Privacy Policy

This policy applies to parents and caregivers, the children they register for care, therapists, clinical supervisors, and administrators using the Hayven platform (the "Service").

Hayven is operated by Hayven [confirm exact registered company name and RC number] ("Hayven," "we," "us"), registered in Nigeria, of [registered business address to be added]. For everything below, Hayven is the data controller.

Account information, from everyone. Full name, email address, phone number, password (stored securely by our authentication provider, never visible to us in plain text), and your role on the platform.

About your child, from parents. First name, date of birth, presenting concern, and any diagnoses you or your therapist choose to record. You control what goes into your child's profile.

Clinical and session information, from therapists. Session notes, goals, target behaviours, skill tracking, and the reports generated from a session. Some observations recorded during a session are confidential clinical notes, visible only to therapists directly involved in your child's care — never included in the report shared with you.

Professional information, from therapists. Professional bio, qualifications, licensing/credential documents, years of practice, and specialties, used to verify a therapist before they're listed publicly.

Booking, payment, and messages. Session bookings, and messages exchanged between a parent and therapist about a booking. Payments are processed by Paystack — Hayven never receives or stores your full card details (see Section 5).

Technical information. Basic device and access logs kept by our hosting providers for security purposes (for example, sign-in timestamps). We do not run third-party advertising trackers or sell any data to data brokers.

We use your information to:

• Create and secure your account, and verify a therapist's credentials before they can practise on Hayven
• Match families with therapists, and manage bookings, scheduling, and payments
• Let a therapist record session data and generate reports you can review
• Let clinical supervisors oversee the therapists they're responsible for
• Investigate safety concerns, enforce our terms, and keep an audit trail of sensitive actions (e.g. who approved a therapist, who accessed a clinical record)
• Comply with legal, tax, and professional record-keeping obligations

Our legal basis is, depending on the activity: your consent (for example, registering your child and their health information), the necessity of processing to perform our contract with you (bookings, payments), and our legitimate interest in keeping the platform safe (audit logs, fraud prevention). Where we rely on consent, you can withdraw it at any time — see Section 7.

Hayven is not directed at children, and children do not create their own accounts. A child's profile is created and controlled entirely by their registered parent or caregiver, who is the one consenting to its collection. Only the therapist(s) actively assigned to a child, that child's supervising clinician (where applicable), the child's own parent, and Hayven administrators (for safety and support purposes) can ever see a child's clinical information — enforced at the database level, not just in the app's screens.

If you believe a child's information was added to Hayven without appropriate parental consent, contact us immediately at the email in Section 10 and we will investigate and remove it.

We don't sell your data. We share it only as needed to run the Service:

• Other Hayven users, by role. A therapist sees the children assigned to them; a supervisor sees the therapists they oversee; a parent sees their own child's published reports and messages. These boundaries are enforced by database-level access rules, not just by what a screen happens to show.
• Supabase (database, authentication, and file storage) and Netlify (application hosting) — our infrastructure providers, bound by their own security and confidentiality obligations.
• Paystack — to process payments. Paystack receives what's needed to complete your transaction directly; Hayven never sees or stores your full card number.
• Legal or safety exceptions. If required by law, or where we believe in good faith it's necessary to protect a child's safety or the rights of others.

The periods below are our current defaults, applied consistently across the Service:

• Active accounts. Kept for as long as your account is active.
• After you delete your account. Personal account information (name, contact details, non-clinical data) is deleted within 30 days of a verified deletion request.
• Clinical records (session notes, reports, goals, behaviour data) are kept for up to 6 years after a child's last recorded session, in line with standard clinical record-keeping practice — even after an account is deleted — to support continuity of care and meet professional record-keeping obligations.
• Payment and transaction records are kept for 6 years, in line with standard financial record-keeping practice.
• Security and audit logs are kept for 24 months, then deleted.

Under the Nigeria Data Protection Act (NDPA), you can ask us to:

• Confirm what personal data we hold about you or your child, and get a copy of it
• Correct information that's inaccurate or out of date
• Delete your account and associated personal data, subject to the retention periods in Section 6
• Withdraw a consent you previously gave us
• Object to, or ask us to restrict, a particular use of your data

To exercise any of these, email us at the address in Section 10. We'll respond within the timeframe required by the NDPA. If you're not satisfied with our response, you have the right to lodge a complaint with the Nigeria Data Protection Commission (NDPC).

Access to clinical and personal data is restricted by role at the database level, so a therapist can only ever query the children actually assigned to them, not the wider platform. Passwords are hashed by our authentication provider, never stored by Hayven in readable form. Data is encrypted in transit between your device and our servers. Sensitive administrative actions (verification decisions, record access, payment corrections) are recorded in an internal audit trail.

No system is perfectly secure, and we can't guarantee absolute security of any transmission.

Hayven uses only the cookies and on-device storage needed to keep you signed in and let the app work offline as an installed PWA. We don't use third-party advertising or cross-site tracking cookies.

Questions, concerns, or a request about your data: hayvenmind@gmail.com.

If we make a material change to this policy, we'll update the effective date above and, for significant changes, let you know directly (by email or in-app) before they take effect.