HIAMi Privacy Policy

Effective date: 17 November 2026 · Version 1.0

Summary: the short version

This summary helps you find your way. The full policy below is what legally applies.

If you or someone else is in immediate danger, contact your local emergency services now. HIAMi is not an emergency or crisis service.

Who we are. HIAMi (say it "hear me") is a mental-wellbeing platform run by Hiami ICT LTD. You can reach us about privacy at info@hiamiapp.com.
Website and app. The website, hiamiapp.com, is live now and only collects waitlist sign-ups. The app has not launched yet. Parts of this policy marked App start when the app launches.
What the website collects. Your email address, your tick confirming you are 18 or over and agree, and where you signed up from. Your light or dark theme choice stays in your own browser.
What the app will collect. Your account details, what you say to the AI companion, your sessions with human professionals, community posts, voice notes, files, payments, and some device data.
Sensitive information gets extra care. What you share about your mental health, your faith, your sexuality or your family is specially protected by law. We ask for your clear consent before using it, and you can withdraw that consent.
The AI companion is not a clinician. AI companies process your conversations for us under contract. Your conversations are not used to train AI models unless you choose to opt in.
Confidentiality has limits. We may share information without your consent in three cases only: an imminent risk of serious harm to you or someone else, a child safeguarding concern, or a legal duty.
Anonymous means anonymous to other people, not to HIAMi. Other users and professionals will not see who you are. HIAMi may still hold your account, device and payment data.
If you are 13 to 17. You can use the app, with extra protections. In some countries we need a parent or guardian to agree first. You will never see targeted advertising.
We do not sell your personal data. We do not use it for targeted advertising.
You have rights. You can ask to see, correct, delete or move your data, and you can object to some uses. Email info@hiamiapp.com. We reply within one month.
Your data may leave your country. When it does, we use legal safeguards to protect it.
You can complain. First to us, and at any time to your data-protection regulator.

1. Who we are

Applies to: Website and App

1.1 HIAMi is operated by Hiami ICT LTD, a company incorporated in Nigeria, with its registered address at House 9, Road 205, Efab Global Estate, FCT, Nigeria. In this policy, "HIAMi", "we" and "us" mean that company and the group companies named in 1.2.

1.2 HIAMi is run by a group: a holding company, Hiami ICT LTD, which owns the operating business, Hiami App. The controller of your personal data is Hiami ICT LTD. Where Hiami ICT LTD and Hiami App decide together how your data is used, they act as joint controllers under [JOINT CONTROLLER ARRANGEMENT SUMMARY].

1.3 A "controller" is the organisation that decides why and how your personal data is used. It is responsible to you under the law.

1.4 Contact for all privacy matters: info@hiamiapp.com.

1.5 Data Protection Officer: Rhoda Salifu, info@hiamiapp.com.

1.6 Representative in the European Union (GDPR Article 27): [EU REPRESENTATIVE NAME AND ADDRESS]. Representative in the United Kingdom (UK GDPR Article 27): [UK REPRESENTATIVE NAME AND ADDRESS].

2. What this policy covers

Applies to: Website and App

2.1 This policy explains what personal data we collect, why, who sees it, how long we keep it, and what rights you have.

2.2 It covers two things. Each section says which one it applies to.

Part	Status	What applies
Website (hiamiapp.com)	In effect now	Sections marked "Website"
App (HIAMi mobile app)	In effect from the day the app launches	Sections marked "App"

2.3 Until the app launches, we do not collect any of the data described in sections marked "App" only.

2.4 This policy does not cover other websites or services we link to. They have their own policies.

2.5 We wrote one policy for everyone, to the strictest common standard. Section 24 adds rules for particular regions. If section 24 gives you stronger rights where you live, those stronger rights apply.

3. Words we use

Applies to: Website and App

Personal data: any information about you, or that can be linked to you.
Special-category data: personal data the law protects more strongly. For HIAMi this means information about your health (including mental health), your religious or philosophical beliefs, your sex life or sexual orientation, and anything that reveals these. We also treat sensitive family information the same way. Some laws call this "sensitive personal data" or "consumer health data".
Seeker: a person who uses HIAMi for support.
Professional: a verified human who offers sessions on HIAMi. This is either a licensed clinician or a faith or lay counsellor. Each type has its own verification badge.
AI companion: HIAMi's automated listening companion. It is software, not a person and not a clinician.
Processor: a company that handles personal data for us, on our written instructions.
Explicit consent: a clear, separate "yes" from you for a specific use of your data. You can take it back at any time.

4. The data we collect

4.1 Website

Applies to: Website

4.1.1 Waitlist form. If you join the waitlist, we collect:

your email address;
your tick in the box confirming you are 18 or over and consent to being contacted;
the source of your sign-up (for example, which page or link you came from).

4.1.2 The waitlist is for people aged 18 and over only. The form is handled for us by a third-party form processor, Formspree.

4.1.3 Technical data. The website is a static site. Our hosting provider may process basic technical data, such as your IP address and browser type, to deliver the pages and keep them secure. [CONFIRM WHAT THE HOSTING PROVIDER LOGS AND FOR HOW LONG].

4.1.4 Theme preference. Your light or dark theme choice is saved in your browser's local storage. It is not sent to us. See section 15.

4.1.5 Emails you send us. If you email us, we keep your message and our reply.

4.2 App

Applies to: App

4.2.1 Data you give us

Account data: email address or phone number, password (stored in protected form), display name, date of birth or age, country, language.
Preferences: whether you want a local or international professional, preferred gender of professional, faith orientation (universal, Christian, Muslim, Hindu, atheist, other), and response approach (moral, religious, logic-based). The faith track is strictly opt-in.
AI companion conversations: the text you type and, in voice mode, the audio you speak and the text made from it.
Session content: text messages, voice calls and anything you share with a professional during a live session.
Community content: the groups you join, and what you post, edit, react to or report.
Chat content: voice notes, documents, images, files and stickers you send, and edits you make to messages.
Scheduling and check-ins: your bookings, reminder settings, and what you record in the "Check in" feature.
Payment data: what you bought, when, and for how much. Our payment providers handle your card or bank details. We do not store full card numbers.
Sponsorship data: if you sponsor or pay forward, your name or organisation, contact details and contribution records. If you receive sponsored support, a record that your session was funded.
Parent or guardian data: where the law requires their consent, the contact details and consent record of your parent or guardian.
Support requests: messages you send us and our replies.

