Privacy Policy

1. Introduction

Baobab Health (“Baobab Health,” “we,” “us,” or “our”) is operated by JJO Digital Inc., an Ontario, Canada corporation. We are committed to handling your personal information responsibly and explaining how it is collected, used, stored, and disclosed when you use our mobile application and related services (collectively, the “Services”).

Baobab Health helps users record and review health-related information, including skin symptoms, lesions, flare-ups, possible triggers, medications, and personal notes. Because this information may be sensitive, we encourage you to review this Privacy Policy before using the Services.

This Privacy Policy should be read together with our Terms and Conditions.

2. Information We Collect

The information we collect depends on how you use Baobab Health.

2.1 Account and Sign-In Information

Baobab Health supports account access through Google, Apple, and email. When you create or access an account, we may collect information such as your email address, name, and account identifiers associated with your selected sign-in method.

When you use Google or Apple sign-in, we receive the account information made available by the provider and authorized through your sign-in settings. This may include your name and email address. If you use Apple Sign-In, you may choose to share your personal email address or use Apple's private email relay feature, which provides an alternative email address that forwards messages to your personal inbox.

We use this information to authenticate your identity, create and manage your account, and provide access to the Services.

2.2 Health Information and User Content

You may choose to enter information into Baobab Health, including:

• Skin symptoms, lesions, cysts, and flare-ups.
• Dates, duration, severity, and changes in symptoms.
• Potential triggers and related factors, such as food, stress, sleep, or menstrual cycle information, where provided.
• Medications and other information you choose to record.
• Personal notes, observations, and information prepared for healthcare appointments.

This information may reveal details about your health and is treated as sensitive personal information. You are responsible for the information you choose to enter into the Services. Please avoid including information about other people unless you have an appropriate basis to do so.

2.3 Technical and Usage Information

When you use Baobab Health, we and our service providers may collect certain technical and usage information to understand how the application is used, maintain its functionality, and improve its performance. We use Google Analytics for Firebase, with Google Analytics 4 linked to our Firebase Analytics implementation, to measure application usage and understand how users interact with the Services.

Depending on the analytics configuration, information collected may include number of users and app sessions; session duration and app activity; device models and operating systems; app launches, first opens, and updates; app-instance identifiers and other technical identifiers; general usage events and interactions with application features; and approximate geographic information derived from technical data, where applicable.

We may also process technical information such as IP addresses, timestamps, application versions, and diagnostic information, depending on the configuration of the Services. We use this information to understand general app usage, monitor performance, troubleshoot technical issues, and improve the user experience.

2.4 Crash and Diagnostic Information

We use Firebase Crashlytics to help identify, investigate, and resolve application crashes and technical errors. Crashlytics may collect crash reports and technical error details; device model and operating system information; application version and crash timestamps; crash stack traces and diagnostic information; and technical identifiers associated with an application installation.

We configure crash reporting to avoid including users' health entries, symptom descriptions, medication information, or personal notes in crash reports and diagnostic information. This information helps us identify technical problems and improve the stability and reliability of Baobab Health.

2.5 Website and Waitlist Information

If you join the Baobab Health waitlist or contact us through our website, we may collect information such as your email address and any information you voluntarily provide. We use MailerLite for waitlist or email communications. MailerLite may process the information needed to provide those services on our behalf, subject to the configuration and terms of that service.

3. How We Use Your Information

We may use personal information to create, authenticate, and manage your account; provide symptom-tracking and record-keeping features; store and display information you choose to record; enable you to review records and prepare information for healthcare appointments; respond to support requests and communicate important service information; administer waitlist registrations and requested communications; understand general app usage and engagement; maintain, troubleshoot, protect, and improve the Services; investigate technical issues, suspected misuse, or security incidents; and comply with applicable legal obligations.

We configure our analytics and crash-reporting services to exclude the personal health entries you record in Baobab Health. This includes symptom descriptions, flare-up details, medication information, and personal health notes. These details are not intended to be included in analytics event parameters, analytics user properties, or crash-reporting diagnostics.

We will not use your personal health information for a purpose materially different from the purposes described in this Privacy Policy without obtaining consent where required by applicable law.

4. Health Information and Consent

Baobab Health is designed to help you track information about your own health experience. Your entries may reveal sensitive details, even when you enter them for personal record-keeping.

Where required, we will seek your consent before collecting, using, or disclosing sensitive personal information. We will explain the relevant purposes in a manner intended to help you understand what you are agreeing to.

You may choose what health information to enter. However, some information may be necessary for particular features to work.

Baobab Health is not a medical provider and does not provide medical diagnosis or treatment. The app's tracking features are not a substitute for professional medical advice.

5. How We Share Information

We do not sell your personal health information. We may disclose personal information in the limited circumstances described below.

5.1 Service Providers

We may use third-party service providers to support the operation and delivery of Baobab Health. Our service providers include:

• DigitalOcean: Provides managed database and hosting infrastructure for the Baobab Health application.
• Google Analytics for Firebase and Google Analytics 4: Support app usage measurement and analytics.
• Firebase Crashlytics: Supports crash reporting and technical diagnostics.
• Google and Apple: Support account authentication when you choose to sign in through these providers.
• MailerLite: Supports our waitlist and email communications.

These providers may process personal information on our behalf or in connection with the services they provide. The information they may access depends on the services they provide and how those services are configured. We take reasonable steps to ensure that service providers handle personal information appropriately and only for authorized purposes.

5.2 Legal Obligations and Protection

We may disclose information where we reasonably believe disclosure is required by law, legal process, or a valid request from an authorized authority, or where necessary to investigate suspected fraud, address security incidents, protect the Services, or protect the rights and safety of users or others, subject to applicable law.

