Health360 Privacy Notice

Health360 handles wellness information that can be sensitive. This starter notice explains the product's intended privacy design and should be reviewed against your actual processing, vendors and Kenyan legal obligations before production launch.

1. Who operates Health360

Health360 is provided by Online Advisors Insurance Agency Ltd. Contact and business details should be maintained on the main Online Advisors website and in any formal privacy notices required for the service.

2. Information you may provide

Depending on the features you use, Health360 may process account details, wellness profile information, assessment responses, fitness and nutrition activity, self-reported readiness, goals, consent choices, Care360 records, provider requests, membership information and product-usage events.

3. Why information is processed

Health360 uses information to create your private account, deliver requested wellness features, personalise eligible experiences, maintain membership access, support account security, process user-initiated provider or cover-review requests, provide Rewards360, and operate or improve the service.

4. Purpose-specific consent

Wellness processing is separated from optional AI personalisation and provider-referral permissions. You can review relevant consent choices inside Health360. Revoking a consent may disable features that depend on that processing.

5. AI personalisation

If you enable AI-assisted personalisation, Health360 is designed to send minimised context relevant to the requested wellness feature through the configured server-side AI integration. API credentials are not intentionally exposed to the browser.

6. Insurance and wellness-data separation

Health360 wellness scores, assessments, Coach history, Fitness360 history, Nutrition360 history and related wellness information are not designed to flow automatically into insurance underwriting or ordinary insurance-agency workflows. A medical-cover review request is intended to share only the high-level fields shown to the user for that request.

7. Provider requests

When you deliberately request a provider appointment or referral, Health360 is designed to share only the selected request fields and the permissions shown at that time. Your full Health360 profile is not automatically attached.

8. Security and storage

Health360 uses WordPress authentication, server-side access controls, no-store handling for private API responses and application-level encryption for selected sensitive fields where the required server encryption key is configured. No online system can promise absolute security.

9. Product analytics

Health360 may record a limited allowlist of operational events such as app use, onboarding completion or PWA installation. The production analytics design intentionally excludes assessment answers, medical flags, Health360 Scores, Coach text, meal contents and workout details.

10. Retention and deletion

Retention should be limited to what is necessary for the service, legal obligations and legitimate operational needs. Health360 includes member export and privacy-erasure support, but final retention periods should be documented in your production privacy programme.

11. Your choices and rights

You can manage consent choices inside Health360, request a personal data export and use account-security controls. Subject to applicable law, additional access, correction, objection, restriction or deletion rights may apply.

12. Service providers and cross-border processing

Hosting, email, payment, analytics and AI vendors may process information on behalf of the service depending on the production configuration. Vendor contracts, data locations, transfer safeguards and processor obligations should be reviewed before launch.

13. Contact and complaints

Publish an appropriate privacy contact channel for Online Advisors Insurance Agency Ltd and provide any regulator or complaint information required by applicable Kenyan law.