Privacy Policy

Effective 24 October 2026

This policy explains what personal information Weblora CareApp ("we", "us"), operated by Weblora, collects, why, who we share it with, and the rights you have under the Nigeria Data Protection Act 2023 (NDPA). We are the data controller for the information described here.

1. Information we collect

• Waitlist details: if you join the waitlist — your name, email, and optionally your phone or WhatsApp number, country, city, the features you're interested in, and how you heard about us.
• Account details: your name, email address, and phone number if you choose to give it.
• Your password: stored only in scrambled (hashed) form. We can never see it.
• Health conversations: the messages you send to the Health Assistant and its replies. These may include information about your health, which the NDPA treats as sensitive personal data.
• Security information: email verification codes (stored scrambled and valid for 10 minutes), login times, and your network (IP) address, used to prevent abuse.
• Information kept on your device only: your daily exercise streak is saved in your browser. It is not sent to us.

We do not collect your location. When you search for a pharmacy, Google Maps opens and handles your location under Google's own privacy policy.

2. Why we use it, and our legal basis

• To provide your account and the app's features — to perform our agreement with you.
• To answer your health questions — based on your explicit consent, which you give when you create an account. You can withdraw it at any time (see section 7).
• To send waitlist updates and launch news — based on your consent when you join. Every email has an unsubscribe link.
• To verify your email and keep accounts secure — our legitimate interest in preventing fraud and misuse.
• To meet legal obligations, where the law requires it.

We do not sell your information, and we do not use it for advertising.

3. Who we share it with

We share information only with service providers that help us run the app, and only what each one needs:

• Anthropic (AI provider, United States) — receives your Health Assistant messages to generate replies.
• Render (hosting and database, servers in Germany) — stores your account and conversations.
• Vercel (website hosting) — delivers the app's pages to your browser.
• Google (email delivery) — sends your verification codes and waitlist emails.
• YouTube — only if you play an exercise video, which loads from YouTube.
• Google, Apple or Microsoft — only if you choose to sign up with them. They confirm your identity and share your name and email address with us; we don't receive your password.

We may also disclose information if required by law or to protect someone's life or safety.

4. Transfers outside Nigeria

Some of these providers process data outside Nigeria (in the United States and the European Union). We use providers that apply recognised safeguards to protect personal data, as the NDPA requires for international transfers. By creating an account you consent to these transfers.

5. How long we keep it

• Account details and conversations: for as long as your account is open.
• When you ask us to delete your account, we delete your account and conversations within 30 days, except where the law requires us to keep something longer.
• Waitlist details: until you unsubscribe, or 12 months after launch, whichever comes first.
• Security logs: up to 90 days.

6. How we protect it

Data is encrypted in transit (HTTPS), passwords are hashed, accounts require email verification, login attempts are limited, and access to our systems is restricted. No system is perfectly secure, but we work to protect your information and will notify you and the Nigeria Data Protection Commission of a serious breach as the law requires.

7. Your rights

Under the NDPA you can:

• ask for a copy of the personal data we hold about you;
• ask us to correct inaccurate data;
• ask us to delete your data;
• withdraw your consent at any time (this doesn't affect what we did before you withdrew it);
• object to or ask us to restrict how we use your data;
• ask for your data in a portable format; and
• complain to the Nigeria Data Protection Commission (NDPC).

To use any of these rights, email t.oluwaseunofficial@gmail.com from the email address on your account. We will reply within 30 days.

8. Children

Weblora CareApp is for people aged 18 and over. We do not knowingly collect data from children. If you believe a child has created an account, contact us and we will delete it.

9. Not medical advice

The Health Assistant gives general information only and is not a doctor. See our Terms of Use.

10. Changes to this policy

We will post any changes on this page and update the date above. For important changes, we will notify you in the app or by email.

11. Contact

Weblora — t.oluwaseunofficial@gmail.com