Privacy policy

Effective: to be set at launch · Last updated: August 2026
Applies to: the Boogso mobile app and boogso.com
Data controller: Hubaal Technologies Ltd

1. Who we are

Boogso is a healthcare application operated by Hubaal Technologies Ltd ("Hubaal", "we", "us"). We are the data controller for the personal information described in this policy.

For anything in this document, contact privacy@boogso.com.

2. What we collect

2.1 Information you give us

• Account details — phone number (required), name, gender, date of birth, and the region and language you select.
• Profile information — anything you add to your profile, including a photo if you upload one.
• Bookings and requests — the appointments you book, the tests you order, and the details you supply when requesting an ambulance, including the patient name and stated condition.
• Health information — records, prescriptions, diagnoses, lab and imaging results created by providers through Boogso, and anything you upload yourself.
• Messages — health questions you ask, reviews you write, and support requests you send.
• Conversations with Kaaliye — what you type to the in-app assistant, and what it replies. See section 4.1.
• Feedback on Kaaliye — whether you marked an answer useful or wrong, any correction you gave, and whether you acted on a suggestion (for example, booking an appointment it proposed).

2.2 Information collected automatically

• Location — only when you ask us to use it, and only for the request you're making. Attaching coordinates to an ambulance request is the main case. We do not track your location in the background.
• Device information — device model, operating system version, app version and a device identifier used to deliver notifications.
• Usage information — which screens are opened and when, and error reports when something crashes. Used to fix the app, not to profile you.

2.3 What we do not collect

• Your contacts, your photo library, your call log or your SMS messages.
• Location when the app is closed or in the background.
• Advertising identifiers. There is no advertising SDK in Boogso.

2.4 If you use a form on this website

The contact form and the provider application form on boogso.com send what you type — your name, phone number, email if you give one, and your message — to Formspree, a form-handling service in the United States, which forwards it to us by email. It is used only to deliver your message; Formspree does not use it for its own purposes. This is the only point at which website form data passes through a third party. If you would rather not use the form, the same pages list an email address you can write to directly.

3. Why we use it

• To run the service — create your account, issue your Health ID, process bookings and ambulance requests, store and show your records.
• To connect you with providers — passing the details a clinic needs to accept and honour your booking.
• To communicate — verification codes, booking confirmations, reminders, results and answers to your questions.
• To keep the service safe and working — detecting fraud and abuse, diagnosing crashes, understanding which features are used.
• To improve Kaaliye — using your feedback and whether its suggestions led you to the right care. Not the text of your conversations; see section 4.1.
• To meet legal obligations — including record-keeping duties that apply to health services.

We rely on your consent for optional processing such as location and notifications, on the performance of our agreement with you for the core service, and on our legitimate interest in a secure, functioning product for the rest. You can withdraw consent at any time in the app's settings.

4. Who sees your health information

Beyond that, we share personal information only with:

• Providers you interact with — a clinic you book with receives your name, contact number and the reason for the appointment, so it can honour the booking. An ambulance service receives what it needs to reach you.
• Service providers who work for us — hosting, SMS delivery and push notifications. They act on our instructions, are bound by contract, and may not use your data for their own purposes.
• Authorities — where we are legally required to disclose, or where disclosure is necessary to prevent serious harm to someone.
• A successor — if Hubaal is acquired or merged, under the same commitments in this policy. We would notify you before your data moved.

We do not sell personal or health information. We do not share it with advertisers, data brokers, or insurers for underwriting. This is not a current-policy statement that might change with a business model; it is a constraint we've placed on what Boogso is allowed to become.

4.1 Kaaliye, the in-app assistant

This is a deliberate and more expensive choice than calling someone else's service. We made it because what a person types when they are worried about their health is among the most revealing information they will ever put into a phone, and we do not think it should be handed to a third party to process.

• No outside AI provider is involved. There is no third party reading, storing or processing your conversations with Kaaliye.
• We improve Kaaliye from feedback, not from your conversations. When you tell us an answer was useful or wrong, or when you book the appointment it suggested, that tells us whether it guided you well — and that is what we learn from. The text of what you typed is not used to train the model. If that ever changes we will ask you first, and it will be opt-in.
• Your medical records are not sent automatically. Kaaliye only sees a record if you choose to share one with it in the conversation.
• You can delete the conversation history from the app at any time, and it goes from our systems too.

Kaaliye does not diagnose and is not a substitute for a clinician — see the terms of use.

5. How we protect it

• All traffic between the app and our servers is encrypted in transit using TLS.
• Stored data is encrypted at rest, and access to production systems is restricted to the small number of staff who need it, with individual accounts and logging.
• Boogso staff do not browse patient records in the normal course of running the service. Access for support happens only on your request and is recorded.
• Accounts are protected by phone-number verification rather than a password you might reuse elsewhere.

No system is perfectly secure, and anyone who tells you otherwise is selling something. If a breach affects your data we will tell you and the relevant authority, promptly and specifically, including what happened and what we're doing about it.

6. How long we keep it

• Medical records — retained for as long as your account is open, and afterwards only where health record-keeping law requires it.
• Account details — deleted within 30 days of you closing your account.
• Bookings and transactions — kept as long as accounting and tax rules require.
• Location data attached to a request — kept with the request record, not stored as a location history.
• Crash and usage logs — kept for up to 12 months.

7. Your rights

• Access — get a copy of what we hold about you.
• Correction — fix anything inaccurate. For a clinical record this means we ask the provider that created it to correct it, and we note your objection either way.
• Deletion — close your account and have your data erased, except where law requires us to keep it.
• Portability — export your records in a readable format to take elsewhere.
• Withdraw consent — turn off location, notifications or provider access at any time, without losing the rest of the app.
• Object — tell us to stop a particular use of your data.

Use Settings → Account in the app, or email privacy@boogso.com. We respond within 30 days and never charge for it.

8. Children

Boogso is for people aged 18 and over. A parent or guardian may manage care for a child through their own account, and is responsible for the information they enter. We do not knowingly create accounts for under-18s. If you believe a child has registered independently, tell us and we'll remove the account.

9. Where your data lives

Boogso's servers are hosted with commercial providers who may operate data centres outside Somalia. Where data crosses a border we use providers offering contractual protections at least equivalent to those described here. We will name our hosting regions on request.

10. Changes to this policy

We'll update this page when our practices change. For anything material — a new category of data, a new recipient, a change to retention — we'll notify you in the app before it takes effect, not quietly change a date at the top.

11. Contact and complaints

Privacy questions and requests: privacy@boogso.com
Anything else: hello@boogso.com

If we haven't resolved your concern, you can complain to the data protection authority in your jurisdiction. We'd rather you came to us first, but that right is yours regardless.