5.3 Business Transactions

If JJO Digital Inc. is involved in a merger, acquisition, financing, restructuring, or sale of some or all of its business or assets, personal information may be transferred as part of that transaction, subject to applicable legal requirements and appropriate safeguards.

5.4 Aggregated or De-identified Information

We may use aggregated or de-identified information to understand general usage, evaluate the Services, or support product development. We will not represent information as de-identified unless reasonable steps have been taken to remove or reduce the ability to identify an individual. We will not use this provision to authorize a use or disclosure of identifiable health information that is otherwise inconsistent with this Privacy Policy or applicable law.

6. Data Storage and Security

Baobab Health uses DigitalOcean Managed Databases hosted in Ontario, Canada, to store application database information.

DigitalOcean Managed Databases provide encryption at rest and support encrypted database connections using TLS/SSL. Our application database connections enforce TLS/SSL and verify the database server certificate to help protect information transmitted between connected systems.

We also take reasonable steps to restrict access to personal information to authorized individuals and services that require access to operate and maintain Baobab Health.

We use a 14-day retention period for applicable production database backups. Backup availability, restoration, and deletion are subject to the capabilities and configuration of our hosting service.

We take the protection of personal information seriously and seek to use appropriate safeguards to protect information against unauthorized access, loss, misuse, alteration, or disclosure. No method of electronic storage or transmission can be guaranteed to be completely secure.

7. Data Retention, Access, and Deletion

We retain personal information for as long as reasonably necessary for the purposes described in this Privacy Policy, subject to applicable legal requirements and legitimate operational needs.

You can request deletion of your Baobab Health account through the account-deletion feature available in the application.

When you request account deletion, we take steps to delete the account information and associated health records linked to your account, including information you have recorded in the application, subject to applicable legal requirements and any information we are permitted or required to retain.

Our applicable production database backup retention period is 14 days. Information contained in these backups may remain temporarily after an account deletion request until the applicable backup expires or is replaced through the normal backup process.

Other technical records and service-provider logs may be subject to separate retention periods determined by the relevant service provider or operational requirements. Where information must be retained for legal, security, or legitimate operational reasons, we will limit its use to those purposes.

If you have questions about account deletion or the handling of your information, you can contact us at support@thebaobabapp.com. You may also contact us to request access to or correction of personal information we hold about you, subject to applicable law.

8. App Technologies and Device Permissions

Baobab Health uses Google Analytics for Firebase, Google Analytics 4, and Firebase Crashlytics to support app analytics, crash reporting, and technical troubleshooting. These technologies may process technical information, app usage events, device information, identifiers, and diagnostic information, depending on their configuration.

We configure these services to exclude users' personal health entries, including symptom descriptions, flare-up details, medication information, and personal health notes, from analytics events, user properties, and crash-reporting diagnostics.

Baobab Health may request permission to send notifications to your device. Notifications may be used to provide app-related reminders, updates, or other communications associated with features you use. You can manage notification permissions through your device settings. Disabling notifications may affect your ability to receive certain app communications.

9. Email and Other Communications

We may send you service-related messages, respond to enquiries, and provide waitlist updates or other communications you have requested.

Where we send promotional or marketing emails, we will provide an unsubscribe mechanism where required by law. Unsubscribing from marketing messages will not necessarily stop essential account, security, or service-related communications.

You can contact us if you have questions about communications you receive from Baobab Health.

10. Your Privacy Rights

Depending on the applicable law and circumstances, you may have the right to:

• Request access to personal information we hold about you.
• Request corrections to inaccurate or incomplete information.
• Withdraw consent where permitted by applicable law.
• Ask questions about how your personal information is collected, used, or disclosed.
• Request deletion of your account and associated personal information, subject to applicable retention obligations.

You can delete your account through the app. For other privacy-related requests, contact us using the details in Section 15.

We will review and respond to requests in accordance with applicable law. Certain legal exceptions or retention obligations may affect how a request can be fulfilled.

Canadian privacy laws may apply to our handling of personal information, including the Personal Information Protection and Electronic Documents Act (PIPEDA) and applicable provincial legislation, depending on the circumstances.

11. International Processing

Baobab Health is operated by JJO Digital Inc., an Ontario, Canada corporation. Our application database is hosted using DigitalOcean Managed Databases in Ontario, Canada.

However, not all service providers necessarily process information in Canada. Google services, including Google Analytics for Firebase, Google Analytics 4, and Firebase Crashlytics, may process technical and usage information using Google's global infrastructure.

Information processed by third-party service providers may be stored or processed in jurisdictions outside Canada and may be subject to the laws of those jurisdictions.

We take reasonable steps to ensure that personal information handled by our service providers is protected in accordance with our obligations under applicable privacy laws.

12. Children's Privacy

Baobab Health is intended for individuals who are at least 16 years old. The Services are not designed for children under the age of 16, and we do not knowingly collect personal information from children under 16.

If we become aware that a child under 16 has provided personal information through the Services, we will take appropriate steps to review the situation and delete the information where required by applicable law.

If you believe a child under 16 has provided us with personal information, please contact us at support@thebaobabapp.com.

13. Third-Party Websites and Services

The Services may link to third-party websites or services. Those third parties have their own privacy policies and practices, which we do not control.

We encourage you to review the privacy terms of any third-party service you choose to use, including Google, Apple, DigitalOcean, and MailerLite.

14. Changes to This Privacy Policy

We may update this Privacy Policy from time to time to reflect changes in the Services, our information-handling practices, or applicable legal requirements.

When we make changes, we will update the “Last updated” date. Where required by law, we will provide notice or seek consent for material changes.

We encourage you to review this page periodically to stay informed about how we handle personal information.

15. Contact Us

If you have questions about this Privacy Policy or wish to make a privacy-related request, please contact us: