Home / Privacy policy
Privacy policy
Written to be read, not to be survived. If anything here is unclear, ask us and we'll rewrite it.
Boogso is in preview. The clinics, doctors and money in the app are demonstrations, marked "(Demo)". No real appointment is booked and no real money moves. Your account is real, so this policy applies to it in full. When Boogso launches fully, we will clear your demo bookings, payments and wallet balance, and keep your account. See section 6.1.
The short version. We collect what the app needs to work: your phone number, your profile, and the health records created through Boogso. We do not sell it. We do not share your health information with a provider unless you grant that provider access, and you can withdraw it. You can ask us for a copy of your data, or for it to be deleted, at any time.
This summary has no legal force on its own — the sections below are the policy. It's here because a policy nobody reads protects nobody.
1. Who we are
Boogso is a healthcare application operated by Hubaal Technologies Ltd ("Hubaal", "we", "us"). We are the data controller for the personal information described in this policy.
For anything in this document, contact privacy@boogso.com.
2. What we collect
2.1 Information you give us
- Account details — phone number (required), name, gender, date of birth, and the region and language you select.
- Profile information — anything you add to your profile, including a photo if you upload one.
- Bookings and requests — the appointments you book, the tests you order, and the details you supply when requesting an ambulance, including the patient name and stated condition.
- Health information — records, prescriptions, diagnoses, lab and imaging results created by providers through Boogso, and anything you upload yourself.
- Messages — reviews you write and support requests you send.
2.2 Information collected automatically
- Location — only when you ask us to use it, and only for the request you're making. Attaching coordinates to an ambulance request is the main case. We do not track your location in the background.
- Technical information — like any website, our servers log each request with its time, IP address and the browser or app version that sent it. We use these logs to keep the service running and to stop abuse.
Boogso has no analytics or crash-reporting service. We do not record which screens you open.
2.3 What we do not collect
- Your contacts, your photo library, your call log or your SMS messages.
- Location when the app is closed or in the background.
- Advertising identifiers. There is no advertising SDK in Boogso.
2.4 If you use a form on this website
The contact form on the Contact page and the provider application form on the For providers page send what you type — your name, the email address or phone number you want us to reply on, and your message (for providers, also the facility’s name, type and city) — straight to our own servers, not to a third party. Our team reads it there and replies on the email address or phone number you gave, which for a phone number may be by WhatsApp. We keep it as a record of your request, and we delete it if you ask. If you would rather not use a form, the same pages list an email address you can write to directly.
The Create your account form on the Get the app page also goes straight to our own servers: it sends your name, mobile number, the password you choose, your email address if you give one, phone type (Android or iPhone), preferred language and the link you came from. We use it to create your preview account straight away; your password is stored only in scrambled (hashed) form, so nobody at Boogso can read it. If you give an email address we use it only to tell you your account is ready, never to send your password. Your number is not verified when the account is made: once Boogso sends SMS codes we will ask you to confirm it, and we delete your details if you ask.
3. Why we use it
- To run the service — create your account, issue your Health ID, process bookings and ambulance requests, store and show your records.
- To connect you with providers — passing the details a clinic needs to accept and honour your booking.
- To communicate — verification codes, booking confirmations, reminders, results and answers to your questions.
- To keep the service safe and working — detecting fraud and abuse and fixing faults.
- To meet legal obligations — including record-keeping duties that apply to health services.
We rely on your consent for optional processing such as location and notifications, on the performance of our agreement with you for the core service, and on our legitimate interest in a secure, functioning product for the rest. You can withdraw consent for location or notifications at any time in your phone's or browser's settings.
4. Who sees your health information
The rule: access is granted, not assumed. A hospital, clinic, doctor or laboratory sees your medical records only where you have granted that provider access, or where they created the record themselves. Granting is per-provider and you can withdraw it at any time from the app.
Beyond that, we share personal information only with:
- Providers you interact with — a clinic you book with receives your name, contact number and the reason for the appointment, so it can honour the booking. An ambulance service receives what it needs to reach you.