4.2.2 Data created when you use the app

Device and technical data: device type, operating system, app version, IP address, device identifiers, language, time zone, crash reports.
Usage data: features used, session times and durations, reminders sent and opened.
Approximate location: your country or region, worked out from your IP address or your settings. We do not collect precise GPS location.
Safety signals: flags created by automated safety tools or by human reviewers when content suggests a risk of harm.
Inferences: things that can be worked out from what you do. For example, joining a grief group suggests a bereavement. We treat these inferences as special-category data.

4.2.3 Data from other people

Professionals: session records, and safety reports where they have a concern.
Other users and moderators: reports about content or behaviour.
Payment and identity-verification providers: confirmation that a payment or a check succeeded or failed.
Sponsors: funding instructions, such as which kind of support they want to fund.

4.2.4 Data about professionals is covered in section 12.

5. Why we use your data, and our legal reasons

Applies to: Website and App, as marked in the table

5.1 The law says we need a valid reason, called a "lawful basis", for each use of your data. We use these, from Article 6(1) of the GDPR and UK GDPR:

Consent (Article 6(1)(a)): you said yes, and you can change your mind.
Contract (Article 6(1)(b)): we need the data to give you the service you asked for.
Legal obligation (Article 6(1)(c)): a law requires us to do it.
Vital interests (Article 6(1)(d)): it is needed to protect someone's life.
Legitimate interests (Article 6(1)(f)): we have a fair reason that does not override your rights. You can object (section 21).

5.2 For special-category data we also need a second reason from Article 9(2). Our main one is your explicit consent (Article 9(2)(a)). The others are named in the table and explained in section 6.

5.3 Retention periods in square brackets are still to be confirmed. Section 20 explains how deletion works.

Data category	Purpose	Lawful basis	Retention period	Recipients
Website: waitlist email address and sign-up source	Tell you when the app launches and send the updates you asked for	Consent, Art. 6(1)(a)	Until you unsubscribe, or 12 months after app launch, whichever comes first	Form processor; email delivery provider
Website: age-and-consent tick, with date and time	Keep the waitlist to adults; prove you consented	Legal obligation, Art. 6(1)(c), read with Art. 7(1); legitimate interests, Art. 6(1)(f)	As long as we hold your email, plus [RETENTION PERIOD FOR CONSENT RECORDS]	Form processor
Website: technical data (IP address, browser type)	Deliver and secure the website	Legitimate interests, Art. 6(1)(f)	[30 DAYS]	Hosting provider
Website and App: emails and support messages	Answer you and keep a record	Legitimate interests, Art. 6(1)(f); contract, Art. 6(1)(b), where it concerns your account	[24 MONTHS] after our last contact	Email and support-tool providers
App: account data	Create and run your account; sign you in; keep it secure	Contract, Art. 6(1)(b)	Life of your account, plus [30 DAYS]	Cloud hosting provider; authentication provider
App: date of birth or age; parent or guardian consent records	Check you are old enough; get and prove guardian consent where the law requires it	Legal obligation, Art. 6(1)(c); legitimate interests, Art. 6(1)(f)	Life of your account, plus [RETENTION PERIOD FOR CONSENT RECORDS]	Age-assurance provider; cloud hosting provider
App: matching preferences (local or international, preferred gender, response approach)	Suggest suitable professionals	Contract, Art. 6(1)(b)	Life of your account, or until you change them	Cloud hosting provider
App: faith orientation and faith-track choices (special category)	Match you by faith if you opt in; run the opt-in faith track	Explicit consent, Art. 6(1)(a) and Art. 9(2)(a)	Until you withdraw consent or delete your account	Cloud hosting provider; the professional you choose
App: AI companion text conversations (special category)	Provide the AI companion and keep the thread of your conversation	Contract, Art. 6(1)(b); explicit consent, Art. 9(2)(a)	Until you delete them, or [RETENTION PERIOD FOR AI CONVERSATIONS] after your last activity	AI model providers; cloud hosting provider
App: AI voice mode audio and transcripts (special category)	Turn your speech into text and the reply into speech	Contract, Art. 6(1)(b); explicit consent, Art. 9(2)(a)	Raw audio: deleted straight after transcription. Transcripts: as for text conversations	Speech-processing providers; AI model providers
App: AI conversations used to improve or train AI models	Improve the AI, only if you opt in	Explicit opt-in consent, Art. 6(1)(a) and Art. 9(2)(a). Off by default	Until you withdraw consent. Data already used in training cannot always be removed from a model	None outside HIAMi
App: safety signals and flagged content (special category)	Spot and respond to a risk of serious harm; protect children	Legitimate interests, Art. 6(1)(f); vital interests, Art. 6(1)(d). For special-category data: explicit consent, Art. 9(2)(a); Art. 9(2)(c) where you cannot consent; Art. 9(2)(g) where local law provides for safeguarding	[RETENTION PERIOD FOR SAFETY RECORDS]	Trained safety staff; emergency or safeguarding services in the cases in section 8
App: live session content with professionals (special category)	Deliver your text and voice sessions	Contract, Art. 6(1)(b); explicit consent, Art. 9(2)(a). For licensed clinicians, Art. 9(2)(h) may also apply	[RETENTION PERIOD FOR SESSION CONTENT], or longer where a clinician's professional rules require it	Your professional; communications provider; cloud hosting provider
App: community group membership and posts (special category)	Run the peer groups you join	Contract, Art. 6(1)(b); explicit consent, Art. 9(2)(a)	Until you delete the post or your account	Group members; moderators; cloud hosting provider
App: moderation records	Keep groups safe; apply the rules; handle appeals	Legitimate interests, Art. 6(1)(f). For special-category data: Art. 9(2)(f), legal claims	[RETENTION PERIOD FOR MODERATION RECORDS] after the action	Moderators; trust and safety staff
App: voice notes, documents, images, files, stickers	Deliver your chats; scan for malware and illegal content	Contract, Art. 6(1)(b); explicit consent, Art. 9(2)(a), where content is special category; legitimate interests, Art. 6(1)(f), and legal obligation, Art. 6(1)(c), for scanning	Until you delete them, plus up to [30 DAYS] in backups	The people you send them to; file storage provider; content-scanning provider
App: scheduling, reminders and check-ins	Book sessions; send the reminders you set; record your check-ins	Contract, Art. 6(1)(b); explicit consent, Art. 9(2)(a), for check-in content	Life of your account	Your professional (bookings only); your device's notification service
App: payment and transaction records	Take payments; manage subscriptions, refunds and commissions; prevent fraud	Contract, Art. 6(1)(b); legal obligation, Art. 6(1)(c), for tax and accounting; legitimate interests, Art. 6(1)(f), for fraud prevention	[PERIOD REQUIRED BY TAX AND ACCOUNTING LAW IN EACH COUNTRY]	Payment providers; banks; tax authorities; auditors
App: sponsorship and pay-it-forward records	Receive funding; apply it to sessions; report to sponsors	Contract, Art. 6(1)(b); legitimate interests, Art. 6(1)(f); legal obligation, Art. 6(1)(c)	[PERIOD REQUIRED BY TAX AND ACCOUNTING LAW IN EACH COUNTRY]	Payment providers; sponsors, in non-identifying form only
App: device, technical and usage data	Run, secure and fix the app; understand use in aggregate	Contract, Art. 6(1)(b); legitimate interests, Art. 6(1)(f); consent, Art. 6(1)(a), for non-essential analytics	[13 MONTHS]; security logs [RETENTION PERIOD FOR SECURITY LOGS]	Cloud hosting, analytics, crash-reporting and security providers
App: marketing messages	Send news and offers, only if you agree	Consent, Art. 6(1)(a)	Until you unsubscribe	Email and messaging providers
App: professionals' identity and credential data (section 12)	Verify identity and qualifications; award badges	Contract, Art. 6(1)(b); legal obligation, Art. 6(1)(c); legitimate interests, Art. 6(1)(f); explicit consent, Art. 9(2)(a), for any biometric check	Time on the platform, plus [RETENTION PERIOD FOR PROFESSIONAL RECORDS]	Identity-verification provider; licensing bodies, to confirm credentials
App: professionals' payout and earnings data	Pay professionals; calculate commission; meet tax duties	Contract, Art. 6(1)(b); legal obligation, Art. 6(1)(c)	[PERIOD REQUIRED BY TAX AND ACCOUNTING LAW IN EACH COUNTRY]	Payment and payout providers; banks; tax authorities
Website and App: records of rights requests, complaints and legal matters	Answer your requests; defend legal claims; meet regulators' demands	Legal obligation, Art. 6(1)(c); legitimate interests, Art. 6(1)(f). For special-category data: Art. 9(2)(f)	[RETENTION PERIOD LINKED TO LIMITATION PERIODS]	Legal advisers; regulators; courts

