Privacy Policy

ETILIFE is a Nigerian company that operates a health-plan and loyalty rewards platform. We are the "data controller" of the personal data described in this policy. For any privacy question, request, or complaint, please contact our Data Protection Officer at privacy@etilifecare.com. General support is available at support@etilifecare.com.

We only collect information that is necessary to run the Service. Categories of data include:

• Identity & contact data: full name, username, email address, phone number, date of birth, gender, home address, city, state, country and profile photo.
• KYC data: your Bank Verification Number (BVN), National Identity Number (NIN), voter's card, driver's licence or passport number, together with an ID image where required. Raw identifier numbers are hashed at rest — we store the last four digits and a one-way hash, never the full number.
• Health data: vitals you or your connected device record (blood pressure, heart rate, temperature, SpO₂, blood sugar, height, weight, daily steps), allergies, chronic conditions, blood type and emergency-contact information. This is classed as "sensitive personal data" under NDPA.
• Dependant data: name, relation, age and (optionally) date of birth of the family members you add to your ETILIFE plan.
• Payment & card data: tokenised card details (network, issuing bank, last four digits) and payout account details for hospital/HMO partners. We do not store full card numbers, CVVs, PIN or one-time codes — those are handled directly by our licensed payment service providers.
• Plan & redemption data: HMO selection, plan usage, rewards you have earned, redemption authorization codes, service categories, hospitals visited and settlement records.
• Device & usage data: IP address, device model, operating system, app version, crash logs, approximate location (derived from IP), pages viewed, buttons tapped and referral source. We use this to keep the Service reliable and to prevent fraud.
• Communication data: chats you have with EtiBot, support tickets, feedback, and any emails or in-app messages you send us.

We process personal data for the following purposes and on the following legal bases:

• Providing the Service (contract): creating your account, awarding points, honouring redemption authorization codes, splitting settlement payments to hospitals and HMOs, sending transactional email and rendering the dashboards.
• KYC & anti-fraud (legal obligation and legitimate interest): verifying your identity, preventing money-laundering, detecting duplicate or suspicious accounts, rate-limiting redemption codes, and monitoring unusual claim patterns.
• Health rewards (consent): reading step counts from HealthKit / Google Fit / paired wearables so we can award streak and milestone points. You can revoke this consent at any time from the Devices sheet.
• Product improvement (legitimate interest): analytics, A/B tests and aggregated reporting to improve reliability, security and user experience. This data is de-identified wherever possible.
• Communications (contract / consent): weekly wellness digest, milestone celebrations, service announcements and — only if you opted in — marketing emails.
• Legal, safety and regulatory purposes: to comply with lawful requests from the Nigeria Data Protection Commission (NDPC), CBN, NHIA, NAICOM or courts of competent jurisdiction, and to enforce our Terms.

ETILIFE never sells your personal data. We share the minimum necessary data with the following categories of recipients:

• Hospitals you redeem points at (name, points balance snapshot, service category, KYC medical snapshot such as blood type and allergies, and the specific Redemption Authorization Code).
• HMOs that cover your plan (redemption metadata, hospital, service category, aggregate spend reporting).
• Payment service providers licensed by the Central Bank of Nigeria — currently Flutterwave and Paystack — who execute the split-payment settlement to hospital sub-accounts.
• KYC providers (e.g. Youverify, Smile ID or Dojah) who validate BVN/NIN against NIBSS / NIMC.
• Communication providers (e.g. Resend, Twilio) used to deliver transactional emails and OTP codes.
• Infrastructure & analytics providers (cloud hosting, error monitoring, crash reporting).
• Professional advisers, auditors and regulators when we are required by law.
• Successors in the event of a merger, acquisition or asset sale, subject to equivalent privacy commitments.

Some of our providers process data outside Nigeria. Where we transfer personal data internationally we rely on the safeguards permitted under Section 41 of the NDPA — including transfers to jurisdictions recognised as offering adequate protection, standard contractual clauses, or your explicit consent.

We keep your personal data only as long as necessary for the purposes described above and to satisfy our legal, tax and audit obligations. In general:

• Active account data: for the life of your account.
• Transaction, settlement and KYC records: seven (7) years after the transaction, per NDIC / CBN rules.
• Marketing preferences: until you unsubscribe.
• Deleted accounts: hard-deleted from primary systems within thirty (30) days; a tombstone record (deletion date + reason) is retained for audit.

Subject to certain conditions, you have the right to:

• Request a copy of the personal data we hold about you (right of access).
• Correct inaccurate or incomplete data.
• Request deletion of your account and associated personal data. You can do this in-app from Profile → Delete account, or by emailing privacy@etilifecare.com.
• Restrict or object to certain processing (for example, marketing emails — use the unsubscribe link in any newsletter).
• Withdraw consent at any time where processing is based on consent (this does not affect the lawfulness of processing already carried out).
• Receive your data in a portable, machine-readable format.
• Lodge a complaint with the Nigeria Data Protection Commission (NDPC) if you believe your rights have been violated.

We implement organisational, physical and technical safeguards designed to protect your personal data against unauthorised access, alteration, disclosure or destruction. These include TLS 1.2+ in transit, encryption at rest for sensitive fields, bcrypt password hashing, one-way hashing of BVN/NIN, JWT expiry, rate limiting on authentication and redemption endpoints, principle-of-least-privilege access controls, audit logging and 24/7 monitoring. No system is 100% secure — please help us by using a strong unique password and enabling any additional protections we offer.

ETILIFE is not intended for children under 18. Parents and guardians may register minors only as dependants on their own verified account.

Our marketing site and web dashboards use a small number of essential cookies and localStorage entries (session token, preferred theme, verify-email banner state). We do not use third-party advertising cookies. You can disable cookies in your browser but some parts of the Service will not work correctly without them.

We do not take decisions that have significant legal or similar effects on you based solely on automated processing. Vital-sign anomaly detection surfaces suggestions (e.g. a "Book a check-up" nudge) but a human — you, or your hospital — always makes the final decision.

The Service may link to third-party websites (for example your HMO's or hospital's own portal). Their privacy practices are governed by their own policies and we encourage you to review them.

We may update this Policy from time to time to reflect changes in our services, technology, or legal requirements. When we make material changes we will notify you by email and in-app. The "Effective date" above always reflects the most recent version.

Data Protection Officer
ETILIFE Health Limited
Lagos, Nigeria
Email: privacy@etilifecare.com
Support: support@etilifecare.com