Nududu privacy policy

Effective date: [Effective date]

In short

Nududu keeps your health information on your phone by default. You create an account to use Nududu (an email address or phone number, a password, and the country you live in), but your account holds no health information. We do not use ads or tracking tools.

Some features you can choose to switch on send selected information off your phone. Each is off until you turn it on, and each asks you first:

Online backup: everything, locked with your recovery code. Who can read it: only you.
Sharing with your family: a short summary (blood pressure, medicines, salt, added sugar, activity, drinks), locked with your family code. Who can read it: only people you give the code to.
Pocket Dietitian: your profile, recent food logs, readings, medicines and messages to your dietitian. Who can read it: your registered dietitian and the Nududu team. An AI writes drafts for your dietitian.
Ama, the AI nutritionist: your messages, and today's numbers only if you tick the box. Who can read it: Nududu's AI writes the answers; the messages are not stored.
Photo meal logging: the photo. Who can read it: Nududu's AI looks at the photo once; it is not stored.
Restaurant finder: the town you type, or your rough location. Who can read it: sent to OpenStreetMap; not stored with anything about you.
Sharing with a clinic: a 30-day summary of readings and medicines. Who can read it: the clinic you choose.
Account and payments (only for paid plans): your email and plan status; card details go to Stripe. Who can read it: Nududu and Stripe.
Anonymous usage counts: which parts of the app were used; no health numbers. Who can read it: Nududu, as totals only.

The sections below explain each one.

About private codes. Online backup, family sharing and pharmacy readings each use a long, random private code made on your phone. A code works like a house key: whoever has it can open what it locks, and nobody without it can, including us. So keep your backup code to yourself, send each family code only to the person it's for, and show your pharmacy code only to your health worker. If a family code goes to the wrong person or a phone is lost, make a new code for that person in Family: the old one stops working straight away.

Who we are

Nududu is made by [Company legal name], [Registered address] ("we", "us").

You can contact us about privacy at:

Email: [Contact email]
WhatsApp: [WhatsApp support number]

This policy explains what information Nududu uses, where it is kept, and the choices you have. It covers the Nududu website app and the Nududu Android app.

What information Nududu uses

You choose what to enter. Most things are optional. The app can hold:

Your profile: name (optional), sex, age, height, activity level, preferred language, your health goal, and the conditions you choose to tell the app about (such as high blood pressure, diabetes, kidney disease, pregnancy and due date, sickle cell disease, stroke, heart failure, high cholesterol, HIV, gout or anaemia), or that you take no regular medicines.
Your readings: blood pressure (morning or evening), blood sugar (and whether it was fasting), weight, and lab results you copy in (kidney tests, HbA1c, cholesterol, liver tests, haemoglobin), and your answers to "Do you know your numbers?". The app works out your BMI from these.
A pain diary, if you keep one: how bad the pain was, where, and what came before it.
Clinic visits you add, so the app can remind you.
Your meals: the foods you ate, the meal, the number of servings, and how many glasses of water you drank.
Your cooking salt: what went into the family pot (for example stock cubes, salt, seasoning powder, smoked fish) and how many people shared it.
Your medicines: the name, the dose, the times of day you take them, and which doses you ticked as taken.
Your reminder settings (Android app only): whether you want blood pressure and medicine reminders, and at what times.

Some of this is health information. The law in many countries treats health information as sensitive and gives it extra protection. We designed Nududu so that this information stays with you.

Where your information is kept

Everything you enter is saved on your device. Unless you switch on one of the optional features listed in "In short", it is saved only there. In the website app it is saved in your browser's storage on that phone or computer. In the Android app it is saved in the app's storage on your phone.
Your Nududu account holds only your email address or phone number, a scrambled form of your password, the country you live in, when you registered, and your plans. No health information.
Unless you switch on an optional feature, Nududu does not send your information to us or to anyone else.
We do not have a copy of anything you keep only on your phone. This means we cannot see it, and we cannot get it back for you if it is lost.
Your phone's own backup. Android phones can back up app data to the phone owner's Google account, if the owner has turned on phone backup in the phone settings. This backup may include Nududu's information. It is controlled by you and Google, not by us, and we cannot see it. You can turn phone backup on or off in your phone settings.

What we do not do

We do not sell your information.
We do not show ads.
We do not use analytics or tracking tools inside the app.
We do not use your information for marketing.
We do not ask for your contacts or microphone. The Android app asks to use the camera only when you take a meal photo, your rough location only when you tap "Use my location" in the restaurant finder, and to show notifications only if you turn on reminders.