5.4 Where we rely on consent, you can withdraw it at any time in the app settings or by emailing info@hiamiapp.com. Withdrawing consent does not make our earlier use unlawful. Some features cannot work without the data they depend on. We will tell you which.

5.5 We do not use your data for a new, unrelated purpose without telling you first and, where the law requires, asking for your consent.

6. Special-category data

Applies to: App

6.1 Much of what you share on HIAMi is special-category data. We treat all of the following that way:

anything about your mental or physical health, including what you tell the AI companion, a professional or a community group;
your religious or philosophical beliefs, including your faith orientation and faith-track choices;
information about your sex life or sexual orientation, whether you state it or it can be worked out from what you share;
sensitive family information, such as divorce, family dysfunction or postpartum experience;
the fact that you belong to a particular community group, because membership itself can reveal these things.

6.2 Explicit consent. Before you first use a feature that handles special-category data, we ask for your explicit consent. We ask separately for separate things. Using the AI companion, turning on the faith track, and joining a community group each have their own consent.

6.3 Withdrawing consent. You can withdraw each consent in the app settings or by emailing info@hiamiapp.com. We then stop that use and delete the data, unless we must keep it for a reason in section 8 or section 20.

6.4 Other legal reasons. In limited cases we rely on a different condition in Article 9(2) of the GDPR and UK GDPR:

Article 9(2)(c): to protect someone's life when the person cannot give consent;
Article 9(2)(f): to bring or defend legal claims;
Article 9(2)(g): for reasons of substantial public interest set out in law, such as safeguarding children and people at risk;
Article 9(2)(h): where a licensed clinician, bound by a duty of confidentiality, provides care.

6.5 What we never do with special-category data. We do not sell it. We do not use it for advertising. We do not use it to build marketing profiles. We do not share it with employers, insurers, schools or data brokers.

6.6 The faith track is opt-in. We do not record a faith orientation for you unless you choose one. Choosing "universal" or choosing nothing does not limit your access to support.

7. The AI companion

Applies to: App

7.1 What it is. The AI companion is software that listens and responds. It is not a human. It is not a clinician. It cannot diagnose, treat or prescribe, and it tells you so. Text is free. Voice mode is paid, with one month free.

7.2 What data it processes.

the messages you type;
in voice mode, the audio you speak, the text made from it, and the spoken reply;
earlier messages in your conversation, so the reply makes sense;
your language and the preferences you have set, such as response approach and, if you opted in, faith orientation;
safety signals created by automated checks.

7.3 Who processes it. We use these categories of AI provider, each acting as our processor under a written contract:

large language model providers, which generate the replies;
speech-to-text and text-to-speech providers, for voice mode;
safety classification providers, which help detect signs of risk;
cloud hosting providers, which run and store the service.

7.4 We send these providers only what they need. We do not send them your name, email address or payment details as part of a conversation, unless you type them yourself.

7.5 Training AI models. By default, your conversations are not used to train AI models, by us or by any provider. Our contracts with AI providers forbid them from using your content to train their models. We will only use your conversations to improve or train AI if you give explicit opt-in consent on a separate screen. You can say no and still use the AI companion. You can withdraw later. If you are under 18, we do not use your conversations for training at all.

7.6 Human review for safety. Automated tools check conversations for signs of serious risk, such as risk to life or harm to a child. When they flag something, a trained member of our safety team may read the relevant part of the conversation. Reviewers are bound by confidentiality, see only what they need, and their access is logged. We may also review a small sample of conversations with direct identifiers removed, to check the AI is behaving safely. [CONFIRM QUALITY-SAMPLING PRACTICE].

7.7 Automated decisions. The AI companion generates replies automatically. Our matching feature suggests professionals automatically, using the preferences you set. You make the final choice. We do not make decisions about you that have legal or similarly significant effects by automated means alone. Decisions to suspend or close an account, and decisions to break confidentiality under section 8, always involve a human. You can ask for a human to look again at any decision and to explain it.

7.8 Limits you should know. The AI can be wrong. It can misunderstand you. Do not rely on it for medical, legal or emergency decisions.

7.9 Deleting conversations. You can delete AI conversations in the app. Section 20 explains how long deletion takes.

8. Safety and the limits of confidentiality

Applies to: App

8.1 HIAMi is not an emergency service. We cannot send help to you. Messages are not monitored around the clock by humans. If you or someone else is in immediate danger, contact your local emergency services now.

8.2 What you share is confidential. We, and the professionals on HIAMi, keep what you share private. There are three exceptions.

8.3 When confidentiality may be broken. We, or a professional, may share information about you without your consent only when:

There is an imminent risk of serious harm. We reasonably believe you or another person is at immediate risk of death or serious injury.
A child needs safeguarding. We have reason to believe a child is being abused, neglected or exploited, or is at risk of it. In many countries, professionals and platforms have a legal duty to report this.
The law requires it. A court order, a binding request from a regulator or law-enforcement body, or another legal duty requires disclosure.

8.4 What we share, and with whom. We share only what is needed to deal with the risk. Depending on the case, this may go to emergency services, child-protection authorities, law enforcement, or an emergency contact you have given us. It may include your name, contact details, approximate location and the content that raised the concern.

8.5 Our limits. We can only share what we hold. If you have given us little identifying information, we may not be able to get help to you. Do not rely on us to do so.

8.6 Telling you. Where it is safe and lawful, we will tell you before or soon after we share your information, and explain why.

8.7 Legal requests. We check every legal request. We challenge requests that are unclear, too broad or not legally valid. We do not hand over data voluntarily for immigration enforcement, or to investigate someone's beliefs, sexuality or lawful health choices.

8.8 Legal reasons. For these disclosures we rely on vital interests (Article 6(1)(d)), legal obligation (Article 6(1)(c)) or legitimate interests (Article 6(1)(f)), together with the Article 9(2) conditions in section 6.4.

9. If you are 13 to 17

Applies to: App. The website waitlist is for people aged 18 and over only.

9.1 Minimum age. You must be at least 13 to use the app. The app is not for children under 13. If we learn that someone under 13 has an account, we close it and delete their data.

9.2 Parent or guardian consent. The age at which you can agree to our use of your data on your own is different in different countries. Where the law requires it, we ask a parent or guardian to consent before you use the app, and we take reasonable steps to check they are who they say they are.

In the European Union, that age is set by each country, between 13 and 16 (GDPR Article 8).
In the United Kingdom, it is 13.
In Nigeria, a child is anyone under 18 (NDPA section 31).
For other countries, we apply the local rule.

9.3 What a parent or guardian sees. A parent or guardian who gives consent sees that you have an account. They do not see your conversations, sessions or posts. [CONFIRM GUARDIAN VISIBILITY AND CONTROLS]. A parent or guardian can withdraw consent, and can ask us to delete your account, by emailing info@hiamiapp.com. Section 8 still applies.

9.4 How we check age. We ask for your date of birth when you sign up. We also use [AGE-ASSURANCE METHOD] where the risk calls for it. We use the least intrusive method that works, and we do not keep more age data than we need. If signals in the app suggest someone is younger than they said, we may ask them to confirm their age and may pause the account meanwhile.

9.5 Protections for 13 to 17. If you are under 18:

your privacy settings start at the most private level;
you see no targeted advertising, and we do not profile you for marketing;
your conversations are never used to train AI models;
we do not collect your precise location;
marketing messages are off;
we do not use design tricks that push you to share more data or weaken your privacy settings.

9.6 Restricted features for 13 to 17.

Community groups: [MINORS' ACCESS TO COMMUNITY GROUPS, FOR EXAMPLE AGE-BANDED GROUPS ONLY OR NO ACCESS].
Sessions with professionals: [RULES FOR MINORS' SESSIONS, FOR EXAMPLE ONLY PROFESSIONALS VERIFIED TO WORK WITH UNDER-18s].
Payments, sponsorship and pay-it-forward: [RULES FOR MINORS' PAYMENTS].
Sending and receiving files and images: [RULES FOR MINORS' FILE SHARING].
Private one-to-one messaging with other seekers: [RULES FOR MINORS' DIRECT MESSAGING].

9.7 Your rights are yours. If you are 13 to 17, you can use the rights in section 21 yourself. We explain things to you in language you can follow.

10. Anonymity

Applies to: App

10.1 You can choose to be anonymous to other users and to professionals.

10.2 What anonymity does. When you turn it on:

other users and professionals see a display name or alias you choose, not your real name;
they do not see your email address, phone number or payment details;
your profile shows no photo unless you add one.

10.3 What anonymity does not do. Anonymity is between you and other people on HIAMi. It is not anonymity from HIAMi itself.

We may still hold your account data, such as your email address or phone number.
We still receive device and technical data, such as your IP address.
If you pay, our payment providers handle your payment details, and we hold a record of the transaction.
Your voice can identify you in voice sessions and voice notes.
Anything you say or share that identifies you can be seen by the people you say it to.
If section 8 applies, we may share the data we hold about you.

10.4 Staying more private. Choose an alias that does not identify you. Think before sharing names, places, schools, workplaces or photos.

