Privacy Policy

1. Who We Are and Scope

Selorah Health Limited is the primary entity responsible for the Selorah platform. Depending on the context, we may act as a data controller (for account data, product analytics, and platform security) or as a data processor (when a hospital or research institution instructs us to process patient data under a Data Processing Agreement).

This Policy should be read together with our Terms of Use, Cookie Policy, and any role-specific notices shown in the product.

2. Data We Collect

Identity and account data: name, email, phone number, password hashes, role (patient, provider, researcher, insurer), organization ID, National Identification Number (NIN) where you provide it, language and country preferences.

Health and profile data: records you upload (titles, types, files), date of birth, blood group, genotype, and other profile fields you choose to store; emergency contacts where provided.

Usage and technical data: device type, browser, IP address, approximate location derived from IP, log events, access logs for shared records, crash diagnostics.

Transactional data: subscription status, limited payment metadata from processors (we do not store full card numbers), research reward or withdrawal records where applicable.

3. How We Collect Data

We collect data directly from you (registration, onboarding, uploads, forms), automatically through cookies and similar technologies (see Cookie Policy), and from authorized parties when you share records via QR tokens or invite a provider. We may receive limited data from identity or payment providers solely to complete authentication or billing.

4. Purposes and Legal Bases

We process data to: provide and secure the Services; authenticate users (including email, phone, or NIN login flows); enable record sharing and audit trails; improve product performance; communicate service notices; process payments; comply with law; and, with consent where required, send product updates or research opportunities.

Legal bases may include contract performance, legitimate interests (security, product improvement balanced against your rights), consent (marketing, certain cookies, optional research), and legal obligation.

5. Special Category / Health Data

Health data is sensitive. We process it to provide the Services you request, based on your explicit actions (upload, share) and applicable health-data rules in your jurisdiction. Hospitals and researchers using Selorah must ensure they have an independent lawful basis for any processing they control.

We design access controls so that staff portals only reach patient data through authorized workflows (for example valid QR tokens or patient-directed share).

6. Sharing and Recipients

We share data with: (a) recipients you authorize via share links or QR; (b) infrastructure and subprocessors (hosting, auth, storage, email) bound by contracts; (c) payment providers; (d) professional advisors under confidentiality; (e) authorities when required by law or to protect rights and safety.

We do not sell personal health information. Aggregated or de-identified insights may be used for product and public-health analytics in ways that do not reasonably identify you.

7. International Transfers

Data may be processed in countries other than where you live, including infrastructure regions used by our cloud providers. Where required, we use appropriate safeguards such as contractual clauses, vendor assessments, and access controls. You may request information about relevant safeguards by contacting us.

8. Retention

We retain account and health records for as long as your account is active and as needed to provide the Services. After deletion requests or account closure, we remove or anonymize personal data within a reasonable period, except where retention is required for legal claims, audits, security logs, or statutory obligations.

Access logs and security events may be kept for longer than primary records to investigate abuse.

9. Security

We implement administrative, technical, and organizational measures appropriate to the risk, including encryption in transit, access control, authentication, and monitoring. No method of transmission or storage is fully secure; you should use strong unique passwords and protect devices used to access Selorah.

Report suspected incidents to security@selorah.health promptly.

10. Your Rights

Depending on applicable law, you may have rights to access, correct, delete, restrict, or port your data, and to object to certain processing or withdraw consent. You may manage many profile fields in Settings. For formal requests, email privacy@selorah.health with enough detail to verify your identity.

You may lodge a complaint with a supervisory authority where available. We encourage you to contact us first so we can resolve concerns.

11. Children

The Services are not directed to children under 18 creating accounts on their own. Where a parent or guardian manages a minor’s health information, they are responsible for providing appropriate consent and accurate data.

12. Cookies and Similar Technologies

We use cookies and similar technologies as described in our Cookie Policy. Essential cookies support login and security; optional cookies support analytics or preferences where you consent.

13. Automated Decisions and Profiling

We do not make solely automated decisions that produce legal or similarly significant effects about you without human involvement, except as clearly disclosed for a specific feature (for example fraud checks). Product recommendations or ranking inside the app, if any, are for convenience and can be disregarded.

14. Changes and Contact

We may update this Privacy Policy by posting a new version with a revised “Last Updated” date. Material changes will be highlighted in the product or by email where appropriate.

Privacy contact: privacy@selorah.health — Selorah Health Limited. For processor arrangements, see the Data Processing Agreement.