Privacy Policy

Last Updated: June 17, 2026

1. Introduction

TheHyWing ("we", "our", or "us") is committed to protecting your privacy. This Privacy Policy explains how we collect, use, disclose, and safeguard your information when you use our mobile application, WhatsApp bot, and related services (collectively, the "Service"). TheHyWing is a climate-risk intelligence and preventive health platform that protects human health and livelihoods across multiple climate stressors. We operate globally and comply with applicable data protection laws in all jurisdictions where we serve users.

2. Data Controller

TheHyWing is the data controller responsible for your personal data. For data protection inquiries:

• Data Protection Officer: privacy@thehywing.com
• General Support: support@thehywing.com

3. Information We Collect

2.1 Personal Information

We collect information that you provide directly to us, including:

• Account Information: Email address, password (encrypted), and profile details
• Health Information: Occupation, work environment, climate exposure data, hydration records, vital signs, health conditions
• Agriculture Information: Crop types, livestock types, farming details (work_details field) — used solely to personalize Farm Intel climate risk assessments
• Location Data: Geographic location for weather-based alerts and agro-ecological zone detection (with your permission)
• Device Information: Device type, operating system, unique device identifiers

2.2 Automatically Collected Information

• App usage data and analytics
• Log data (IP address, timestamps, error logs)
• Weather API data for your location

3. How We Use Your Information

We use the collected information for:

• Service Delivery: Providing climate risk alerts, health monitoring, agricultural risk intelligence (Farm Intel), and medical consultations
• Personalization: Customizing alerts based on your work environment, health profile, and specific crops/livestock
• Livelihood Protection: Generating crop risk assessments, livestock welfare alerts, pest/disease warnings, and planting calendar guidance personalized to what you grow
• Safety: Sending critical climate health warnings and emergency notifications
• Communication: Sending service updates, password resets, and consultation reminders
• Analytics: Improving app performance and user experience
• Legal Compliance: Meeting regulatory and security requirements

3a. Why an Account and These Details Are Required

TheHyWing is a personalized safety and preventive-health service, not a general information app. The protection it provides — heat-strain and climate-risk scoring, hydration plans, symptom triage, doctor teleconsultations, safety-buddy check-ins, and employer/team safety features — cannot be delivered anonymously. Each of these is calculated against your own occupation, health vulnerability, and location, and is tied to a secure account.

For this reason we require an account and certain personal details to function. We rely on the following bases:

• Necessary for the service you request: Your occupation, work environment, and health profile are used directly to calculate the personalized risk warnings and guidance that are the core purpose of the app. Generic, non-personalized output would not protect you.
• Required by law: Because we facilitate consultations with licensed clinicians and process health data, we are legally required (under the Nigeria Data Protection Act 2023 and equivalent health-data rules) to maintain an identified account, record consents, and keep auditable medical records.
• Data minimization: We ask only for what is needed to deliver and personalize the service. Optional items (e.g. HealthKit signals, specific health conditions, crop/livestock details) can be skipped, and the app still works with safe default assumptions.

You may withdraw consent or delete your account at any time (Settings → Consents, or email privacy@thehywing.com).

4. Health Information Protection

We take the protection of your health information seriously:

• All Protected Health Information (PHI) is encrypted at rest (AES-256) and in transit (TLS 1.2+)
• Access to health data is logged and monitored for compliance
• We implement HIPAA-aligned security practices
• Health data is only shared with licensed clinicians for consultations you authorize
• At signup you provide granular, separate consents for: Terms of Service, Privacy Policy, processing of health data, AI symptom assessment, WhatsApp messaging, and marketing — each of which can be reviewed or withdrawn in the app at any time (Settings → Consents).

4.1 Health Connect (Android) Disclosure

On Android, TheHyWing integrates with Health Connect to read selected wearable measurements only after you grant permission. We request read-only access and do not write any records to Health Connect.

Health Connect data types we request (read-only):

• HeartRate
• RestingHeartRate
• HeartRateVariabilityRmssd
• OxygenSaturation
• RespiratoryRate
• SkinTemperature

Why we access these data types: to compute your personalized physiological strain signal (heat/cold body stress), generate preventive actions, trigger high-risk alerts, and improve clinician decision-support during authorized consultations.