11. Community groups

Applies to: App

11.1 HIAMi has moderated peer groups for life situations: divorce, addiction, depression, health, grief, postpartum and family dysfunction.

11.2 Joining is a choice, and it reveals something. Joining a group tells its members that the topic matters to you. We ask for your explicit consent before you join your first group.

11.3 What other members can see.

your display name or alias, and your profile picture if you added one;
that you are a member of that group;
what you post, including voice notes, images and files, and your reactions;
that a message was edited.

11.4 What other members cannot see. Your email address, phone number, payment details, your other groups, your AI conversations and your sessions with professionals.

11.5 What moderators can see. Moderators see everything members see in their groups. They also see reports made about posts or members, and the moderation history of a member in that group. Moderators do not see your email address, payment details, AI conversations or sessions. Moderators are HIAMi staff and volunteers. Both are bound by confidentiality.

11.6 Moderation records. When a post is reported or removed, or a member is warned, muted or removed, we keep a record. It holds the content concerned, who reported it, the decision, the reason and the date. We keep it to apply the rules fairly, handle appeals and protect members. We keep it even if you delete the post, for the period in section 5.

11.7 What we cannot control. Other members can copy, screenshot or repeat what you post. Share only what you are comfortable with other members knowing.

11.8 Leaving. You can leave a group or delete your posts at any time. Replies that quote you may keep the quoted words.

12. Professionals

Applies to: App. This section is for professionals who apply to offer, or offer, sessions on HIAMi.

12.1 Data we collect about you.

Identity (KYC) data: full legal name, date of birth, nationality, address, government identity document, and a photo or short video of your face if our verification provider uses a liveness or face-match check.
Credential data: licences, certifications, registration numbers, issuing bodies, expiry dates, and the documents you upload. For faith or lay counsellors: references, training records and other supporting documents we ask for.
Profile data: the name, photo, languages, specialisms, faith orientation, response approach and badge shown to seekers.
Payout data: bank or mobile-money account details, tax identification number, earnings, commission and payout history.
Activity data: availability, bookings, session times, ratings, complaints and their outcomes.
Checks: results of verification with licensing bodies and, where lawful, background checks.

12.2 Why, and our legal reasons. We use this data to verify who you are and what you are qualified to do, to protect seekers, to pay you, and to meet tax and anti-fraud duties. We rely on contract, legal obligation and legitimate interests (section 5). Face-match checks use biometric data, and your stated faith orientation is special-category data. We process both only with your explicit consent.

12.3 What seekers see. Seekers see your profile data and your verification badge: licensed clinician, or faith or lay counsellor. They do not see your identity documents, home address or payout details.

12.4 Who else receives it. Our identity-verification provider, payment and payout providers, the licensing or professional bodies we contact to confirm your credentials, tax authorities, and regulators where the law requires.

12.5 Retention. We keep professional records while you are on the platform and for [RETENTION PERIOD FOR PROFESSIONAL RECORDS] afterwards. If we refuse or remove a professional for safety reasons, we keep a record of that decision for [RETENTION PERIOD FOR REFUSED OR REMOVED PROFESSIONALS] so that the person cannot simply reapply.

12.6 Your responsibilities for seekers' data. Professionals on HIAMi are independent controllers of the seekers' personal data they handle in their sessions. This means you are responsible under data-protection law for your own use of that data. You must keep seekers' information confidential, use it only to provide sessions, keep it inside HIAMi's tools, and follow your professional and legal duties, including the duties in section 8.

12.7 Your rights. You have the rights in section 21.

13. Payments and sponsorship

Applies to: App

13.1 Paying for sessions and voice mode. Payments are taken by third-party payment providers. They receive your card, bank or mobile-money details directly. We do not store full card numbers or security codes. We receive a record of the payment: amount, date, currency, what it was for, a transaction reference, and whether it succeeded.

13.2 Commissions and payouts. We keep a share of session fees as commission and pay the rest to the professional. We keep records of each fee, commission and payout.

13.3 Sponsors and pay-it-forward. NGOs, individuals and other bodies can fund sessions for seekers. From sponsors we collect a name or organisation name, contact details, contribution records and any funding instructions.

13.4 If your session is sponsored. We record that your session was funded and by which fund. Sponsors do not learn who you are. We give sponsors reports in non-identifying form only, such as the number of sessions funded. We never tell a sponsor what you discussed.

13.5 Billing descriptors. Your bank or card statement will show the name of our payment service provider. Think about who else can see your statements.

13.6 Fraud prevention. We and our payment providers check transactions for signs of fraud. A payment may be declined automatically. You can ask us to have a person review it.

13.7 Records we must keep. Tax and accounting laws require us to keep transaction records for set periods, even after you delete your account. These records do not include what you said in conversations or sessions.

14. Voice recordings and file uploads

Applies to: App

14.1 Voice notes. A voice note is a recording you choose to send. We store it so that the people you sent it to can play it. You can delete it.

14.2 AI voice mode. Your speech is sent to a speech-processing provider to be turned into text. The raw audio is deleted straight after it is transcribed. The transcript is treated like a text conversation.

14.3 Live voice sessions with professionals. [STATE WHETHER LIVE VOICE SESSIONS ARE RECORDED. IF NOT: "We do not record live voice sessions." IF SO: WHO CAN START A RECORDING, WHAT CONSENT IS ASKED, AND RETENTION]. Professionals must not record sessions outside HIAMi's tools.

14.4 We do not create voiceprints. We do not use your voice to identify you, and we do not build a biometric profile from it.

14.5 Documents, images and files. We store what you upload so it can be delivered to the people you chose. Files may contain hidden details, such as the place and time a photo was taken. [STATE WHETHER HIAMi REMOVES THIS METADATA ON UPLOAD].

14.6 Scanning. We scan uploads automatically for malware. We also use automated tools to detect illegal content, such as child sexual abuse material. Where the law requires, we report such content to the competent authorities.

14.7 Edited and deleted messages. When you edit a message, others see the new version and a note that it was edited. We may keep the earlier version for [RETENTION PERIOD FOR EDIT HISTORY] for safety and moderation. When you delete a message, it is removed from view straight away and then deleted under section 20.

