Privacy Policy

This policy applies to parents and caregivers, the children they register for care, therapists, clinical supervisors, and administrators using the Hayven platform (the "Service").

Hayven is operated by Hayven Health Limited (RC 9879135) ("Hayven," "we," "us"), registered in Nigeria, of No. 17, Aganga Williams, Ogba, Ikeja, Lagos State, Nigeria. For everything below, Hayven is the data controller.

Account information, from everyone. Full name, email address, phone number, password (stored securely by our authentication provider, never visible to us in plain text), and your role on the platform.

About your child, from parents. First name, date of birth, presenting concern, and any diagnoses you or your therapist choose to record. You control what goes into your child's profile.

Clinical and session information, from therapists. Session notes, goals, target behaviours, skill tracking, and the reports generated from a session. Some observations recorded during a session are confidential clinical notes, visible only to therapists directly involved in your child's care, and never included in the report shared with you.

Professional information, from therapists. Professional bio, qualifications, licensing/credential documents, years of practice, and specialties, used to verify a therapist before they're listed publicly.

Booking, payment, and messages. Session bookings, and messages exchanged between a parent and therapist about a booking. Payments are processed by Flutterwave. Hayven never receives or stores your full card details (see Section 5).

Technical information. Basic device and access logs kept by our hosting providers for security purposes (for example, sign-in timestamps).

Product and site analytics. Which pages are visited, how long a page takes to load, and coarse actions like “search performed” or “booking started”, used to understand how the Service is used and to fix what's slow or broken. These events never include a child's name, date of birth, presenting concern, session notes, or report content (see Section 5). We do not run third-party advertising trackers, ad pixels, or sell any data to data brokers.

We use your information to:

• Create and secure your account, and verify a therapist's credentials before they can practise on Hayven
• Match families with therapists, and manage bookings, scheduling, and payments
• Let a therapist record session data and generate reports you can review
• Let clinical supervisors oversee the therapists they're responsible for
• Investigate safety concerns, enforce our terms, and keep an audit trail of sensitive actions (e.g. who approved a therapist, who accessed a clinical record)
• Comply with legal, tax, and professional record-keeping obligations

Our legal basis is, depending on the activity: your consent (for example, registering your child and their health information), the necessity of processing to perform our contract with you (bookings, payments), and our legitimate interest in keeping the platform safe (audit logs, fraud prevention). Where we rely on consent, you can withdraw it at any time (see Section 7).

Hayven is not directed at children, and children do not create their own accounts. A child's profile is created and controlled entirely by their registered parent or caregiver, who is the one consenting to its collection. Only the therapist(s) actively assigned to a child, that child's supervising clinician (where applicable), the child's own parent, and Hayven administrators (for safety and support purposes) can ever see a child's clinical information, enforced at the database level, not just in the app's screens.

If you believe a child's information was added to Hayven without appropriate parental consent, contact us immediately at the email in Section 10 and we will investigate and remove it.

We don't sell your data. We share it only as needed to run the Service:

• Other Hayven users, by role. A therapist sees the children assigned to them; a supervisor sees the therapists they oversee; a parent sees their own child's published reports and messages. These boundaries are enforced by database-level access rules, not just by what a screen happens to show.
• Supabase (database, authentication, and file storage) and Vercel (application hosting), our infrastructure providers, bound by their own security and confidentiality obligations.
• Flutterwave for payments. Flutterwave receives what's needed to complete your transaction directly; Hayven never sees or stores your full card number.
• PostHog (product analytics, EU-hosted) and Google Analytics (site-traffic analytics). Both receive only your role, the page or action, and coarse timing/counts. Neither ever receives your name, email, a child's details, session notes, or report content; we do not enable Google Signals or ad personalisation on our Google Analytics property.
• Google (optional “Continue with Google” sign-in for parents). If you choose it, Google confirms your identity and shares your name and email address with us. We don't receive your Google password, contacts, or other Google data, and Google isn't told anything about your child or your use of Hayven.
• Legal or safety exceptions. If required by law, or where we believe in good faith it's necessary to protect a child's safety or the rights of others.

International transfers. Our database, authentication, and file storage (Supabase) and our application hosting (Vercel) are located in the United Kingdom. Our product analytics provider (PostHog) and our error-monitoring provider (Sentry) are both EU-hosted. Our email provider (Resend) and our credential-document virus-scanning provider (Cloudmersive) process data in the United States by default. Google Analytics may process information on infrastructure located outside Nigeria and the UK/EU.

The periods below are our current defaults, applied consistently across the Service:

• Active accounts. Kept for as long as your account is active.
• After you delete your account. Personal account information (name, contact details, non-clinical data) is deleted within 30 days of a verified deletion request.
• Clinical records (including session notes, reports, goals, behaviour data, and the child's core identifying details recorded as part of their care) are kept for up to 6 years after the child's last recorded session, even after an account is deleted, to support continuity of care and meet applicable professional record-keeping obligations.
• Payment and transaction records are kept for 6 years, on a separate retention timeline independent of account and clinical-record retention periods.
• Security and audit logs are kept for 24 months, then deleted.

Under the Nigeria Data Protection Act (NDPA), you can ask us to:

• Confirm what personal data we hold about you or your child, and get a copy of it
• Correct information that's inaccurate or out of date
• Delete your account and associated personal data, subject to the retention periods in Section 6
• Withdraw a consent you previously gave us
• Object to, or ask us to restrict, a particular use of your data

To exercise any of these, email us at the address in Section 10. We'll respond within the timeframe required by the NDPA. If you're not satisfied with our response, you have the right to lodge a complaint with the Nigeria Data Protection Commission (NDPC).

Access to clinical and personal data is restricted by role at the database level, so a therapist can only ever query the children actually assigned to them, not the wider platform. Passwords are hashed by our authentication provider, never stored by Hayven in readable form. Data is encrypted in transit between your device and our servers. Sensitive administrative actions (verification decisions, record access, payment corrections, report downloads) are recorded in an internal audit trail.

Downloading reports. A therapist can download their own session reports as PDF files, a clinical supervisor can download the clinical reports of the therapists they oversee, and a parent can download the reports published about their own child. Each download is recorded in our audit trail (who downloaded which report, and when), and every file carries a confidentiality notice with the name of the person who downloaded it. Once a file is on your device it is outside Hayven's technical controls, so please store it securely and share it only with people who are entitled to see it.

No system is perfectly secure, and we can't guarantee absolute security of any transmission.

If a breach happens. If we become aware of a security breach that risks your or your child's personal data, we will notify the Nigeria Data Protection Commission (NDPC) within 72 hours of becoming aware of it, and where the breach is likely to result in a high risk to you, we will also notify you directly and without undue delay, explaining what happened and what we're doing about it.

Hayven uses the cookies and on-device storage needed to keep you signed in and let the app work offline as an installed PWA, plus first-party analytics cookies set by PostHog and Google Analytics (Section 5) to tell returning visits apart. We don't use third-party advertising or cross-site tracking cookies.

Questions, concerns, or a request about your data: hayvenmind@gmail.com.

Data Protection Officer. Data protection questions and requests go to our Data Protection Officer at the email address above.

If we make a material change to this policy, we'll update the effective date above and, for significant changes, let you know directly (by email or in-app) before they take effect.