Privacy, consent and control

1. Who we are

Ofure is operated by Ofure Health Technologies Limited ("Ofure", "we", "us"), a company based in Nigeria at Airport Road, Abuja. This policy applies to the Ofure mobile app, the Ofure website, and any Ofure admin, provider, or employer portal (together, the "Service").

Our Data Protection Officer can be reached for privacy questions, correction, deletion, access requests, or complaints at privacy@ofure.health.

2. Personal data we collect

We collect only what is needed to help you track and complete preventive-care steps. Depending on how you use Ofure, this can include:

• Account and profile data: full name, phone number, email address, date of birth, sex, and state of residence in Nigeria.
• Health data (sensitive personal data): preventive-care risk factors you provide, screening and journey status, blood pressure and weight readings you log, self-reported health events, and any documents you choose to upload (e.g. test results, referral letters).
• Care relationships: if you add a trusted contact, sponsor, or link to a family member's profile, we record that relationship and the specific consent permissions you grant or receive.
• Location: only if you grant permission, used to show nearby clinics, labs, and facilities relevant to your reminders. Location is not collected if you decline this permission.
• Camera: only if you choose to scan a document, used to capture and upload health documents such as lab results or prescriptions. The camera opens only for that scan; Ofure does not access your photo library or camera roll, and the captured image is used only for the document you chose to scan.
• Device and technical data: push-notification token, app version, and basic error/crash diagnostics used to keep the Service reliable.
• Employer, provider, and admin accounts: if you use an employer, provider, or staff portal, we collect the organisation, role, and access details needed to operate that portal.
• Waitlist and contact submissions: name, email, phone, and the information you choose to share when joining our early-access waitlist or contacting us.
• Business WhatsApp messages: if you choose to contact Ofure through our Business WhatsApp number, we collect your WhatsApp number, profile name, message content and limited message-delivery metadata so authorised staff can respond to your request. Please do not send urgent medical information through WhatsApp.

3. Why we collect it (legal basis)

Because health information is sensitive personal data under Nigeria's data protection law, we only process it with your explicit, informed consent, or where necessary to provide a service you have asked for. Specifically, we rely on:

• Your consent — for health data you log or upload, and for any sharing with a trusted contact, sponsor, or provider, which you grant and can withdraw at any time.
• Performance of a service you requested — for account creation, reminders, and the core preventive-care tracking features.
• Legitimate interest — for basic security, fraud prevention, and service-reliability monitoring, always balanced against your rights.
• Legal obligation — where we are required to retain or disclose limited information by law.

4. How we use your data

• To create and maintain your account and preventive-care profile
• To show you due screening/preventive actions and send reminders
• To connect you with relevant facilities, providers, and services
• To let you share specific, permissioned information with a trusted contact or sponsor you choose
• To operate employer, provider, and admin portals for organisations you or your employer has connected to Ofure
• To detect, prevent, and respond to fraud, abuse, and security incidents
• To receive and triage messages you choose to send to Ofure through Business WhatsApp
• To improve the Service, fix bugs, and understand basic product usage

We do not use your health data to train third-party advertising systems, and we do not sell your personal data.

5. Who we share data with

We do not sell your personal data. We share it only in these circumstances:

• People you explicitly grant access to — a trusted contact, family sponsor, or care supporter only sees what you specifically consent to share, and only for as long as that consent is active. You can revoke it at any time.
• Providers and facilities you choose to connect with through the Service, for the purpose of completing a referral, appointment, or screening.
• Ofure staff, on a limited, role-based, and logged basis, strictly to operate, support, and secure the Service — never to sell or market to you.
• Service providers who process data on our behalf, under contract and only for the purpose we specify. These currently include: Supabase (database, authentication, and file storage), Vercel (website hosting), Resend (transactional email delivery), Sentry (error and crash monitoring), hCaptcha (bot protection on public forms), Upstash (technical rate limiting, no personal content), and Firebase/Expo push notification services (delivering reminder notifications to your device), Meta/WhatsApp Business Platform (receiving and delivering WhatsApp service messages), and Google Maps Platform (returning nearby health-facility listings when you choose to search using your current location). Ofure does not store the coordinates sent for that search or the returned Google listing content.
• Legal or safety reasons — if required by law, or to protect the rights, safety, or property of Ofure, our users, or the public.

Some of these service providers may process or store data outside Nigeria. Where that happens, we require contractual and technical safeguards appropriate to the sensitivity of the data involved.

Google Maps Platform processing is also governed by the Google Privacy Policy.

6. How we protect your data

• Data is encrypted in transit (HTTPS/TLS) between your device and our servers.
• Access to your health data is enforced at the database level by row-level security, not just application logic — so even internal tools must go through the same consent and role checks.
• Staff access to patient data is role-restricted and audit logged.
• We monitor for errors and security issues using automated tooling, without exposing your health data content in those tools.

No system is perfectly secure. If we become aware of a data breach affecting your personal data, we will notify affected users and the relevant regulator as required by law.

7. Cookies and similar technologies

Ofure uses essential cookies and similar browser storage to keep authenticated sessions secure, protect restricted pages, and record your cookie choice. We do not use advertising, behavioural-profiling, or analytics cookies.

The cookie-choice notice records your acceptance of essential cookies for one year. Essential cookies cannot be disabled from within the Service because they are necessary for secure sign-in and protected features. You can remove browser storage through your browser settings, but doing so may sign you out or cause the notice to be shown again. Any future non-essential cookies will remain blocked until you are offered a separate opt-in choice.

8. Data retention

We retain your personal and health data for as long as your account is active, so the Service can keep working the way you expect. If you delete your account or ask us to delete your data, we will delete or irreversibly anonymise it within 30 days, except:

• information we are required to keep by law (for example, for tax, audit, or legal-dispute purposes), which we retain only for as long as legally required; and
• residual copies in encrypted backups, which are purged on our routine backup-rotation schedule (within 90 days).

9. Your rights

Under Nigeria's Data Protection Act and its implementing regulation (NDPR), you have the right to:

• Access the personal data we hold about you
• Correct inaccurate or incomplete data
• Request deletion ("erasure") of your data, subject to the retention exceptions above
• Withdraw consent for any processing that relies on consent, at any time
• Object to or request restriction of certain processing
• Request a portable copy of the data you provided to us
• Lodge a complaint with the Nigeria Data Protection Commission (NDPC), or your local data protection authority

To exercise any of these rights, email privacy@ofure.health. We will respond within a reasonable time and in line with legal requirements.

10. Children and minors

Ofure is currently intended for adults (18 years and older) managing their own preventive care, or a family sponsor/trusted contact supporting another adult. We do not knowingly collect data directly from minors at this time. Support for tracking a minor's care under a parent or guardian's account is a feature we plan to introduce in future, with its own dedicated consent and safeguards.

11. Clinical boundaries

Ofure helps you track and navigate preventive-care steps. It does not diagnose conditions, interpret complex results, or replace a qualified clinician. Nothing in the Service should be treated as medical advice.

12. Changes to this policy

We may update this policy as the Service evolves. Material changes will be reflected by an updated "last updated" date on this page, and where appropriate, we will notify you directly.

13. Contact us

Ofure Health Technologies Limited, Airport Road, Abuja, Nigeria.
General support: support@ofure.health
Data Protection Officer: privacy@ofure.health