Who we are
Boolbyte Technologies ("Boolbyte", "we") is a healthcare technology company in Lagos, Nigeria. We build ByteOps, ByteNetwork, ByteCare, and ByteEngine. This policy covers this website and our products. It is written to meet the Nigeria Data Protection Act 2023 (NDPA) and the guidance of the Nigeria Data Protection Commission (NDPC).
Our role: controller or processor
Who decides how your data is used depends on the product.
- We are the controller for visitors to this website, for people who create a Boolbyte account, and for people who use ByteCare.
- We are a processor for the data a healthcare organization puts into ByteOps or ByteNetwork, such as its patients' details and messages. The organization is the controller. It decides what it collects and why, and its own notice applies. We process that data only on its instructions, under our data processing agreement. If you are a patient of a clinic that uses ByteOps, contact the clinic first about your data.
- When you ask ByteCare to send a request to a clinic, the clinic becomes a controller of what you share with it, and its notice applies to its copy.
- Developers using ByteEngine are the controllers of what they put in their servers.
What we collect
On this website
- What you send through the contact form: your name, work email, organization, and your message.
- Analytics (Google Analytics), only if we have turned it on and you accept it in the cookie banner. See our cookie policy.
- A security check on the contact form (Cloudflare Turnstile), which looks at your browser to tell people from bots.
When you have an account
- Your name, email address, and a password stored only as a one-way hash. If you sign in with Google, GitHub, a passkey, or your organization's single sign-on, we receive what that service shares to sign you in.
- For staff: your organization, your role, and the actions you take in the product, which we record so the organization can see who did what.
When you use ByteCare
- Your profile: name, date of birth, sex, phone number (checked with a texted code), address and the position you confirm on a map, next of kin, and the profiles you add for family members.
- What you ask for, your messages with the assistant and with clinics, the requests and referrals you send, and the consents you give.
- Voice input: when you speak instead of typing, your recording is sent to a speech-to-text model and turned into text. We do not store or log the recording.
- If you allow notifications, the address your browser gives us to send them.
When you use ByteEngine
- Your account and project details, your API keys, and a log of how the API is used. We do not store the content of requests or responses.
How we use it, and why
The NDPA requires a lawful basis for each use. We rely on these:
| Use | Lawful basis |
|---|---|
| Provide your account and the products you use | Performance of a contract with you or your organization |
| Find care, send your requests to clinics, and remind you of visits in ByteCare | Your consent, which you give for each request you send |
| Alert clinics when you raise an emergency | Your vital interests, and your consent |
| Keep the products secure, prevent abuse, and fix problems | Our legitimate interests |
| Answer your enquiries | Our legitimate interests, or steps you asked for before a contract |
| Website analytics | Your consent, given in the cookie banner |
| Keep records the law requires | Legal obligation |
We do not sell personal data, and we do not use it for advertising.
Health information
Health information is sensitive personal data under the NDPA. In ByteCare we process it only with your consent, or where it is needed to protect your life in an emergency. In ByteOps and ByteNetwork we process it for the healthcare organization that is its controller, under that organization's lawful basis and our data processing agreement.
AI and your data
- ByteCare's assistant, and the assistants clinics use in ByteOps, are automated, and say so. Their replies are generated by AI models.
- Some AI models run on infrastructure we run or contract; others are third-party providers, used only where an organization allows them. The providers are listed on our subprocessors page.
- We do not use your data to train AI models.
- An AI does not make decisions with legal or similarly significant effects about you on its own. In ByteOps each action is either automatic, confirmed by the patient, or approved by staff, under rules the organization sets, and anything the rules don't cover goes to staff. Clinical decisions stay with clinicians. See responsible AI.
Who we share it with
- Clinics you choose. In ByteCare, your request and the details it needs go to the clinic you send it to, and to the clinics that can respond if you raise an emergency.
- Your organization. If you are staff, your organization's owners and admins can see your account and activity in its workspace.
- Subprocessors that host, process, or deliver data for us: AI model providers, messaging and email services, and map and address services. They are listed, with what each receives, on our subprocessors page.
- Authorities, where the law requires it, and only what it requires.
- A buyer or successor, if Boolbyte is reorganized or sold, under the same protections.
Transfers outside Nigeria
Some subprocessors process data outside Nigeria, for example AI providers in the United States or the European Union. We transfer personal data abroad only as Part VIII of the NDPA allows: to a country with adequate protection, or with appropriate safeguards such as contractual terms, or with your consent after telling you the risks. The subprocessors page says where each one processes data.
How long we keep it
We keep data only as long as the purpose needs it. What each product keeps, and for how long, is set out in our data policy. Conversations with an assistant are kept as part of your care record, until you or the organization that controls them asks for them to be deleted.
How we protect it
We protect data with encryption in transit, access control by role, hashed passwords and keys, and audit records of what staff and automated agents do. Our security page describes these measures. If a personal data breach is likely to put your rights at risk, we notify the NDPC within 72 hours of becoming aware of it, and tell you without undue delay where the risk to you is high.
Your rights
Under the NDPA you have the right to:
- be told how your data is used (this policy);
- get a copy of your data, in a common machine-readable format;
- have inaccurate data corrected;
- have your data deleted, where we no longer have a reason to keep it;
- restrict or object to how we use it;
- withdraw your consent at any time, without affecting what was done before;
- not be subject to a decision based only on automated processing that has legal or similarly significant effects on you.
To use any of these rights, email [email protected] from the address on your account. We may ask you to confirm who you are. We reply within 30 days. If your request is about data a clinic controls, we pass it to that clinic and help it respond.
Children
Our products are not for children to use on their own. A parent or guardian can keep a child's profile in ByteCare and make requests for them. We process a child's data only with the consent of a parent or guardian.
Changes to this policy
Each version has a version number and effective date, shown at the top of this page. When we change it in a way that matters, we tell account holders before the change takes effect.
Contact and complaints
Questions or requests about your data: [email protected].
If you are not satisfied with our answer, you can complain to the Nigeria Data Protection Commission at ndpc.gov.ng.