personal data:

• Right of access — request a copy of personal data we hold about you
• Right to rectification — request correction of inaccurate or incomplete data
• Right to erasure — request deletion of your data, subject to legal and operational limitations
• Right to restrict processing — request limitation of how we use your data in certain circumstances
• Right to object — object to processing based on legitimate interests, where applicable
• Right to withdraw consent — where processing is based on consent, without affecting the lawfulness of prior processing
• Right to lodge a complaint — with the Nigeria Data Protection Commission or other relevant supervisory authority

To exercise any of these rights, contact privacy@myndorasolutions.com. We will respond within the timeframe required by applicable law. We may need to verify your identity before fulfilling a request.

11. Children and Vulnerable Adults

Myndora Care may be used to coordinate care for elderly patients, individuals with chronic conditions, and other vulnerable adults who may have limited digital literacy or capacity to manage their own data.

Where a patient lacks capacity to provide consent, consent must be obtained from an authorized local caregiver, legal guardian, or family sponsor acting within the scope of their authority and applicable law.

We do not knowingly collect personal information from children under the age of 18 for independent account registration without appropriate parental or guardian authorization. If you believe we have collected information from a child without proper authorization, please contact us immediately.

12. International Data Transfers

Myndora Care is designed for families in Nigeria and may be used by diaspora sponsors located in other countries. If you access the Services from outside Nigeria, your information may be processed in Nigeria and, where necessary, transferred to service providers in other jurisdictions.

Where international transfers occur, we implement appropriate safeguards — such as contractual data protection clauses — to ensure your information receives a level of protection consistent with applicable law.

13. Changes to This Privacy Policy

We may update this Privacy Policy from time to time to reflect changes in our practices, technology, legal requirements, or Services. When we make material changes, we will update the "Last updated" date at the top of this page and, where appropriate, provide additional notice through the platform, email, or other reasonable means.

We encourage you to review this Privacy Policy periodically. Continued use of the Services after changes take effect constitutes acknowledgment of the updated policy, unless applicable law requires a renewed consent for specific processing activities.

14. Contact Us

If you have questions, concerns, or requests regarding this Privacy Policy or our data practices, please contact: