Legal

Privacy policy

Last updated 11 October 2026

1. About this policy

This policy applies to the KuraNyx website (kuranyx.com), the KuraNyx Android wellness app, the KuraNyx clinician portal and related KuraNyx services. It describes four kinds of use separately, because they involve different information:

Website visitors — people who browse kuranyx.com.
Android wellness-app users — people who record overnight physiological measurements with a compatible monitoring device and view their measurements and trends in the app.
Clinician-portal users — authorized physicians, clinical staff and institution administrators who review recordings and reports.
Investigational clinical and research processing — separate technical and clinical evaluation of our software, described in section 4.

The wellness app is intended for general wellness and informational purposes. It is not intended to diagnose, treat, cure or prevent any medical condition, and it does not replace professional medical advice or clinical sleep testing. Clinical and research processing is separate from the app's intended functionality and is described below.

This policy is written to meet the Nigeria Data Protection Act (NDPA) 2023. The data controller is KuraNyx Health Limited (RC 9654434), The Waterside, 5 Admiralty Road, Off Admiralty Way, Lekki Phase 1, Lagos, Nigeria. Contact: admin@kuranyx.com.

2. Who this policy covers

Visitors to this website.
Users of the KuraNyx Android app, who record measurements with a compatible third-party pulse-oximetry device. KuraNyx does not manufacture or supply the device.
Physicians, clinical staff and institution administrators who use the clinician portal.
People whose data is included in investigational clinical or research evaluation.

The app and the clinician portal are for adults aged 18 and over. We do not knowingly collect information from anyone under 18; if you believe we have, please contact us.

3. What we collect

Website visitors

Limited server logs (IP address, request time, page requested, user agent) kept for security and to keep the service running. The website loads no third-party analytics or advertising and sets no tracking cookies — see section 10.
If you email us, we receive your email address and the content of your message. Please do not send health information by email.

Android wellness-app users

Account and profile details you enter during enrollment: name, date of birth, sex, height, weight, ethnicity, country, phone number, email address, a patient or study identifier, and, where relevant, a referring clinician and referral reason. We also record your consent and when you gave it.
Questionnaire responses to the sleep and health questionnaires in the app, if you complete them — including sleepiness, snoring and tiredness, sleep pattern, body measurements and lifestyle questions.
Recorded measurements: blood oxygen saturation (SpO₂), pulse rate and perfusion index recorded about once per second with timestamps, together with device status flags such as probe-off, searching and battery level. The app shows you basic measurements and overnight trends, including SpO₂ and pulse rate.
Device information: your monitoring device's model and identifier, and the Bluetooth connection details needed to pair it and transfer your recording. Android requires the location permission to scan for Bluetooth devices; the app does not use it to record your location.
Technical information: app version, phone model and operating system, and upload status used to retry failed uploads.

Calculations made from your recording

When a recording is uploaded, our cloud service calculates further measures from the stored SpO₂, pulse and perfusion data — including oxygen-desaturation measures, time below 90% SpO₂, hypoxic burden, estimated apnea–hypopnea index, sleep-stage estimates, recording-quality measures and a composite risk score. These calculations are part of the clinical and research workflow described in sections 4 and 5. They are not offered as a diagnosis, and the wellness app is not designed to present them as one.

Clinician-portal users

Account and identity details: name, professional email, phone number, institution, role and, for physicians, licensing or registration information.
Authentication data, including multi-factor authentication and session activity.
Patient information you access: recordings, calculated results and the profile and questionnaire information linked to them.
Review activity: notes, annotations, interpretations, edits and sign-off on reports, with a change history, and logs of who accessed which record and when.

4. Why we use your data and our legal basis

Under the NDPA 2023 we rely on the following bases:

Providing the service — to create your account, connect your device, record and process your measurements, show you your measurements and trends, and operate the clinician portal. Basis: performance of a contract, and your consent for the processing of health data.
Sharing with your care team — to make recordings and results available to your referring clinician or institution so they can be reviewed (section 5). Basis: your consent, and the provision of healthcare by or under a health professional.
Investigational clinical and research evaluation — to evaluate and improve our software algorithms, including comparison with established sleep-monitoring technologies and performance across skin tones and populations. This processing is separate from the wellness app's intended functionality. Basis: consent and our legitimate interest in a safe, effective product. Data used for development or validation is minimised and, wherever possible, de-identified.
Legal and regulatory obligations — to comply with applicable laws, including data-protection requirements and engagement with the Nigeria Data Protection Commission (NDPC), and to respond to lawful requests from regulators. Basis: compliance with a legal obligation.
Security — to protect accounts and infrastructure. Basis: legitimate interest.
Vital interests — in rare cases, to protect someone's life or physical safety.