Reminders

The Android app can remind you to check your blood pressure and to take your medicines. Reminders are off until you turn them on. The phone creates them itself; they are not sent from the internet.

Reminders do not name your medicines. A medicine reminder only says it is time for your medicines.
Depending on your phone settings, reminders can appear on the lock screen, where other people may see them.
You can turn reminders off in Nududu, or hide notification details on the lock screen in your phone settings.

When your information leaves your phone

Your information only leaves your phone when you choose to send it: through the optional features listed in "In short", or in the ways below.

Backup file. When you tap "Save backup", the app makes a file (named like nududu-backup-2026-01-31.json) on your device. This file holds all your Nududu information. It is not locked with a password. Anyone who has the file can read it. Keep it somewhere safe. If you send it to yourself by WhatsApp, email or cloud storage, those services will hold a copy under their own rules.
Restore backup. When you tap "Restore backup", the app reads a backup file you pick and replaces what is in the app. The file is read on your phone. It is not sent to us.
Clinic report. You can print the report, save it as a PDF, or share it. If you tap "Share on WhatsApp", the app passes a text summary to WhatsApp or another app you pick on your phone. The summary can include your name, age, sex, conditions, medicines, blood pressure, medicine-taking, salt, weight and blood sugar. You decide who receives it. After you share it, the app you used (for example WhatsApp, run by Meta) and the person you send it to will have a copy. Their own privacy rules apply, not ours.

Technical information when you download the app

Website app. Like any website, when your phone loads or updates the Nududu website, our hosting provider (Cloudflare) handles the connection. It can see technical details such as your internet (IP) address, the type of browser, and the pages requested, and it may keep short technical logs for security and to keep the service running. These requests do not include the health information you enter in the app. After the first visit, the app can work offline.
Android app. The Android app has all its pages built in, so it does not need to load them from the internet.
If you install Nududu from Google Play, Google handles the download and may collect information about it under Google's own privacy policy. We may see total numbers of installs and crash reports that Google gives to app developers. These do not include the health information you enter in the app.

Keeping your information safe

Your information is as safe as your phone. Use a screen lock (PIN, pattern or fingerprint).
If other people use your phone, they may be able to open Nududu and see your information.
Keep backup files and shared reports private.
If your phone is lost, stolen or reset, your Nududu information may be lost too, unless you saved a backup.

How long information is kept, and how to delete it

Your information stays on your device until you delete it.

To delete one item, remove it in the app where it is shown.
To delete everything at once, go to Profile → Your data → Delete all my data. This also turns off reminders.
To delete everything in the Android app, uninstall the app, or clear the app's storage in your phone settings.
To delete everything in the website app, clear the site data for Nududu in your browser settings.
Delete any backup files you saved, and any reports you shared, separately. We cannot delete these for you because we do not have them.
What you chose to keep online is also deleted automatically once it's no longer used: an online backup or family summary not updated for 2 years; family messages never collected after 30 days; Pocket Dietitian membership with no update from the app for a year; sharing with a clinic with no update for 6 months; pharmacy readings never collected after 30 days; contact details on a closed problem report after 90 days; our security log after 2 years. Your account stays until you delete it.
To delete your account and anything you chose to keep online (backup, family sharing, Pocket Dietitian, clinic sharing), see Delete your account and data. You can ask us to do it even without the app.

Your rights

Data protection laws in Ghana, Nigeria, Kenya, South Africa and other countries give you rights over your personal information. These include the right to know what is held about you, to correct it, to delete it, to get a copy, to object, and to withdraw consent.

Most of your Nududu information is kept only on your device, so you can see, change, copy and delete it yourself at any time in the app and in your phone settings. If you use an optional online feature (an account, online backup, family sharing, Pocket Dietitian or sharing with a clinic), we hold that information, and you can ask us to show you, correct, copy or delete it. See Delete your account and data for how to delete it.

If you have a question or complaint, contact us first at [Contact email] or [WhatsApp support number]. You can also complain to the data protection authority in your country, for example:

Ghana: Data Protection Commission
Nigeria: Nigeria Data Protection Commission (NDPC)
Kenya: Office of the Data Protection Commissioner (ODPC)
South Africa: Information Regulator

Extra privacy for HIV

If you tell the app you have HIV, it stays on your phone. It is never shown on the Today screen, never sent to Ama, and never shared with family or clinics. It is left out of your doctor's report unless you tick to include it, and out of Pocket Dietitian unless you choose "Include HIV" in your profile. You can mark any medicine as private, so it is left out of reports and sharing too. Medicine reminders never name your medicines.