14.8 Stickers. Stickers you send are stored as part of the conversation.

15. Cookies and local storage

15.1 Website

Applies to: Website

15.1.1 The website stores one item in your browser's local storage: your light or dark theme choice. It stays on your device, is not sent to us, and is not used to track you. You can clear it in your browser settings.

15.1.2 The website does not use advertising cookies or analytics cookies. Our form processor and hosting provider set no cookies on it.

15.1.3 If we add any non-essential cookies or similar technologies, we will ask for your consent first and update this section.

15.2 App

Applies to: App

15.2.1 The app stores data on your device so that it can work: for example, a token that keeps you signed in, your settings, and unsent drafts.

15.2.2 The app does not currently include third-party analytics or tracking software development kits. If we add non-essential analytics, they will run only with your consent, and you will be able to change your choice in the app settings.

15.2.3 We do not use advertising identifiers, and we do not let advertising networks collect data in the app.

16. Who we share your data with

Applies to: Website and App, as marked

16.1 We share personal data only as described in this policy. We do not sell it (section 23).

16.2 Processors. These companies handle data for us under written contracts that meet Article 28 of the GDPR and UK GDPR. They may use the data only on our instructions, must keep it secure and confidential, and must delete or return it when the contract ends.

Processor category	What they do	Applies to
Form processor	Collects waitlist sign-ups	Website
Website hosting provider	Delivers the static website	Website
Email delivery provider	Sends waitlist, service and marketing emails	Website and App
Cloud hosting and database providers	Run and store the app	App
Large language model providers	Generate AI companion replies	App
Speech-processing providers	Speech-to-text and text-to-speech for voice mode	App
Safety classification and content-scanning providers	Detect signs of risk, malware and illegal content	App
Real-time communications providers	Carry live text and voice sessions	App
File storage providers	Store voice notes, documents and images	App
Payment and payout providers	Take payments and pay professionals	App
Identity-verification providers	Verify professionals; support age assurance	App
Notification providers	Deliver reminders and alerts	App
Analytics and crash-reporting providers	Help us fix and improve the app	App
Customer-support tool providers	Manage your requests to us	Website and App
Security providers	Protect against attacks and abuse	Website and App

16.3 You can ask for the current list of our processors and their locations by emailing info@hiamiapp.com.

16.4 Other people on HIAMi. Professionals you choose receive what you share with them. Community members and moderators see what section 11 describes.

16.5 Group companies. Hiami ICT LTD and Hiami App share data with each other to run HIAMi, under this policy.

16.6 Independent recipients. These decide for themselves how they handle the data they receive, under their own legal duties:

payment providers and banks, for their own regulatory duties;
professional advisers, such as lawyers, auditors and insurers, under a duty of confidentiality;
licensing and professional bodies, when we confirm a professional's credentials;
emergency services, safeguarding authorities, law enforcement, regulators and courts, in the cases in section 8;
tax authorities.

16.7 Business changes. If HIAMi is merged, sold or restructured, personal data may pass to the new owner. The new owner must honour this policy. We will tell you before your data is used differently, and you may delete your account first.

17. International transfers

Applies to: Website and App

17.1 HIAMi's pilot market is Nigeria and its users are global. Our group companies and processors are in several countries, including Sweden, where our main app data is hosted with a cloud provider inside the European Union, Nigeria, where our team is based, and [OTHER COUNTRIES WHERE PROCESSORS STORE OR ACCESS DATA]. Your data may be stored in, or accessed from, a country other than your own. Some of those countries have weaker data-protection laws than yours.

17.2 Safeguards. When we transfer personal data across borders, we use a safeguard the law recognises:

From the EEA: an adequacy decision of the European Commission (GDPR Article 45), or the European Commission's Standard Contractual Clauses (GDPR Article 46).
From the United Kingdom: UK adequacy regulations, the UK International Data Transfer Agreement, or the UK Addendum to the Standard Contractual Clauses.
From Nigeria: a basis permitted by sections 41 to 43 of the Nigeria Data Protection Act 2023, such as an adequacy finding, appropriate contractual safeguards, or your consent after we explain the risks.
From other countries: the mechanism local law requires.

17.3 Where needed, we assess the laws of the destination country and add protections, such as encryption and strict access controls.

17.4 In rare, one-off cases we may rely on a legal exception, such as your explicit consent or the need to protect someone's life (GDPR Article 49).

17.5 You can ask for a copy of the safeguards we use by emailing info@hiamiapp.com. We may remove commercially confidential parts.

18. Security

Applies to: Website and App

18.1 We use technical and organisational measures suited to how sensitive this data is. They include:

encryption of data in transit and at rest;
end-to-end encryption of chat messages [CONFIRM EXACTLY WHICH CHATS ARE END-TO-END ENCRYPTED]. AI companion conversations are not end-to-end encrypted, because the AI must process them to reply;
access on a need-to-know basis, with multi-factor authentication for staff and logging of access to sensitive data;
separation of account identifiers from conversation content where practical;
confidentiality duties and privacy training for staff, moderators and reviewers;
security checks on processors before we use them;
regular testing, backups and an incident-response plan;
data-protection impact assessments for high-risk processing (GDPR Article 35).

18.2 No system is perfectly secure. You can help by using a strong, unique password, locking your device, and turning on the app lock if your device is shared.

18.3 If you think your account has been accessed by someone else, email info@hiamiapp.com straight away.

19. Breach notification

Applies to: Website and App

19.1 A personal data breach is a security incident that leads to personal data being lost, destroyed, changed, disclosed or accessed without permission.

19.2 If a breach is likely to put your rights at risk, we notify the relevant regulator within 72 hours of becoming aware of it, where the law requires this (GDPR and UK GDPR Article 33; NDPA section 40).

19.3 If a breach is likely to put you at high risk, we tell you without undue delay. We explain what happened, what data was involved, what we are doing, and what you can do to protect yourself.

