Privacy Policy

Enike (“the app”) is operated by Pi Technologies (“we”, “us”, “our”), the company responsible for the app and the party accountable for your information under this policy. The app is a health companion for people living with sickle cell disease (“warriors”) and the partners who support them. We take the privacy of your health information seriously. This policy explains what we collect, why, our lawful basis for it, how we protect it, who it is shared with, and how you can delete it. It applies to the Enike mobile app and its backend service.

1. Data we collect

We collect only what the app needs to function. Most health data is optional and only collected when you choose to log it or connect a wearable.

Data	Why we collect it	Required?
Email address	Account creation, sign-in, and authentication	Required
Display name	Personalizing your experience	Optional
Health profile (sensitive): sickle-cell genotype (e.g. HbSS/HbSC/HbSβ), date of birth / age, sex, weight, country	Tailoring guidance, risk indicators, and predictions to your condition	Optional
Care plan (sensitive): blood type, current medications, allergies, pain-management protocol, hematologist name & phone, preferred hospital, emergency notes	Keeping your care details handy and shareable in an emergency	Optional
Vitals & health metrics (sensitive): heart rate (incl. resting/walking), heart-rate variability, SpO₂, respiratory rate, body temperature	Tracking your health and surfacing trends	Optional
Fitness & activity: sleep (incl. stages), steps, distance, active energy, workouts	Context for wellbeing and crisis-risk signals	Optional
Hydration logs	Helping you meet hydration goals	Optional
Daily health log (symptoms, pain level, sleep, notes)	Recording how you feel over time	Optional
Menstrual cycle data (sensitive)	Cycle logging and prediction — only when you opt in	Optional (off by default)
Emergency contacts you add: their name, phone, and email	So we can alert them when you trigger an SOS	Optional
Precise location (only at an active SOS/crisis)	Attached to your crisis record and used for weather context; see §5 for exactly who receives it	Optional — only captured when you trigger SOS
Device push (FCM) token	Delivering reminders and crisis alerts	Required for push notifications
Crash & diagnostic data	Diagnosing stability problems (personal identifiers are scrubbed before the report is sent, and this is disabled unless crash reporting is enabled)	Optional

We do not collect data for advertising and we have no advertising identifiers. Health and care-plan information is treated as sensitive and is never required to create an account.

Wearable & health-platform data

With your permission, the app reads data from Apple HealthKit (iOS) or Google Health Connect (Android) on a read-only basis — we never write to those platforms. Each data type is requested individually and you can decline any of them. Menstrual data is only read if you turn on cycle tracking. Information obtained from HealthKit or Health Connect is never used for advertising or marketing and is never sold, in line with Apple and Google platform policies.

When you grant background access, the app may automatically sync newly recorded wearable data in the background (for example, on a periodic schedule) so your trends stay current without opening the app. You can revoke any of these permissions at any time in Health Connect / Apple Health or your device settings, which stops further reads.

2. How we use your data

• To provide the core features you use: hydration, vitals, daily logs, cycles, care plans, and crisis support.
• To send notifications you have enabled, including hydration reminders and crisis alerts.
• To compute a transparent, on-device-explained crisis-risk indicator from signals you have logged. This is a rule-based heuristic, not a medical diagnosis.
• To keep the service secure, reliable, and free of abuse.

We do not sell your data, and we do not use it for advertising.

3. Legal bases for processing

Where the GDPR or a comparable law applies, we rely on the following lawful bases:

• Your explicit consent for special-category health data (your health profile, care plan, vitals, fitness, daily logs, and menstrual data). You can withdraw consent at any time by turning off a feature or deleting your account.
• Performance of a contract for the data needed to create and operate your account, such as your email and authentication.
• Legitimate interests in keeping the service secure, stable, and free of abuse (for example, limited diagnostic data) — balanced against your rights.
• Vital interests when you trigger an SOS and we relay your alert to the emergency contacts you chose.

Under the Nigeria Data Protection Act / Regulation, we process your data on the equivalent bases of consent, contract, legitimate interest, and the protection of vital interests.

4. Sharing

We do not sell your data or share it with third parties for their own purposes. Data leaves the app only in these ways:

• Emergency contacts. When you trigger an SOS, the app sends an alert (SMS and/or push) to the emergency contacts you configured. The alert contains your name, your reported pain level, and any triggers you logged so they can understand the situation. This is a message you direct us to send on your behalf. The alert does not currently include your GPS coordinates.
• Linked partners. If you link a support partner, they can see only the data you choose to share through the app’s sharing controls. Menstrual/cycle sharing is off by default and is never shared with a partner unless you explicitly turn it on. You can change permissions or unlink a partner at any time.
• Service providers (processors). We use the third parties below solely to operate the app, acting on our instructions. They may not use your data for their own purposes.