Children

Nududu is made for adults aged 18 and over. A young person under 18 should only use Nududu with the help and permission of a parent or guardian. We do not knowingly collect information from children. Because the app does not send information to us, we do not receive any information about children.

Information from you is not checked by us

Nududu calculates totals, averages and targets from what you enter. We do not see or check what you enter. If a reading is typed wrongly, the results will be wrong too.

Optional online backup and sharing with a clinic

These two features are switched off unless you turn them on in Profile. If you never turn them on, everything above applies and nothing is sent to us.

Online backup

When you turn it on, the app makes a recovery code on your phone. Your information is locked (encrypted) on your phone with that code before it is sent.
We store only the locked copy and the date it was saved. We do not receive your recovery code, so we cannot open your backup, and nobody can restore it without the code.
If you lose the code, we cannot get your backup back for you.
You can turn backup off at any time with "Turn off and delete online copy". This deletes the online copy straight away. The information on your phone stays.

Sharing with a clinic

You can choose to share with a clinic by typing the clinic code it gives you and the name the clinic knows you by. The app asks for your permission first.
What the clinic sees, for the last 30 days: your blood pressure readings and averages, your medicines (except any you marked private) and how often you ticked them as taken, your average salt, your latest weight and BMI, your fasting blood sugar average, and your age, sex and known conditions (high blood pressure, diabetes, and pregnancy if you told the app). For pilot studies, it also sees the average of your first week of blood pressure readings and of salt, and in how many weeks you used the app, so changes over time can be measured. The clinic does not see your meals, cooking details or any other information.
The app sends an updated summary when your readings change and you have internet.
You can stop at any time with "Stop sharing". This deletes your summary from our server straight away, and the clinic can no longer see it. It does not remove anything the clinic already copied into its own records.
Clinics log in with a code and password. Each clinic only sees the people who chose to share with it.

Where this is stored and who runs it

The online parts run on Cloudflare (Cloudflare Pages and Cloudflare D1 database). Data may be stored outside your country. [Confirm data location and any transfer safeguards required in each launch country.]
Information is encrypted when it travels over the internet. Backups are also locked with your recovery code, as described above.
We do not sell this information, use it for ads, or share it with anyone else, except where the law forces us to.

Your rights for online data

You can delete your online backup and stop sharing yourself, at any time, in the app.
You can also ask us to delete online data, or ask what we hold, by contacting [Contact email]. We will answer within the time the law in your country requires.
If a security problem affects online data, we will tell you and the data protection authorities as the law requires.
[Before switching these features on for the public: register with, or notify, the data protection authorities where the law requires it, and name a person responsible for data protection.]

Anonymous usage counts (optional)

If you choose "Help improve Nududu", once a day the app sends a short anonymous report so we can see how many people use Nududu and which parts help them. It contains only: the date, the week you started using Nududu, the app language, the app version for your country, and which parts of the app were used on recent days (for example "logged a pot" or "opened a recipe").

It does not contain your name, any health numbers, what you ate, or any code that identifies you or your phone. We only keep running totals (for example, "40 people logged a pot on 7 October"), not individual reports. You can turn this off at any time in Profile.

Photo meal logging (optional)

You can log a meal by taking a photo. Before the first photo the app explains what happens and asks you to agree.

What is sent: the photo, made smaller on your phone first, and a random code made by the app for the daily limit.
Who receives it: the photo passes through Nududu's server, and an AI suggests the foods it can see. The photo is not kept and is not used to train the AI. [lawyer: confirm processor terms]
What we keep: nothing. The photo is not stored by Nududu, on its server or on your phone. Only the foods you confirm are saved, on your phone.
Please photograph the food only, not people.

Pocket Dietitian (optional)

If you join Pocket Dietitian, you agree to share health information with a registered dietitian. This is the one feature that stores your health information on Nududu's server in a form people can read.

