Privacy Policy

Muna Health (“Muna”, “we”, “us”, “our”) provides a mobile application offering an oral-systemic health screening. Using a short health questionnaire and photographs of your mouth, the app produces an Oral-Systemic Health Risk Score (OS-HRS) and guidance on suggested next steps. This policy explains what personal data we collect, how and why we use it, who we share it with, how we protect it, and your rights over it. It applies to the Muna mobile application and related services (the “Service”). Muna Health Inc. is the data controller responsible for your personal data. Questions: info@munahealthtech.com.

• Account information: your name and email address, to create and secure your account.
• Health questionnaire responses (sensitive health data): information you provide when screening, which may include age and sex; height and weight; conditions such as diabetes or hypertension; blood-test indicators (such as HbA1c) if you choose to enter them; oral-health symptoms (such as bleeding gums, tooth loss); lifestyle factors (such as smoking, diet, exercise); family medical history; for some users reproductive-health information (such as pregnancy or related conditions); and your state of origin and residence.
• Intraoral photographs (sensitive health data): photographs of the inside of your mouth (front teeth, upper and lower gums, tongue) captured through the app.
• Assessment results: the OS-HRS score, risk tier, and related results the app generates.
• Care requests: when you ask us to arrange care (a lab test, pharmacy support, or a wellness consultation), the phone number you give us to call you on, the area you want to be seen in, and any note you add (for example “mornings are best”).
• Location: if you allow it, the app reads your device location on the care request screen and turns it into the name of your area, so you do not have to type it. We store that area name together with approximate coordinates, rounded to about 100 metres, attached to the care request. We do not keep the exact position your phone reported. We collect location only at that moment, never in the background and never while you are elsewhere in the app. You can refuse the permission and type your area yourself, and the rest of the Service works exactly the same.
• Technical and usage data: basic information needed to operate and secure the app, such as device type, app version, authentication data that keeps you signed in, and, if you turn notifications on, a notification token and your time zone so reminders arrive at a sensible hour.

We do not collect your National Identification Number (NIN) or similar national identifiers, and do not require them to use the Service.

Health information and intraoral photographs are sensitive personal data. We process them only with your consent and only for the purposes in this policy. You may withdraw consent at any time, though some features may not function without the data they depend on.

Your Oral-Systemic Health Risk Score is produced automatically by software, from your questionnaire answers. No person calculates it and no person approves it before you see it.

Your photographs are not scored and do not change the number. They are there so that a clinician can look at them and tell you what was visible, and, only if you agree separately, so that they can help train and test our software in future.

The score places you in a risk band, and that band decides what the app shows you next: which suggested next steps you see, and which care options we offer to arrange. That is why we explain it here rather than treating it as a technical detail. It is a screening estimate, not a diagnosis, and it is never the final word on your health.

A clinician may separately look at your photographs and add a note about what was visible in them. That note sits beside your score and does not change it.

• To provide the Service: register your account, run your screening, compute your OS-HRS, and show your results and next steps. (Basis: performance of our agreement with you, and your consent.)
• To arrange the care you ask for: our care team uses your phone number, your area, and the approximate coordinates behind it to find a lab, pharmacy, or clinic near you, to book the appointment, and to tell you where and when to go. (Basis: performance of our agreement with you, and your consent to the location permission.)
• To send the reminders you choose: your daily health tip, habit nudges, and re-screening reminders, at the time and in the categories you set. You can turn any of them off in Settings. (Basis: your consent.)
• To secure your account: authenticate you and protect your data. (Basis: our legitimate interest in security, and legal obligations.)
• To train and test our screening software, and conduct research: only where you give separate explicit consent, we use your answers and your intraoral photographs, with direct identifiers removed, to train and test the software that produces the OS-HRS, to check the quality of our screening, and for research on the link between oral and general health (see “Research and training data” below). (Basis: your explicit consent.)

We do not use your data for advertising, and we do not sell your personal data.

Improving a health screening tool requires data. In the app we ask you separately, in plain words, whether you agree to let us use your answers and the photographs of your mouth, with your name and contact details removed, to train and test the software that works out Muna scores, to check the quality of our screening, and for research on oral and general health. Using your screening for that purpose is a different thing from screening you, which is why we ask for it separately rather than folding it into the consent you give to use Muna at all. This consent is:

• optional (you can decline and still use the full Service);
• separate from accepting this policy;
• withdrawable (contact info@munahealthtech.com); and
• recorded (we keep a record of your choice and the version you agreed to).