Minimum scope commitment: we request only the Health Connect data types required for the user-facing safety and preventive-health features described above. We do not request unrelated Health Connect permissions.

Sharing and limited use: Health Connect data is not sold and is not used for advertising, credit scoring, lending, or data brokerage. We only share health data with parties you authorize (for example, licensed clinicians in your consultation flow), or when legally required.

Your control: you can revoke Health Connect permissions anytime in Android Settings → Health Connect → App permissions → TheHyWing, and you can request deletion of your stored data from within the app (Settings → Consents) or by emailing privacy@thehywing.com.

5. Information Sharing and Disclosure

We do not sell your personal information. We share data only in these circumstances:

• Healthcare Providers: Licensed clinicians during authorized consultations
• Caregivers: Only those you explicitly authorize
• AI Processing (OpenAI): Symptom descriptions are sent to OpenAI's API for AI-assisted health guidance. OpenAI processes this data under a Data Processing Agreement and does not use it for model training. No personally identifiable information (name, email, phone) is sent — only symptom text and anonymized health context.
• Service Providers: WeatherAPI.com / Open-Meteo (GPS coordinates only), Brevo (email delivery), Paystack (payments, PCI DSS compliant), Expo/EAS (push notification tokens), Render (cloud hosting)
• Legal Requirements: When required by law or to protect rights and safety
• Emergency Situations: To prevent serious harm to you or others

5a. Artificial Intelligence (AI) Transparency

6. Data Security

We implement industry-standard security measures:

• SSL/TLS encryption for all data transmission
• Encrypted database storage
• Secure authentication with JWT tokens
• Regular security audits and monitoring
• Access controls and audit logging

7. Your Rights

Depending on your jurisdiction, you have the following rights:

• Access: Request a copy of your personal data (GDPR, NDPA, CCPA, DPDP, POPIA)
• Rectification: Correct inaccurate or incomplete data (GDPR, NDPA, POPIA)
• Erasure / Deletion: Request deletion of your data (GDPR, NDPA, CCPA)
• Data Portability: Receive your data in machine-readable format (GDPR, DPDP)
• Restrict Processing: Limit how we use your data (GDPR, POPIA)
• Withdraw Consent: Revoke consent at any time (all jurisdictions)
• Non-Discrimination: Exercise rights without diminished service (CCPA)

To exercise any right, email privacy@thehywing.com. We respond within 30 days.

8. Data Retention

We retain your information for as long as your account is active or as needed to provide services. Health records may be retained for longer periods to comply with medical record-keeping requirements.

9. Children's Privacy

TheHyWing is not intended for users under 18 years of age. We do not knowingly collect information from children under 18.

10. Data Breach Notification

In the event of a breach posing a risk to your rights, we will notify the relevant supervisory authority within 72 hours (GDPR/NDPA) and notify affected users without undue delay. Our breach response process includes:

• Detection & Assessment: Automated security event logging via our audit system identifies anomalous access patterns within minutes.
• Authority Notification: NDPC (Nigeria), relevant EU DPA, or other applicable authority notified within 72 hours of confirmed breach, including nature of breach, categories of data affected, approximate number of users, and remediation steps.
• User Notification: Affected users notified via email and in-app alert without undue delay, including what data was affected and recommended protective actions.
• Remediation: Encryption key rotation, forced token revocation, and access credential reset as appropriate.

11. International Data Transfers

Your data may be processed in countries other than your own. We use the following sub-processors:

We ensure appropriate safeguards for cross-border transfers including Standard Contractual Clauses (SCCs), Data Processing Agreements (DPAs) with each sub-processor, and encryption of all data in transit (TLS 1.2+) and at rest (AES-256). PHI (Protected Health Information) is encrypted before leaving our application layer and is never sent to sub-processors in plaintext.

12. Changes to This Privacy Policy

We may update this Privacy Policy from time to time. We will notify you of significant changes via email or in-app notification. Continued use of the service after changes constitutes acceptance of the updated policy.

13. Jurisdiction-Specific Provisions

EEA (GDPR): Data portability, right to object, lodge complaints with your local DPA. USA (CCPA): Right to know, delete, opt out — we do not sell data. Nigeria (NDPA 2023): Consent-based processing, breach notification, correction/deletion. India (DPDP 2023): Consent management, data erasure, representative nomination.

© 2025-2026 TheHyWing. All rights reserved.