1. Who we are
Pamosi AI ("Pamosi", "we", "us") is the data controller for information processed through the Pamosi mobile application. You can reach us at support@pamosi.ai.
2. Modules inside Pamosi
Pamosi is a single application that adapts to the role you use it in. During the current pilot, only two modules are available to new users:
- Pamosi Health — a personal health passport for patients and their families.
- Pamosi Clinic — a web workspace for clinic teams covering clinical notes, prescriptions, lab orders and results, procedures, admissions, team roles, and audit logs. The Clinic EMR is launching soon.
The sections below also describe other modules (Pamosi Business, Pamosi Finance, Pamosi Logistics — Merchant, and Pamosi Logistics — Rider) that will launch as separate products at a later date. These are documented here for transparency, and remain available only to users who were already using them before the pilot began.
3. What each module collects
Account & device (all modules)
Phone number (for sign-in), a display name if you provide one, your preferred language, and a stable device identifier we generate on your device. We do not read your contacts, your call history, or any advertising identifier.
Pamosi Business
Records you enter or dictate: sales, expenses, debts owed, customer nicknames, product names, and amounts. Receipt photos you take with the camera or pick from your library. Optional short voice notes you record with the microphone; these are transcribed and then discarded unless you choose to keep the audio.
Pamosi Health
Personal and health information you or a clinician enters into your record: name, date of birth, lab results, prescriptions, discharge summaries, vaccination records, medication reminders, and any notes you save. Sensitive categories (reproductive health, maternity, mental health, and personal notes) can be locked behind a private PIN you set on your device.
Pamosi Clinic
Clinic team identity (name, role, professional registration where required, and the clinic you work at). When a patient visits a clinic that uses Pamosi, the clinic records the care they provide: visit notes, diagnoses, prescriptions, lab orders and results, procedures (including any photos taken as part of a procedure), admissions and discharges, and the actions each team member performs. These records are stored under the patient's account and are visible to the patient through Who accessed my record in Pamosi Health. Patients can revoke a clinic's access at any time.
Pamosi Finance
Amounts, categories, and short labels for transactions you enter. We do not connect to your bank account and we do not read SMS transaction alerts.
Pamosi Logistics (Merchant)
Pickup and drop-off addresses, package descriptions, recipient contact details you provide, and — with your permission — your device location to auto-fill a pickup address.
Pamosi Logistics (Rider)
Your device location while a job is active, so we can match you to nearby jobs and share estimated arrival times with the merchant and recipient. Earnings, trip history, and a rating derived from completed jobs.
4. Why we collect it
To provide the module you are using; to keep your data available across your devices; to translate between the languages you enable; to keep audit logs of who accessed what; and to detect abuse of the service. We do not use your data to train third-party AI models beyond the momentary processing needed to answer your own requests.
5. Legal basis
- Contract — to deliver the module you have signed up to use.
- Explicit consent — for special-category health data in Pamosi Health, for microphone/camera/photo access, and for background or precise location in Pamosi Logistics (Rider).
- Legitimate interest — for fraud prevention, security logging, and diagnostics that do not identify you personally.
- Legal obligation — when we are required by law to retain or disclose specific records.
6. Who we share with
Nothing is shared with another user, clinician, merchant, rider, or recipient unless you explicitly grant that permission inside the app. We do not sell personal data. We share limited data with the third-party processors listed in section 7 strictly to run the service, and with law enforcement or regulators only where legally required.
7. Third-party processors
- Twilio — sends the WhatsApp / SMS one-time codes used to sign you in.
- Anthropic — provides the language model that transcribes voice notes, translates between languages, and helps structure records. Anthropic processes prompts only to return an answer and does not train on your data.
- Supabase — stores your records in an encrypted Postgres database and hosts receipt and record images.
- Cloudflare — hosts our API and serves this website; sees inbound requests and IP addresses.
- Mapbox — renders maps and calculates routes in the Logistics modules; sees anonymised location queries.
- Apple and Google — deliver push notifications to your device (message titles are kept generic; sensitive content is never included in push text).
8. Where data is stored
Records are stored in Supabase's managed Postgres. Attachments (photos, PDFs) are stored in Supabase Storage. Our API and this website are served by Cloudflare's global network. We are working with our processors to keep primary copies in the region closest to our users; the current region for each service is available on request.
9. How long we keep it
We keep your records for as long as your account is active and for up to 30 days after you delete the account, at which point personal data is erased from our production database. Backups are retained for a maximum of 30 additional days and then overwritten. Some anonymised, aggregated statistics (for example, "count of active accounts by day") are kept indefinitely and cannot be traced back to you.
10. Security
Data in transit is protected by TLS 1.2 or later. Data at rest is encrypted using industry-standard AES-256. Access to production systems is restricted to named personnel, MFA is required, and access is audit-logged. PIN-locked sections in Pamosi Health use an additional device-level encryption layer so that even a stolen unlocked phone cannot reveal them without the PIN.
11. Your rights & data deletion
Under Nigeria's Data Protection Act and equivalent laws in other jurisdictions we operate in, you have the right to:
- Access a copy of the data we hold about you
- Correct information that is wrong or out of date
- Delete your account and the data associated with it
- Withdraw a consent you previously gave (for example, for microphone or location)
- Object to a specific use of your data
- Complain to the Nigeria Data Protection Commission (NDPC) or the equivalent regulator where you live
How to request deletion. You can delete your account from inside the app under Profile → Delete account. If you cannot access the app, email support@pamosi.ai from the phone number on the account with the subject line "Delete my Pamosi account". We complete verified deletion requests within 30 days.
12. Children
Pamosi is not directed at children under 13 and we do not knowingly collect their personal information. A parent or guardian may add a minor's health record inside their own Pamosi Health account for care coordination; that record belongs to the parent's account and is subject to this notice.
13. Changes to this notice
We will post material changes to this page and, where the change affects how we handle your data, notify you inside the app before the change takes effect. The date at the top of this page reflects the most recent version.
14. Contact
Privacy questions or requests: support@pamosi.ai.