Privacy notice

This notice explains what Ndu Well Therapy collects, why, who can see it, how long it is kept and what you can do about it. It is written to meet the Nigeria Data Protection Act 2023.

The short version: therapists see your username and picture, never your email address or phone number. Your journal is yours unless you share an entry. We never sell your information, and we never use what you say in a session for advertising.

Who we are

Ndu Well Therapy is responsible for the information described here. You can reach us about privacy at support@nduwelltherapy.com.

What we collect

• Your account: email address, a password (stored only in a form that cannot be read back), your username and picture. If you sign in with Google, we store only the account identifier and email address Google provides.
• Therapists: full name, photograph, licence details, identity documents, qualifications and a payout account.
• Sessions: bookings, the words exchanged in a session room, voice notes and photos you send, voice recordings and their transcripts, the moods you record when you arrive and leave, and letters.
• Your journal and results: journal entries, and the results of any tests or games you choose to take.
• Payments: what you paid, refunds and wallet movements. Card details are handled by Paystack; we never see or store your full card number.
• Technical information: the device and browser you use, your IP address and sign-in times, used to keep your account secure.

We do not ask for your real name, your address or your phone number as a client.

Why we use it

• to provide your account, sessions, payments and the features you use (our agreement with you);
• to keep people safe, prevent fraud and settle concerns about sessions (our legitimate interest, and our legal obligations);
• to meet our legal, tax and accounting obligations;
• to send you messages you have chosen to receive, which you can switch off at any time (your consent).

Information about your mental health is sensitive. We use it only to provide your sessions and the features you have chosen, and to handle a concern you raise.

Who can see it

• Your therapist sees your username, picture, what you share in your sessions and letters, and journal entries only if you share them.
• Our staff see only what their role needs. Staff read a session only when you raise a concern and allow it, and every such reading is logged.
• Service providers process information for us under contract, only to provide their service: Paystack (payments), Cloudflare (file storage and speech-to-text), Agora (voice calls), Mailgun (email, only if our own mail server is unavailable), Google Firebase (notifications to your phone), and our hosting provider. Some of them process information outside Nigeria; where they do, we rely on the safeguards the Act requires.
• Authorities, only where the law requires it.

We never sell your information.

How long we keep it

• Session words, voice notes and photos: you can open and download them for 30 days; your therapist can read them for 48 hours. They are then removed from our servers. An encrypted archive copy is kept for resolving disputes and is deleted by our staff on a schedule.
• Voice recordings: the audio is deleted after 7 days; its transcript follows the rule above.
• Anything connected to a concern is kept, sealed, until the concern is settled and our staff delete it.
• Letters: removed on the same schedule as session words.
• Results taken without an account: forgotten after 48 hours unless you create an account.
• Accounts never confirmed: removed after 7 days.
• Payment records: kept for as long as tax and accounting law requires, even after an account is closed.

How we protect it

Session content, letters, journal entries and payout account numbers are encrypted when stored. Archives and sealed records use separate keys. Staff accounts need an authenticator code, and sensitive actions are logged.

Your rights

You may ask to see the information we hold about you, to correct it, to delete it, to receive a copy of it, or to object to how we use it. You may withdraw consent you have given at any time. Write to support@nduwelltherapy.com and we will reply within the time the law allows. If you are not satisfied, you may complain to the Nigeria Data Protection Commission.

Cookies

We use cookies only to keep you signed in and to remember your settings, such as light or dark mode. We do not use advertising cookies.

Children

Ndu Well is for people aged 18 and over. If you believe a child has created an account, please tell us and we will close it.

Changes

When we change this notice, we publish the new version with the date it takes effect. For an important change, we ask you to read it the next time you use Ndu Well.