Privacy Policy
Last updated: July 29, 2026
At a Glance
HealthIntel ("we", "us", "our") operates the healthintel.app website and mobile application. We help you understand your lab results and track your health — but your data belongs to you. This policy explains exactly what we collect, why we need it, and how we protect it. We comply with the Nigeria Data Protection Regulation (NDPR) and Nigerian Data Protection Act (NDPA) 2023.
1. Information We Collect
We only collect information that is necessary to provide our services. Here is the full breakdown:
| Category | Specific Data Points | Why We Need It |
|---|---|---|
| Account Information | Full name, email address, phone number (optional), hashed password | To create and secure your account, communicate with you, and verify your identity |
| Health Profile | Date of birth, biological sex, pregnancy status (if female), height (cm), weight (kg), blood type, medical conditions, current medications | To personalise lab result reference ranges (they differ by age, sex, and pregnancy status) and provide accurate interpretations |
| Lab Results | Test panel selected, individual test values (e.g., Hemoglobin: 13.2 g/dL), units, normal/abnormal flags, uploaded PDF lab reports, extracted text from PDFs | To generate AI-powered plain-language interpretations of your lab results |
| AI Interpretations | AI model used (DeepSeek), the prompt sent to the AI (which contains your lab values), AI-generated interpretation text, and guardrail/safety flags | To provide you with understandable lab explanations and maintain a history of your interpretations. Note: Your lab data is transmitted to DeepSeek's API for processing. See Section 7 for details. |
| Health Metrics & Trackers | Daily wellness tracking data (e.g., blood pressure, blood glucose, weight trends, sleep, water intake, exercise), metric types, recorded dates, notes | To help you track daily health habits and trends. You choose what to log — all tracking is voluntary. |
| Payment Information | Transaction reference, amount paid (in kobo), currency (NGN), payment provider (Paystack or Flutterwave), payment status, provider webhook logs | To process credit purchases and maintain transaction records. We do NOT store your card number, CVV, or bank details. All payment card data is handled securely by Paystack and Flutterwave (PCI-DSS certified). |
| Credit Transactions | Action type (purchase, usage, bonus, admin grant), credits added/used, balance after transaction | To maintain an accurate credit balance for your account |
| Appointments | Title, description, appointment date/time, provider name, status, notes, reminder preferences | To help you schedule and manage healthcare appointments |
| Symptom Checker Queries | Symptoms you enter, AI-suggested test panels, AI-generated responses | To suggest relevant lab tests based on symptoms. Sent to DeepSeek API for processing. |
| Feedback & Support | Feedback type, screen where submitted, message content, optional metadata | To improve the app based on user suggestions and resolve issues |
| Technical Data | IP address (logged temporarily), device type, browser/OS, app version, session tokens | For security (rate limiting, fraud detection), debugging, and service improvement |
2. How We Use Your Data
Your data is used exclusively to provide and improve HealthIntel's services:
- Core Service: Generating AI-powered lab result interpretations and symptom suggestions
- Personalisation: Tailoring reference ranges based on your age, sex, and health profile
- Account Management: Authentication, password resets, credit balance tracking, transaction history
- Communication: Sending essential service updates (never marketing emails without consent)
- Appointment Reminders: Notifying you of upcoming appointments if you enable reminders
- Product Improvement: Analysing anonymised, aggregated usage patterns to improve features
- Legal Compliance: Meeting obligations under Nigerian law and responding to lawful requests
We DO NOT:
- Sell your personal data to third parties
- Use your health data for advertising or marketing
- Share your lab results with employers, insurers, or family members
- Use your data to train AI models (your data is only processed for your own interpretations)
3. Legal Basis for Processing
Under the NDPR and NDPA, we process your data on the following lawful bases:
- Consent: You explicitly provide your data when you create an account and enter health information. You may withdraw consent at any time by deleting your account (see Section 8).
- Contractual Necessity: We need certain data (email, lab values) to deliver the AI interpretation service you requested.
- Legitimate Interest: We process anonymised usage data to improve the service, and IP addresses for security (rate limiting, abuse prevention).
- Legal Obligation: We may retain transaction records as required by Nigerian tax and financial regulations.
4. Data Storage & Retention
- Where data is stored: All data is stored on secure servers located in Nigeria (hosted by Namecheap / cPanel). Database backups are encrypted.
- Retention period:
- Account data: Retained until you delete your account
- Lab submissions & interpretations: Retained until you delete your account (you may also delete individual submissions)
- Health metrics & tracker data: Retained until you delete your account or manually clear the data
- Payment records: Retained for 7 years as required by Nigerian financial regulations (CBN guidelines)
- Session data: Expires automatically after 30 days of inactivity
- Server logs (IP addresses): Retained for 30 days, then automatically purged
- Uploaded PDFs: Lab report PDFs you upload are stored on our server until your account is deleted. You may request earlier deletion (see Section 8).
5. Data Security
We take your health data security seriously. Our security measures include:
- Encryption in transit: All data between your device and our servers is encrypted using TLS (HTTPS). Our domain (
healthintel.app) uses SSL/TLS certificates with modern cipher suites. - Encryption at rest: Passwords are hashed using bcrypt (12 rounds). Sensitive database fields are restricted.
- Authentication: We use Laravel Sanctum token-based authentication. Tokens are valid for 30 days and can be revoked at any time.