- Service providers who work for us — the company that hosts our servers and, once Boogso launches fully, the SMS carriers that deliver verification codes and the payment services you choose to pay with. They act on our instructions and may not use your data for their own purposes.
- WhatsApp — during the preview we send your access details by WhatsApp, and some doctors take remote consultations there. A message sent through WhatsApp is handled by WhatsApp under its own privacy policy.
- Authorities — where we are legally required to disclose, or where disclosure is necessary to prevent serious harm to someone.
- A successor — if Hubaal is acquired or merged, under the same commitments in this policy. We would notify you before your data moved.
We do not sell personal or health information. We do not share it with advertisers, data brokers, or insurers for underwriting. This is not a current-policy statement that might change with a business model; it is a constraint we've placed on what Boogso is allowed to become.
4.1 Kaaliye, the in-app assistant
In this version, Kaaliye shows a sample conversation to explain what it will do. You cannot type to it, and nothing you do on the Kaaliye screen is sent to us or to anyone else.
If we later let Kaaliye answer your own questions, we will update this policy and tell you in the app before that version arrives. That update will say exactly where your words go and who processes them.
Kaaliye does not diagnose and is not a substitute for a clinician — see the terms of use.
5. How we protect it
- All traffic between the app and our servers is encrypted in transit using TLS.
- Access to our servers and the admin panel is limited to the small Boogso team that runs the service, and the admin panel requires two-step sign-in.
- Boogso staff do not browse patient records in the normal course of running the service. We look at your records only when you ask us to, for support.
- Your account is protected by a password, stored only in scrambled (hashed) form, and your phone number is confirmed before your account opens.
- Medical record files are served only through short-lived signed links, never at a public address.
No system is perfectly secure, and anyone who tells you otherwise is selling something. If a breach affects your data we will tell you and the relevant authority, promptly and specifically, including what happened and what we're doing about it.
6. How long we keep it
- Medical records — retained for as long as your account is open, and afterwards only where health record-keeping law requires it.
- Account details — deleted within 30 days of you closing your account.
- Bookings and transactions — kept as long as accounting and tax rules require.
- Location data attached to a request — kept with the request record, not stored as a location history.
- Server logs — kept for up to 12 months.
- Request-access forms — kept until we have answered you, and afterwards as a record that you asked. Deleted if you ask.
6.1 What happens to preview data at full launch
On the night Boogso launches fully, we delete every booking, consultation, payment and wallet entry made with the demo clinics and demo money. We also delete records created by demo clinics and set wallet balances to zero. Your account, your Health ID and anything you uploaded yourself stay as they are. If you would rather we deleted your account at that point, email privacy@boogso.com.
7. Your rights
- Access — get a copy of what we hold about you.
- Correction — fix anything inaccurate. For a clinical record this means we ask the provider that created it to correct it, and we note your objection either way.
- Deletion — close your account and have your data erased, except where law requires us to keep it.
- Portability — export your records in a readable format to take elsewhere.
- Withdraw consent — turn off location, notifications or provider access at any time, without losing the rest of the app.
- Object — tell us to stop a particular use of your data.
Email privacy@boogso.com from your own email address, or message us on WhatsApp from the number on your account. We respond within 30 days and never charge for it. Buttons to export your data and close your account inside the app are planned; until they arrive, we do it for you on request.
8. Children
Boogso is for people aged 18 and over. A parent or guardian may manage care for a child through their own account, and is responsible for the information they enter. We do not knowingly create accounts for under-18s. If you believe a child has registered independently, tell us and we'll remove the account.
9. Where your data lives
Boogso's servers are hosted with commercial providers who may operate data centres outside Somalia. Where data crosses a border we use providers offering contractual protections at least equivalent to those described here. We will name our hosting regions on request.
10. Changes to this policy
We'll update this page when our practices change. For anything material — a new category of data, a new recipient, a change to retention — we'll notify you in the app before it takes effect, not quietly change a date at the top.
11. Contact and complaints
Privacy questions and requests: privacy@boogso.com
Anything else: hello@boogso.com
If we haven't resolved your concern, you can complain to the data protection authority in your jurisdiction. We'd rather you came to us first, but that right is yours regardless.