We do not sell your personal or health information, and we do not use health information for advertising or for decisions about employment or insurance eligibility.

You can withdraw consent at any time (section 9). Withdrawing consent does not affect processing already carried out, and we may still need to keep certain records to meet legal obligations.

5. Clinician review and clinical workflows

Recordings uploaded through the app, and the results calculated from them, may be made available to a clinician or institution through the KuraNyx clinician portal so that a sleep physician or other authorized clinician can review them. Clinicians access only the data needed to review the recording, are bound by professional confidentiality and by contract, and remain responsible for their own clinical decisions.

The clinician portal is a tool for healthcare professionals. Its outputs support, and do not replace, clinical judgement. Clinical review is separate from the wellness app's own measurements and trends.

We do not sell your data and we do not use it for advertising. We share it only with:

Your authorized healthcare provider, care team and clinic, so your recording can be reviewed, including a referring or treating clinician.
A clinician's organization or institution, consistent with its data-protection role and its agreement with KuraNyx — limited to what that institution needs to manage your care and its account.
Service providers who help us host, operate and secure our services — principally Amazon Web Services for cloud hosting, storage, authentication and email — under written contract and only on our instructions. They may not use your data for their own purposes.
Authorities and regulators where we are legally required to disclose, or to establish or defend legal claims.
A successor entity if KuraNyx is involved in a merger, acquisition or reorganisation, subject to this policy.

Depending on the service and the processing, KuraNyx and a healthcare provider or institution may each act as independent controllers, as joint controllers, or KuraNyx may act as a processor on behalf of the healthcare organization. The applicable roles are set out in the relevant agreement.

7. Where your data is stored and international transfers

Recordings and results from the app are stored and processed on Amazon Web Services infrastructure in the Africa (Cape Town) region, in South Africa. For information about individuals in Nigeria, storing or accessing it outside Nigeria is a cross-border transfer under the NDPA 2023, and we make such transfers only with the safeguards the NDPA requires, including contractual protections, encryption and access controls.

8. How we protect your data

Encryption of data in transit and at rest.
Role-based access on a least-privilege basis, so staff and clinicians see only what they need.
Multi-factor authentication for clinician-portal users.
Logging and monitoring of access to health data.
Contractual security obligations on every processor.

No system is perfectly secure, but we work to protect your data and to meet our breach-notification duties under the NDPA 2023 if something goes wrong.

9. Your rights

Under the NDPA 2023 you can:

ask for a copy of the personal data we hold about you;
ask us to correct data that is wrong or incomplete;
ask us to delete your data, where there is no overriding legal or clinical reason to keep it;
ask us to restrict or object to certain processing;
ask for your data in a portable format, or ask us to transfer it;
withdraw consent for processing that relies on consent;
lodge a complaint with the Nigeria Data Protection Commission (NDPC).

To exercise any of these, or to ask us to delete your account and data, email admin@kuranyx.com. We will respond within the timeframe set by the NDPA 2023 and may need to verify your identity first. There is normally no charge. We may keep information that the law, security or clinical-record rules require, such as records already part of a provider's clinical file, and we will tell you what is kept and why. Requests about information held by your care team should go to that care team or the applicable controller.

10. Cookies and similar technologies

This website does not use tracking or analytics cookies and loads no third-party trackers; fonts are served from our own servers. The sign-in portal and the app use only what is strictly necessary to keep you signed in. They do not track you across sites.

11. How long we keep data

We keep personal data only as long as it is needed for the purpose it was collected for and for the minimum periods required by medical-records and regulatory law. Account information is kept while your account is active. Sleep recordings, reports and clinical review records are part of the clinical record and are kept for 6 years. Audit logs are kept for 2 years. After that, data is securely deleted or irreversibly anonymised. Account data for clinicians and institution administrators is kept while the account is active and for a limited period afterwards.

12. Changes to this policy

We may update this policy as the service, our infrastructure or the law changes. We will change the "last updated" date above, and for significant changes affecting app users we will provide a more prominent notice.

13. Contact us

Questions, requests or complaints about privacy:

admin@kuranyx.com
KuraNyx Health Limited (RC 9654434)
The Waterside, 5 Admiralty Road, Off Admiralty Way, Lekki Phase 1, Lagos, Nigeria
+234 816 992 8898

You can also contact the Nigeria Data Protection Commission (NDPC) at ndpc.gov.ng.