19.4 We contact you in the safest way we can, bearing in mind that others may see your messages or notifications.

19.5 We keep a record of every breach and what we did about it.

20. Retention and deletion

Applies to: Website and App

20.1 How long we keep data. We keep personal data only as long as we need it for the purposes in section 5. The table in section 5 gives the period for each category.

20.2 How we decide. We consider why we hold the data, how sensitive it is, the risk of keeping it, whether you have asked us to delete it, and whether a law requires us to keep it.

20.3 Leaving the waitlist. Every waitlist email has an unsubscribe link. You can also email info@hiamiapp.com. We then delete your email address from the waitlist, keeping only a minimal record that you asked us not to contact you.

20.4 Deleting your content. In the app you can delete individual messages, conversations, voice notes, files and posts.

20.5 Deleting your account. You can delete your account in the app settings or by emailing info@hiamiapp.com. We then:

close the account and remove your profile from view straight away;
delete or irreversibly anonymise your personal data from live systems within [30 DAYS];
remove it from backups within a further [BACKUP RETENTION PERIOD].

20.6 What we keep after deletion, and why.

transaction records, for the period tax and accounting laws require;
moderation and safety records, for the periods in section 5, to protect other users;
records of your consents and of rights requests, to show we acted lawfully;
data needed for a legal claim or required by a legal order, until it ends;
what you shared with a professional, where that professional must keep records under their own professional rules.

20.7 Inactive accounts. If you do not use your account for [INACTIVITY PERIOD], we will warn you and then delete it.

20.8 Anonymised data. We may keep information that can no longer be linked to you, such as overall usage statistics.

21. Your rights and how to use them

Applies to: Website and App

21.1 We give these rights to everyone, wherever you live. They come from Articles 15 to 22 of the GDPR and UK GDPR. Local law may add more (section 24).

Your right	What it means
To be informed	To know what we do with your data. This policy is how we tell you
Access	To get a copy of your personal data and details of how we use it
Correction	To have wrong or incomplete data fixed
Deletion	To have your data deleted, unless we must keep it (section 20.6)
Restriction	To ask us to pause our use of your data while a concern is checked
Portability	To receive data you gave us in a common, machine-readable format, or have it sent to another service where technically possible
Objection	To object to uses based on legitimate interests. To object to direct marketing at any time, without giving a reason
Withdraw consent	To take back any consent, at any time
Automated decisions	Not to be subject to a decision made only by automated means that has legal or similarly significant effects, and to ask for human review (section 7.7)
Complain	To complain to us and to a regulator (section 22)

21.2 How to use your rights. Use the controls in the app settings, or email info@hiamiapp.com. You do not need to use legal words or say which law you rely on. Using your rights is free.

21.3 Checking it is you. We need to be sure we give data to the right person. We normally ask you to make the request from, or confirm it through, the email address or phone number on your account. We ask for no more information than we need. If you use HIAMi anonymously, we will not ask you to reveal your name to other users or professionals.

21.4 Someone acting for you. You can ask someone to make a request for you. We will need proof that you authorised them. A parent or guardian may make requests for a child where the law allows, subject to section 9.3.

21.5 How quickly we respond.

We acknowledge your request within 7 working days.
We respond in full within one month of receiving it.
If a request is complex, or you have made several, the law lets us take up to two more months. We will tell you within the first month and explain why.
If we need more information to identify you or understand the request, the time may pause until you reply.

21.6 If we say no. Sometimes the law lets or requires us to refuse all or part of a request. Examples: where it would reveal another person's data, put someone at risk, or interfere with a legal duty. If we refuse, we explain why and tell you how to complain.

21.7 No penalty. We will not treat you worse, charge you more or limit your access to support because you used your rights.

22. Complaints

Applies to: Website and App

22.1 Complain to us first, if you are willing. Email info@hiamiapp.com with the word "Complaint" in the subject line. We acknowledge complaints within 7 working days, investigate without undue delay, and tell you the outcome.

22.2 Complain to a regulator. You can complain to a data-protection regulator at any time. You do not have to complain to us first.

European Economic Area: the data-protection authority of the country where you live, where you work, or where you think the law was broken (GDPR Article 77).
United Kingdom: the Information Commissioner's Office.
Nigeria: the Nigeria Data Protection Commission.
United States: your state Attorney General or, for federal matters, the Federal Trade Commission.
Elsewhere: your national or regional data-protection authority.

22.3 You may also have the right to go to court.

23. We do not sell your personal data

Applies to: Website and App

23.1 We do not sell your personal data. We have not sold it and we will not.

23.2 We do not share your personal data with third parties for their own marketing or advertising.

23.3 We do not use your personal data for targeted advertising, and we do not let advertising networks track you on the website or in the app.

23.4 We do not give or sell your data to data brokers, employers, insurers or schools.

23.5 Sponsors receive non-identifying reports only (section 13.4).

24. Extra terms for where you live

Applies to: Website and App

These terms add to the rest of this policy. If a term here gives you more protection, it applies to you.

24.1 European Economic Area and United Kingdom

24.1.1 Laws. The General Data Protection Regulation (Regulation (EU) 2016/679) applies in the EEA. The UK GDPR and the Data Protection Act 2018 apply in the United Kingdom.

24.1.2 Controller and representatives. See section 1. We have no establishment in the EEA, so no lead supervisory authority applies.

24.1.3 Legal reasons. Section 5 sets out our lawful basis for each purpose. Section 6 sets out our conditions for special-category data.

24.1.4 Children. Where you are below the age of digital consent in your country, we ask for a parent or guardian's consent (GDPR Article 8). In the United Kingdom we design the app to meet the Age Appropriate Design Code.

24.1.5 Cookies and device storage. We ask for consent before storing or reading non-essential information on your device, as the ePrivacy rules and the UK Privacy and Electronic Communications Regulations require.

24.1.6 Transfers. See section 17.

24.1.7 Complaints. In the United Kingdom you have a legal right to complain to us directly about how we use your data. We make this easy, acknowledge your complaint, and tell you the outcome without undue delay. See section 22.

24.2 Nigeria

24.2.1 Laws. The Nigeria Data Protection Act 2023 (NDPA) applies, with the General Application and Implementation Directive 2025 issued by the Nigeria Data Protection Commission (NDPC).