Processor	Purpose	Data shared	Region
Google Cloud	Application hosting & database	All account & health data (at rest)	EU / US
Firebase Cloud Messaging	Push notifications	Device push token	US
Twilio / Termii	SMS delivery for crisis alerts	Recipient phone number, alert message	US / Nigeria
Sentry	Crash & error reporting (when enabled)	Diagnostic data with identifiers scrubbed	US
OpenWeatherMap	Weather context during an active crisis (when enabled)	Crisis location coordinates	US / EU

5. Location

The app does not track your location in the background or continuously. Location is captured only at the moment you trigger an SOS/crisis, on a best-effort basis. It is stored on your crisis record and, where enabled, used to look up local weather conditions relevant to your care (which sends the coordinates to the weather provider named in §4). If location is unavailable, the SOS still proceeds without it.

6. Security

• All traffic between the app and our backend is encrypted in transit over HTTPS, and your data is stored securely with encryption at rest provided by our cloud host.
• Authentication tokens are stored in the device’s secure storage (Android Keystore / iOS Keychain).
• Crash reports have authentication headers and identifiers such as phone, email, token, and coordinates scrubbed before they are sent.
• To be clear: your data is encrypted in transit and at rest, but it is not end-to-end encrypted — our backend processes your data to provide the service.

7. International data transfers

We and our processors (§4) may store and process your data on servers located outside your country, including outside Nigeria and the European Economic Area — for example in the United States or the EU. Where we transfer personal data across borders, we rely on appropriate safeguards such as Standard Contractual Clauses or an adequacy decision, and we meet the cross-border transfer requirements of the Nigeria Data Protection Act / Regulation.

8. Data retention & deletion

You can delete your account and all associated data from within the app at any time (Settings → account deletion). Deletion permanently removes your records — vitals, hydration, logs, cycles, care plans, contacts, crisis records, and account details — from our database.

• Active health and account data is retained only for as long as your account exists.
• Crisis records are retained until you delete your account, so your history is available to you.
• Backups containing your data are rotated and are typically purged within 30 days of account deletion.
• Diagnostic / crash data (when enabled) is retained by our error-reporting processor for a limited period — up to around 90 days — before being deleted.
• SMS delivery logs are retained by our SMS providers only as needed to deliver messages and meet their legal obligations.

9. Children & minors

Many warriors are children or teenagers cared for by a parent or guardian, so the app supports use on a minor’s behalf with appropriate consent.

• Self-registration. To create and manage your own account, you must be at least the digital age of consent in your country (for example, 16 in much of the EU, or as low as 13 where local law allows; in Nigeria, in line with the NDPA). Below that age, an account must be set up and managed by a parent or guardian.
• Parent / guardian use. A consenting parent or guardian may set up Enike for a minor warrior and act as their linked partner. The guardian is responsible for providing consent and for the information they enter on the minor’s behalf.
• Sensitive toggles still apply. A minor’s sensitive data follows the same rules as everyone else’s — for example, menstrual tracking is off by default and is never shared with a partner unless it is explicitly enabled.
• Deletion. A parent or guardian can delete a minor’s account and all associated data from within the app, or contact us using the details below to request deletion.

We do not knowingly collect data from a child below the applicable age without parental or guardian consent. If you believe this has happened, contact us and we will delete it.

10. Your rights

Depending on where you live (including under the Nigeria Data Protection Act / Regulation and, where applicable, the GDPR), you may have the right to:

• access the personal data we hold about you, and receive a copy;
• correct inaccurate data;
• delete your data (available directly in the app via account deletion);
• restrict or object to certain processing;
• data portability — receive your data in a portable format;
• withdraw consent at any time, without affecting processing already carried out;
• lodge a complaint with a supervisory authority — in Nigeria, the Nigeria Data Protection Commission (NDPC); in the EU/EEA, your local data protection authority.

Account deletion is available directly in the app. For any other request, contact us using the details below; we aim to respond within 30 days.

11. Changes to this policy

We may update this policy as the app evolves. We will reflect changes here with an updated “Last updated” date, and for material changes we will provide a more prominent notice (in the app or by email) before they take effect.

12. Contact

Questions about this policy or your data? Email privacy@sicklecompanion.app.