When data is used for research, we remove direct identifiers so it is not reasonably attributable to you, and handle it under appropriate safeguards.

We share personal data only as necessary to run the Service, and only with parties bound to protect it:

• Service providers and processors. These act on our instructions under written terms, may not use your data for their own purposes, and are named here rather than summarised:
  • Google Cloud Platform hosts the service and stores your data, including your intraoral photographs.
  • MongoDB Atlas hosts the database holding your account, questionnaire answers and results.
  • Sentry receives anonymous crash diagnostics if the app stops unexpectedly: the technical error, your device model and operating system. It receives no name, no email, no account identifier and no health data.
  • Resend delivers our emails, so it handles your email address.
• Partner providers, when you ask for care: to book an appointment we give the lab, pharmacy, or clinic only what they need to see you, such as your name, your phone number, the area you asked to be seen in, and the service requested. We do not send them your screening answers, your photographs, or your score.
• Legal and safety: we may disclose data where required by law or to protect the rights, safety, and security of our users, the public, or Muna.
• Business transfers: if Muna is involved in a merger, acquisition, or asset sale, data may transfer as part of that transaction, subject to this policy.

We do not sell your personal data and do not share it with advertisers.

Muna serves users in Nigeria and the diaspora, and we should be direct about where your data actually sits. It is stored and processed in the United States. All four of the providers named above operate the services we use from US infrastructure, so your account, your questionnaire answers, your results and your intraoral photographs leave Nigeria.

Section 43 of the Nigeria Data Protection Act permits this, subject to appropriate safeguards. Today those safeguards are contractual and technical: written data processing terms with each provider, encryption in transit and at rest, access limited to the people who need it to operate the Service, and a private, access-restricted store for your photographs.

We are formalising the specific transfer mechanism under Section 43 with a licensed Data Protection Compliance Organisation, and we will name it here once it is in place rather than describe it before it is. We would rather this section be accurate than complete.

We use technical and organizational measures to protect your data, including encrypted transmission, access controls, and storing your intraoral photographs in a private, access-restricted store. No method of transmission or storage is completely secure, but we work to protect your information and limit access to those who need it to operate the Service.

We keep your personal data for as long as your account is active, and as required for legal, regulatory, and legitimate operational needs.

Deleting your account deletes your data, including your photographs. You can do it yourself from Settings in the app. It removes your screenings and results, your intraoral photographs from our storage, your care requests, your consent records, and everything else we hold that is tied to you. Today that applies even to data you allowed us to use for research and training: if you delete your account, that goes too. That is the more protective choice, and we would rather state what actually happens than describe a distinction we do not make.

We are also setting a defined retention period, so that data is deleted automatically after a fixed time rather than only when you ask. We are settling that period with a licensed Data Protection Compliance Organisation, against the record-retention rules that apply to health information in Nigeria, and we will publish the specific period here once it is set.

Subject to applicable law (including the Nigeria Data Protection Act/Regulation), you may:

• access your data;
• correct inaccurate data;
• request deletion;
• withdraw consent (including research consent) without affecting prior lawful processing;
• object to or restrict certain processing;
• request a portable copy;
• ask for a human to review a decision made about you by automated means, and contest it. Your Muna score is such a decision, and how to ask is described in “How your score is worked out” above; and
• lodge a complaint with the Nigeria Data Protection Commission.

To exercise these rights, contact info@munahealthtech.com. We respond within the timeframes required by law.

The Service is intended for adults (18+). We do not knowingly collect personal data from children. If you believe a child has provided us data, contact info@munahealthtech.com and we will take appropriate steps.

We may update this policy from time to time. For material changes we will update the “Last updated” date and, where appropriate, notify you in the app. Continued use after an update means you accept the revised policy.

Muna Health Inc. Email: info@munahealthtech.com.

Data Protection Officer. Our Data Protection Officer is Uche Azinge, reachable at uche@munahealthtech.com. The DPO is your point of contact for anything in this policy, for exercising any of the rights above, and is also the point of contact for the Nigeria Data Protection Commission.