Kuranyx ← Back to site
Legal

Privacy policy

Last updated 28 August 2026

1. About this policy

Kuranyx provides a photoplethysmography (PPG)-based sleep-diagnostics service: a wearable ring oximeter records a night of physiological signals at home, cloud and on-device models analyse them, and a sleep physician reviews and signs off the resulting study through the related service Sleep AeroCare.

This policy explains what personal data Kuranyx collects, why, how it is protected, and the rights you have. It is written to meet the Nigeria Data Protection Act (NDPA) 2023.

The data controller is [Kuranyx legal entity name and RC number], The Waterside, 5 Admiralty Road, Off Admiralty Way, Lekki Phase 1, Lagos, Nigeria. Privacy contact: privacy@kuranyx.com.

2. Who this policy covers

  • Patients who use a Kuranyx ring oximeter and receive a sleep study.
  • Physicians who read studies through Sleep AeroCare.
  • Institution administrators — hospitals, clinics and payers — who manage sites and patients.
  • Visitors to this website.

3. What we collect

From patients

  • Identity and contact details: name, date of birth, sex, phone number, email, and where relevant a referring clinician.
  • Clinical background needed to interpret the study — such as relevant symptoms, medication and prior diagnoses — provided by you or your clinician.
  • Recorded physiological signals: blood oxygen saturation (SpO₂), pulse rate and body motion captured across the recording period.
  • Derived results: oxygen desaturation index, apnea–hypopnea burden, sleep-stage estimates, and the physician's report and sign-off.
  • Device and session information from the ring needed to process a recording, such as recording start and end times, firmware version and signal quality.

From physicians and institution administrators

  • Account details: name, work email, institution, professional role, and for physicians their licensing information.
  • Authentication data and access logs for the portal.

From website visitors

  • Limited server logs (IP address, request time, page requested, user agent) kept for security and to keep the service running. The website loads no third-party analytics or advertising and sets no tracking cookies — see section 11.

4. Why we use your data and our legal basis

Under the NDPA 2023 we rely on the following bases:

  • Providing the service — to record, process, interpret and deliver your sleep study, and to operate the portal. Basis: performance of a contract, and your consent for the processing of health data.
  • Clinical safety and quality — to check signal quality, investigate incidents and improve the accuracy of our models, including performance across skin tones. Basis: consent, and our legitimate interest in a safe, effective device. Data used to develop or validate models is minimised and, wherever possible, de-identified.
  • Legal and regulatory obligations — to meet medical-device, health-records and data-protection requirements, including engagement with NAFDAC and the Nigeria Data Protection Commission (NDPC). Basis: compliance with a legal obligation.
  • Security — to protect accounts and infrastructure. Basis: legitimate interest.
  • Vital interests — in rare cases, to protect someone's life or physical safety.

You can withdraw consent at any time (section 9). Withdrawing consent does not affect processing already carried out, and we may still need to keep certain records to meet legal obligations.

5. Physician review through Sleep AeroCare

Every study is reviewed and signed off by a qualified sleep physician, delivered through Sleep AeroCare. Physicians access only the data needed to interpret your study and are bound by professional confidentiality and by contract with Kuranyx.

6. Who we share data with

We do not sell your data and we do not use it for advertising. We share it only with:

  • The reviewing physician, and where you have a referring or treating clinician, that clinician.
  • Your institution, where your study was arranged through a hospital, clinic or payer — limited to what that institution needs to manage your care and its account.
  • Service providers who process data on our behalf under written contract and only on our instructions — principally cloud hosting and processing, and communications tools. They may not use your data for their own purposes.
  • Authorities and regulators where we are legally required to disclose, or to establish or defend legal claims.
  • A successor entity if Kuranyx is involved in a merger, acquisition or reorganisation, subject to this policy.

7. Where your data is stored and international transfers

Kuranyx is establishing Nigeria-resident infrastructure so that patient data is stored and processed in Nigeria. Until that migration is complete, some patient data is processed outside Nigeria by our service providers under contractual and technical safeguards consistent with the NDPA 2023 — including standard contractual protections, encryption and access controls. This section will be updated when the migration is complete.

8. How we protect your data

  • Encryption of data in transit and at rest.
  • Role-based access on a least-privilege basis, so staff and physicians see only what they need.
  • Authentication controls on the portal and administrative systems.
  • Logging and monitoring of access to health data.
  • Contractual security obligations on every processor.
  • Regular review of these measures as the service and its regulatory footprint develop.

No system is perfectly secure, but we work to protect your data and to meet our breach-notification duties under the NDPA 2023 if something goes wrong.

9. Your rights

Under the NDPA 2023 you can:

  • ask for a copy of the personal data we hold about you;
  • ask us to correct data that is wrong or incomplete;
  • ask us to delete your data, where there is no overriding legal or clinical reason to keep it;
  • ask us to restrict or object to certain processing;
  • ask for your data in a portable format, or ask us to transfer it;
  • withdraw consent for processing that relies on consent;
  • lodge a complaint with the Nigeria Data Protection Commission (NDPC).

To exercise any of these, email privacy@kuranyx.com. We will respond within the timeframe set by the NDPA 2023. We may need to verify your identity first. There is normally no charge.

10. Children's data

Sleep studies are sometimes carried out for children. Where the patient is a minor, the study is arranged and consented to by a parent or legal guardian, who can exercise the rights in section 9 on the child's behalf.

11. Cookies and similar technologies

This website does not use tracking or analytics cookies and loads no third-party trackers; fonts are served from our own servers. The sign-in portal uses only storage that is strictly necessary to keep you signed in and to remember your role selection. It does not track you across sites.

12. How long we keep data

We keep personal data only as long as it is needed for the purpose it was collected for — including clinical care — and for the minimum periods required by medical-records and regulatory law. After that it is securely deleted or irreversibly anonymised. Account data for physicians and institution administrators is kept for as long as the account is active and for a limited period afterwards.

13. Changes to this policy

We may update this policy as the service, our infrastructure or the law changes. We will change the "last updated" date above, and for significant changes affecting patients we will provide a more prominent notice.

14. Contact us

Questions, requests or complaints about privacy:

privacy@kuranyx.com
[Kuranyx legal entity name]
The Waterside, 5 Admiralty Road, Off Admiralty Way, Lekki Phase 1, Lagos, Nigeria
+234 816 992 8898

You can also contact the Nigeria Data Protection Commission (NDPC) at ndpc.gov.ng.