24.2.2 Legal reasons. We process personal data on a lawful basis under NDPA section 25, as set out in section 5 of this policy. We process sensitive personal data, including health data and religious beliefs, under NDPA section 30, relying mainly on your consent.

24.2.3 Children. Under the NDPA, a child is a person under 18. If you are under 18 in Nigeria, we ask for the consent of your parent or guardian and take steps to verify it, unless an exception in NDPA section 31 applies.

24.2.4 Your rights. You have the rights in section 21 of this policy, including the rights in Part VI of the NDPA: to access, correct and delete your data, to withdraw consent, to object, to data portability, and not to be subject to solely automated decisions with significant effects.

24.2.5 Transfers out of Nigeria. We transfer personal data outside Nigeria only on a basis permitted by NDPA sections 41 to 43. See section 17.

24.2.6 Breaches. We notify the NDPC within 72 hours of becoming aware of a breach likely to put your rights at risk, and we tell you promptly if the risk to you is high (NDPA section 40).

24.2.7 Registration and Data Protection Officer. Our registration with the Nigeria Data Protection Commission is in progress. Data Protection Officer: see section 1.5.

24.2.8 Complaints. You can complain to the Nigeria Data Protection Commission.

24.3 United States

24.3.1 No sale, no targeted advertising. We do not sell personal information. We do not share it for cross-context behavioural advertising. We have not done either in the past 12 months. This includes the personal information of anyone under 16.

24.3.2 California (CCPA, as amended by the CPRA). We give California residents these rights whether or not the law strictly requires us to: to know what we collect, use and disclose; to get a copy; to correct; to delete; to limit the use of sensitive personal information; and not to be treated worse for using these rights. We use sensitive personal information only to provide the service you ask for, for safety and security, and as the law allows. You may use an authorised agent. We respond within the time in section 21.5, and never later than 45 days, extendable once by 45 days where the law permits.

24.3.3 Categories of personal information we collect.

Category	Examples	Collected
Identifiers	Email address, phone number, IP address, account ID	Website and App
Customer records	Name, payment records	App
Protected characteristics	Age, gender, religion, where you tell us	App
Commercial information	Purchases, subscriptions, sponsorship	App
Internet or network activity	Usage data, device data	Website and App
Geolocation	Approximate location from IP address. No precise location	Website and App
Audio	Voice notes, voice-mode audio	App
Professional information	Licences and credentials of professionals	App
Inferences	Things that can be worked out from your activity (section 4.2.2)	App
Sensitive personal information	Health information, religious beliefs, information about sex life or sexual orientation, account log-in details, government ID of professionals	App

Sources, purposes, recipients and retention periods for each are in sections 4, 5 and 16.

24.3.4 Children. The app is not directed to children under 13. We do not knowingly collect personal information from children under 13 (Children's Online Privacy Protection Act). If you believe a child under 13 has given us personal information, email info@hiamiapp.com and we will delete it.

24.3.5 Consumer health data (Washington, Nevada and states with similar laws). Laws such as Washington's My Health My Data Act protect "consumer health data". For HIAMi this includes most of what you share in the app.

What we collect and why: see sections 4 and 5.
Sources: you; professionals and moderators; your device.
Who we share it with: the processors in section 16.2, the professionals you choose, and the recipients in section 8 where it applies. A list of specific affiliates is in section 1.2.
Consent: we collect consumer health data only with your consent, or as needed to provide a service you asked for. We ask for separate consent before sharing it for any other reason.
No sale: we do not sell consumer health data.
No geofencing: we do not use location boundaries around health facilities to identify, track or message you.
Your rights: to confirm whether we hold your consumer health data, to access it, to get a list of the third parties and affiliates we shared it with, to withdraw consent, and to have it deleted.
Appeals: if we refuse your request, reply to our decision or email info@hiamiapp.com with "Appeal" in the subject line. If your appeal fails, you can complain to your state Attorney General.

We will publish a separate Consumer Health Data Privacy Policy before the app is offered in these states.

24.3.6 HIPAA. HIPAA is a United States law that applies to certain healthcare providers, health plans and clearinghouses, and to companies that handle health information for them. Whether HIPAA applies to information on HIAMi depends on how each professional is engaged and whether that professional is covered by HIPAA. We are completing this assessment and will update this section before the app is offered in the United States. HIPAA does not apply to your conversations with the AI companion or to community groups. We do not claim that HIAMi as a whole is covered by, or certified under, HIPAA. The protections in this policy apply to you either way.

24.3.7 Breaches. If your information is involved in a security breach, we notify you and the relevant authorities as United States federal and state laws require, including the Federal Trade Commission's Health Breach Notification Rule where it applies.

24.4 Other countries

24.4.1 We give everyone the rights in section 21 and the protections in this policy, wherever they live.

24.4.2 If the data-protection law of your country gives you more rights or stronger protection than this policy, that law applies to you and we will honour it.

24.4.3 If your country's law requires a specific consent, a local representative, registration, or storage of data within the country, we will meet that requirement before offering the app there, or we will not offer it there.

24.4.4 You can always contact your own national data-protection authority.

25. Changes to this policy

Applies to: Website and App

25.1 We may update this policy when the app launches, when we add features, or when the law changes. The version number and effective date at the top show which version you are reading.

25.2 If a change is significant, we tell you at least 30 days before it takes effect, and up to 90 days before for the biggest changes. We do this by email or in the app, and we summarise what is changing in plain language.

25.3 If a change means using your data in a new way that needs your consent, we ask for that consent first. We do not treat your silence, or your continued use of HIAMi, as consent.

25.4 Earlier versions of this policy are available on request from info@hiamiapp.com.

26. Contact us

Applies to: Website and App

26.1 For any question, request or complaint about your personal data:

Email: info@hiamiapp.com
Post: Hiami ICT LTD, House 9, Road 205, Efab Global Estate, FCT, Nigeria

26.2 This inbox is for privacy matters. It is not monitored for emergencies. If you or someone else is in immediate danger, contact your local emergency services now.