What is shared: the first name you give, where you live (country, and state or province in the US and Canada), your age, sex, height, goal and conditions (HIV only if you choose to include it), your food logs from the last 14 days (dishes and amounts), blood pressure, blood sugar and weight readings, lab results you entered, your pain diary for the last 30 days if you keep one, medicines (except any you marked private) and how often you took them, herbal products, walking and alcohol, and the messages you send your dietitian. Not your Ama chats, notes or family sharing.
Who can see it: your dietitian (a registered dietitian licensed where you live, checked by the Nududu team on the official register) and the Nududu team. An AI reads it, and your messages, to write drafts and suggested replies for your dietitian. You only ever see what your dietitian approves or sends. If a message mentions danger signs (such as chest pain or a very high reading), the app shows urgent-care advice straight away and flags it for your dietitian; messages are not an emergency service. [lawyer: confirm processor terms; data processing agreements with dietitians]
How it's kept: on Cloudflare's servers, encrypted in storage and protected by logins. Every time a dietitian opens your record or approves something, it's recorded.
Leaving: "Leave Pocket Dietitian" deletes your shared data, plans, reviews and messages from the server.

Sharing with your family (optional)

You can share a short summary with family members, for example a son or daughter abroad. You choose what it includes: your blood pressure readings and 7-day average, alerts for a very high reading, the share of medicine doses ticked off, your average salt and added sugar on days you logged food, how many days you were active and minutes walked, and alcohol if you log it. It always includes the name you choose (such as "Mum"). It never includes your meals, notes, Ama chats or anything else.

Each person you share with gets their own private code. The summary is encrypted on your phone with that code before it is sent, so Nududu's server stores it but cannot read it. Only the person with the code can read it. Removing a person deletes their copy straight away and their code stops working; stopping sharing deletes every copy.

So that you can see whether your family has seen your latest update, the server records the time each copy was last opened. It records nothing else about who opened it.

Family members can send you a few kind words or ask you to check in. These notes are encrypted on their phone with the same code, so the server cannot read them, and they are deleted from the server once your phone has collected them. When you tap "I'm OK", the time you did so is added to your summary.

If you follow someone, their summary is kept on your phone.

Finding restaurants (optional)

When you search for restaurants, the town you type, or your rough location (rounded to about 100 metres, only if you tap "Use my location"), is sent through Nududu's server to OpenStreetMap's free map services to find restaurants nearby. Nothing else about you is sent, and we don't keep a record of your searches. Search results may be kept for a day so the same area loads faster for everyone.

Ama, the AI nutritionist (optional)

Ama answers questions about food and cooking. She only works if you choose to use her and agree first.

What is sent: the messages you type to Ama, and, only if you tick the box, your goal, any conditions you entered, your age and sex, and today's numbers in the app (salt, sugar, fat, starch, your latest blood pressure, alcohol). Never your name.
Who receives it: the messages pass through Nududu's server to an AI that writes Ama's answers. The messages are not used to train that AI. [lawyer: confirm processor terms and data retention]
What we keep: Nududu does not store your conversation on its server. To stop overuse and to give each person their daily number of questions, the server counts messages for one day, by your account (or, if you are not signed in, by a random code made by the app). Your conversation stays on your phone until you clear it.
Stopping: stop using Ama at any time, and clear the chat in the app.

Your account and payments

Everyone who uses Nududu creates an account. It holds your email address or phone number, a scrambled (hashed) form of your password, the country you live in, the date you registered, and the state of your plans. It holds no health information. We use your country to decide what is free for you (more is free for people living in Africa) and your registration date for the free trial outside Africa. We use your email address or phone number only to sign you in and, for email, to reset your password.

When you ask Ama a question or log a meal from a photo while signed in, the server checks your account to see how many you may use; the question or photo itself is not stored.

Payments are handled by Stripe. We don't see or store your card details. Stripe receives your email and payment details and keeps payment records as the law requires; its own privacy policy applies. We receive from Stripe whether each plan is active and when it renews.

If you are signed in and have joined Pocket Dietitian, your membership is linked to your account so we know it's paid for. Deleting your account cancels your plans and deletes the account; it doesn't delete what's on your phone, your family sharing, your backup or what you shared with a dietitian (use "Leave Pocket Dietitian" for that).

Reporting a problem (optional)

If you tap "Something wrong?" and send a report, we receive what you typed, which part of the app it's about, and the email or WhatsApp number you chose to give for a reply. We use it only to check and fix the problem, and we keep a record of what we found and did.

Content updates

Every few hours, when you have internet, the app asks Nududu's server whether any food or recipe has been taken down while a problem is fixed, so it can hide it. Nothing about you is sent.

Changes to this policy

We may update this policy. We will change the effective date at the top, and show a notice in the app if the change is important. We will not start sending your information off your phone without asking you first.

Contact

[Company legal name], [Registered address]

Email: [Contact email]
WhatsApp: [WhatsApp support number]