- Rate Limiting: API endpoints are rate-limited to prevent brute-force and abuse. Login is limited to 10 attempts per minute; registration to 6 per minute.
- Access Control: Only authorised administrators with role-based permissions can access the admin panel. All admin actions are logged in an audit trail.
- Payment Security: All payment card data is handled exclusively by PCI-DSS Level 1 certified processors (Paystack and Flutterwave). We never see or store your card details.
While we implement industry-standard safeguards, no method of electronic storage is 100% secure. If we detect a data breach involving your personal health information, we will notify you within 72 hours as required by the NDPR.
6. Who We Share Your Data With
Third-Party Service Providers (Data Processors)
We use the following services to operate HealthIntel. Each is contractually bound to process your data only per our instructions:
| Service | Purpose | Data Shared | Location |
|---|---|---|---|
| DeepSeek | AI lab result interpretation, symptom analysis, PDF report interpretation | Lab values, test names, unit measurements, health profile data (age, sex, pregnancy status), symptoms, PDF text. DeepSeek's privacy policy states they do not use API customer data for model training. | Global (API endpoints) |
| Paystack | Payment processing for credit purchases | Email, transaction reference, amount. Card details are collected directly by Paystack — never by us. | Nigeria (PCI-DSS Level 1) |
| Flutterwave (optional) | Alternative payment processing | Email, name, transaction reference, amount. Card details are collected directly by Flutterwave. | Nigeria (PCI-DSS Level 1) |
When We May Disclose Data
We will only disclose your data in these limited circumstances:
- Legal obligation: If required by Nigerian law, court order, or government regulation (e.g., NDPC)
- Vital interests: In a medical emergency where disclosure may protect your life or health
- Business transfer: If HealthIntel is acquired or merged, your data would transfer to the new entity under the same privacy commitments
- With your consent: For any other purpose, we will ask your explicit permission first
7. AI & Automated Decision-Making
HealthIntel uses DeepSeek AI (deepseek-v4-flash) to generate lab result interpretations, symptom analysis, and PDF report summaries. Here's what you should know:
- What happens: When you submit lab results or symptoms, we build a prompt containing your test values and health profile. This prompt is sent to DeepSeek's API. The AI generates a plain-language explanation, which we display to you.
- Not medical diagnosis: Every AI interpretation includes a clear disclaimer: "This is NOT medical advice. Please consult a licensed healthcare professional." Our AI does not make medical decisions — it only translates lab data into understandable language.
- Guardrails: We include strict safety prompts that prevent the AI from claiming to diagnose diseases, recommending medications, or providing dosages.
- Data sent to DeepSeek: The prompt contains your lab values (e.g., "Hemoglobin: 13.2 g/dL"), test names, age, sex, pregnancy status if applicable, and symptoms. No directly identifying information (name, email, phone) is included in the AI prompt.
- DeepSeek's data policy: Per DeepSeek's API terms, they do not use customer API data for model training. The data is processed ephemerally and not stored by DeepSeek beyond what is needed to generate the response. We recommend reviewing DeepSeek's API documentation for their latest privacy practices.
8. Your Rights Under Nigerian Data Protection Law
Under the NDPR and NDPA, you have the following rights:
You can request a copy of all personal data we hold about you, including lab submissions, interpretations, and health metrics.
You can update your profile, health information, and tracker data at any time through the app. If you find errors, you can correct them directly or request our help.
You may delete your account at any time. This permanently removes your profile, lab submissions, interpretations, health metrics, tracker data, appointments, and credit history. Payment records may be retained for 7 years per Nigerian financial regulations (in anonymised form if requested).
You can object to processing of your data. For essential service data, this may mean we can no longer provide AI interpretations. For non-essential data (trackers, appointments), you can simply stop using those features.
You can request your data in a structured, machine-readable format (JSON/CSV). This includes your lab results, health metrics, and interpretations — so you can share them with your doctor.
If you believe your data rights have been violated, you may lodge a complaint with the Nigeria Data Protection Commission (NDPC) at ndpc.gov.ng.
9. Cookies & Tracking
- Essential session cookies: We use a single session cookie to keep you logged in. This is strictly necessary for the service to function.
- No advertising cookies: We do not use third-party advertising cookies, tracking pixels, or analytics cookies on our website or mobile app.
- No cross-site tracking: We do not track your activity across other websites or apps.
- Mobile app: The mobile app stores an authentication token locally using secure device storage (AsyncStorage / EncryptedStorage), not browser cookies.
10. Children's Privacy
HealthIntel is not intended for use by children under the age of 16 without parental consent. If you are a parent or guardian and believe your child has provided us with personal data, please contact us immediately. We will take steps to delete such information.
11. Changes to This Policy
We may update this privacy policy from time to time. If we make material changes, we will:
- Post the updated policy on this page with a new "Last updated" date
- Send an email notification to registered users at least 14 days before the changes take effect
- Display an in-app notice the next time you open the mobile app
Your continued use of HealthIntel after the effective date constitutes acceptance of the updated policy.
12. Data Protection Officer & Contact
If you have any questions, concerns, or wish to exercise your data rights, please contact our Data Protection Officer:
Email: privacy@healthintel.app
Response time: We aim to respond to all privacy-related requests within 48 hours and resolve them within 30 days (as required by NDPR).
NDPC: You may also contact the Nigeria Data Protection Commission at ndpc.gov.ng