Your data, and your control over it

What we collect

Only what the service actually needs to help you:

• •Who you are: your name, your phone or WhatsApp number, your email if you signed up on the web, and your language.
• •Your pregnancy: your week or due date, whether this is your first pregnancy, your baby's birth date once your baby arrives.
• •What you tell us: your chat messages (typed or spoken), journal entries, symptoms and moods, and photos you send us to read (an ANC card, a medicine, a test result).
• •Health readings: blood pressure, weight, temperature and other vitals you or a health worker record, plus any alerts these raise.
• •Optional details that help in an emergency: your state, LGA and ward, your usual facility, a transport contact, a next-of-kin contact, and a partner's number if you choose to add one.
• •Technical basics needed to run the service: your login session cookie and, if you turn on notifications, your device's push subscription.

We do not ask for your NIN, your BVN, bank details or any government ID.

Why we keep it, and on what basis

Health information is sensitive personal data under the NDPA 2023. Our lawful basis is your consent: before Bumply stores anything from your conversation, it sends you a short notice and asks you to reply YES. We record the date and the exact version of that notice against your account.

We use your data to answer your questions with your own context in mind, to spot danger signs in your messages and tell you to get to a clinic, to alert your health worker so a human can follow up, to send you visit and immunization reminders, and to keep a safety record of what the system told you. We also count things like how many mothers we reach and how quickly they get to care — that reporting uses totals only, never your name.

Who can see it

• •Your assigned health worker (the CHW or clinician who enrolled you) sees your profile, your alerts and the vitals relevant to your care. No other health worker sees you.
• •A small technical team maintains the system and can access data when it is needed to fix a fault or investigate a safety incident.
• •Nobody else. We do not sell, rent or trade your data, we do not use it for advertising, and we do not share it with your family, employer or any other organisation unless you ask us to or the law requires it.
• •If you choose to invite your partner or family with a share link, they see only your weekly pregnancy update — not your chats, journal or alerts. You can ask us to cancel that link.

Where your data is kept

Your records live in a self-hosted Postgres database that our team runs and controls — not in a third-party health platform. Access is restricted to the application and to the maintainers, over encrypted connections.

To make the service work, some information necessarily passes through other companies: WhatsApp or Telegram carry your messages, and the AI, voice and translation services that generate replies process the text of your question. Some of these run outside Nigeria. We only send them what is needed to produce your answer, and our providers are bound by their own contractual and security obligations. The full processor list is in our published data-protection documentation.

How long we keep it

We keep your data while you are using Bumply, and for up to 24 monthsafter your last activity so a returning mother finds her history intact. After that, inactive accounts are erased. If you ask us to delete earlier, we do it straight away — you do not have to wait. Safety records that no longer identify you (for example “an alert was raised and closed”) may be kept for reporting, with your name and contact details removed.

Your rights

Under the NDPA 2023 you can, at any time and free of charge:

• •Ask what we hold about you and get a copy (right of access).
• •Correct anything that is wrong — your week, your name, your phone number (right to rectification).
• •Have everything erased (right to erasure).
• •Withdraw your consent. Bumply then stops storing your conversation; withdrawing does not undo what was lawfully done before.
• •Object to how we use your data, or ask us to restrict it.
• •Complain to the Nigeria Data Protection Commission (NDPC) if you are not satisfied with how we respond.

How to use your rights

The fastest way: message the Bumply bot on WhatsApp or Telegram and say “delete my data”(or “forget me”, or just “stop”). Bumply asks you to confirm once, then erases your messages, journal, photos, vitals and personal details, and unlinks your phone number. This is deliberate: a mother who cannot read a policy page can still exercise her rights in her own words.

On the web: sign in and use the delete option on your account page.

For access or correction: email us at privacy@bumply.mom and we will respond within 30 days.

Children

Bumply is built for pregnant and new mothers. Adolescent mothers are among those most at risk in Nigeria, and we do not turn them away — but a mother under 18 should be enrolled and supported by a health worker, parent or guardian who is aware she is using the service.

What Bumply is not

Bumply is not a doctor and not a diagnostic device. It gives general, safe guidance and pushes you towards a clinic whenever anything looks worrying. It never replaces your antenatal visits or your health worker's judgement.

Contact

Questions, complaints, or a request about your data: privacy@bumply.mom, or message our WhatsApp line on +234 815 417 4140.

You may also contact the Nigeria Data Protection Commission (NDPC) directly if you believe your rights have been breached.