Legal

Privacy Policy

Last updated: May 2026.

Before reading our Privacy Policy there are a few things that are especially important for our users to understand about how we manage their data.

Natsuwa does not and will never sell any personal data or identifiable health information. We built this product to help people living with Sickle Cell Disease. Selling your data would contradict everything we are trying to do.
Natsuwa does not share any personally identifiable health data with third-party companies. With your explicit separate consent, collected through a formal research consent process, anonymised health data with all identifying information removed may contribute to Sickle Cell Disease research. This is entirely optional and never affects your access to the app.
Your health data is stored in infrastructure that we control and operate. It is not passed to third-party analytics services, advertising platforms, or AI APIs. All connections are encrypted. We do not use your health data to train external machine learning models.
Natsuwa is compliant with the Nigeria Data Protection Act 2023 (NDPA) and the General Application and Implementation Directive 2025 (GAID).
Natsuwa collects as little personally identifiable data as possible. Your name does not appear in the same database record as your health readings.
The Emergency QR card displays a summary of your health data to medical staff when scanned. You control whether this card is active through the app settings. No account or login is required to view it. This is intentional: doctors can access it in an emergency even if you cannot unlock your phone.

We recognise the sensitive nature of the health data that you choose to track with Natsuwa and strongly believe in the importance of data security, privacy, and anonymity. We take your privacy seriously and we hope that you find this policy clear and transparent.

Introduction

This privacy policy explains how we, the Natsuwa team ("Natsuwa", "us", "we", or "our"), use your personal data to provide you with the Natsuwa health monitoring application and website.

We are committed to protecting and respecting your privacy. Please read this policy carefully as it contains important information about what personal data we collect from you and how we will use it. Any questions should be sent to team@natsuwa.app.

Natsuwa is a pre-pilot health monitoring application operated by the Natsuwa team, contact: team@natsuwa.app.

How we process your data

To register an account, you enter your email address and choose a password. Once registered, your data is backed up securely and you can access your history across sessions.

There are two main purposes for which we process personal data.

1. To provide our services

We do not and will never sell any personal data about you to third parties. When you use the Natsuwa app, we collect, store, and use some personal data to verify you as a user, provide the service, and send you clinical alert messages. Our lawful basis for this processing is that it is necessary for the performance of our agreement with you.

These are the types of data we collect for the above purpose:

Account information

Your email address and a hashed (one-way encrypted) password. Used to send you alerts and let you log in. We never store your password in plain text.

Daily health logs

Pain score (0-10), urine colour, and hydration level submitted through the app each day. These are the inputs to the pattern analysis engine. Stored against a UUID. Your name does not appear in the same database record as your health readings.

Analysis results

The output of the anomaly detection model: risk level and triggered flags. Stored alongside your log so you can see your pattern history over time.

Clinical profile

Genotype (HbSS or HbSC), whether you have asthma, and your registered clinic phone number. Used to personalise alerts and populate the Emergency QR card for first responders.

City-level weather

Temperature for your registered city, fetched from the Visual Crossing API. We store your registered city name, not your GPS coordinates. If you travel, you can request a city update by emailing team@natsuwa.app. We are exploring optional location permissions in a future version to improve alert accuracy for users who travel frequently.

Emergency QR card

The Emergency QR card is a read-only summary of your clinical profile (genotype, comorbidities, current medications, and recent health flags), accessible without login when scanned. This is intentional: the card is designed to function in emergency settings where you may be unable to unlock your phone. You control whether your QR card is active through the app settings. Deactivating the card makes it unreadable to anyone who scans it.

2. To deliver personalised pattern insights

The health data you log in Natsuwa is sensitive personal data. Natsuwa does not store sensitive personal data without your explicit consent. It is only when you create a Natsuwa account and provide your consent that we begin storing health data on our secured servers.

You can withdraw your consent at any time by deleting your account.

The pattern reflection feature analyses correlations within your own logged history. For example, whether low hydration on a given day tends to precede higher pain scores. This analysis runs on your data only and is never compared against other users without explicit anonymised research consent (see section below).

Data security

All data is stored in infrastructure we control and operate. Health data is not passed to third-party analytics services, advertising platforms, or AI APIs. We apply the following measures:

Passwords are bcrypt-hashed before storage. We cannot recover your password.
Health data is stored against a UUID, not your name or email, in the same record.
All data is transmitted using HTTPS. No plain-text connections.
All timestamps are stored in UTC with no timezone metadata that could narrow your location.

Though we cannot guarantee that misuse, loss, or alteration of information will never occur, we use all reasonable efforts to prevent it and keep our security measures under close review.

Optional anonymised research contribution

During the clinical trial phase, patients who are formally enrolled may be asked separately by the principal investigator whether they consent to their anonymised data contributing to the research dataset used to improve the prediction model.

This consent is:

Entirely optional. Declining does not affect your access to the app or your care.
Separate from this policy and governed by the IRB-approved research consent form.
Limited to anonymised data only. Your name, email, and phone number are stripped before any research dataset is created.
Revocable at any time without affecting your use of the app.

Beachhead-phase users (before the clinical trial begins) are not asked for research consent. Their data is used only to operate the service for them personally.

Disclosure of your personal data

We will share personal data with third parties only where strictly necessary to provide the service, where required by law, or where you specifically consent. Personal data may be shared in the following circumstances:

Service providers. The Visual Crossing API receives your city name to retrieve weather data. No health data is sent to this service.
Waitlist management. If you joined our waitlist, your email and optional role were submitted to Formspree solely to deliver that form. Formspree's privacy policy applies to that submission.
Legal requirements. If required to do so by law, regulation, or court order.
Law enforcement. In response to a legitimate request by the police or other law enforcement agency.
Legal advice. To seek legal advice from external lawyers or in connection with litigation.

Your rights

We believe that data privacy is a basic human right. Under the NDPA 2023, you have the following rights:

i. Request information on, or a copy of, your personal data processed by Natsuwa.
ii. Access your personal data and receive it in a portable, readable format.
iii. Correct your personal data and health data through the app settings.
iv. Withdraw your consent from data processing at any time by deleting your account.
v. Request complete deletion of your data within 30 days by contacting us (see below).
vi. Object to our processing of your personal data, or ask us to restrict processing pending a decision on whether we can lawfully continue.

To exercise any of these rights, email team@natsuwa.app with the subject "Data Request". We will respond within 14 days.

Data deletion

To request full deletion of your account and all associated health data, email team@natsuwa.app with the subject "Delete My Data". We will permanently delete your account, health logs, analysis results, and clinical profile within 30 days.

Young users

This service is intended for users aged 13 and above. Users aged 13-17 require the consent of a parent or guardian to register. Clinical trial participants under 18 are governed by the IRB-approved research consent form rather than this policy. Natsuwa does not knowingly collect data from children under 13. If you believe a child under 13 is using Natsuwa without permission, contact team@natsuwa.app and we will delete the account immediately.

If you are a parent or guardian and believe your child is using Natsuwa without your permission, contact us at team@natsuwa.app and we will delete the account immediately.

Changes to this Privacy Policy

Natsuwa reserves the right to amend this Privacy Policy from time to time to reflect changes in the law, our data practices, or the features of the app. Please check this page periodically. If we make a material change, we will notify you by posting a notice at the top of this page with the updated date.

Contact

Any questions about this policy are welcomed and should be sent to team@natsuwa.app.