Data Protection

Privacy Policy

Your health records are yours. This explains how we protect them.

Last updated: September 1, 2026

Introduction

Vutomi ('we', 'our', 'the app') helps you keep your own medical records: prescriptions, exams, vaccines, and diagnoses. Because this is health data, we treat it with more care than an ordinary app would, and this policy explains exactly what we collect, why, and what you can do about it.

This policy applies to every Vutomi user, patient or doctor account, free or paid. By using Vutomi, you agree to the practices described here.

Data protection approach

Mozambique's data protection framework is still developing. Rather than waiting for a specific local law to require it, we apply data protection principles inspired by internationally recognized standards such as the EU's GDPR as a voluntary baseline, applying the stricter standard wherever local requirements are less specific.

1 Data We Collect

Account Data

When you create a Vutomi account, we collect:

Email: for login and account recovery
Username: for identifying your account
Password (encrypted): never stored in readable form

Health Records You Add

The core of the app is what you choose to record. This includes:

Medication, exam, vaccine, and diagnosis entries you type in or a doctor proposes
Photos you attach of paper prescriptions, exam results, or vaccine cards
Notes and side-effect logs you add over time
Basic device information (browser type, general error logs) used only to keep the app working, never to profile you

Payment Data (Paid Accounts)

Important: we do not store your card number or M-Pesa PIN. Card payments are processed by Stripe; M-Pesa payments are processed by PaySuite. Both handle your payment details directly, we never see them.

We only store:

A subscription or payment reference ID
Your subscription status (active, canceled, etc.)
Payment history, for your own records

What We Don't Do With Your Health Data:

✗ We never sell your health records, to anyone, for any price
✗ We never share your records with insurers, employers, or advertisers
✗ We don't run advertising trackers or third-party analytics on your health data
✗ We don't use your records to train AI models without your explicit, separate consent

2 How We Use Your Data

We use your data only to:

Run the app

Store your records, sync them across your devices, generate the PDF export you request, keep photos available when you need them

Show you the right screens

Whether you see patient or doctor features, based on the role you chose

Security

Detect abuse, prevent unauthorized access to your account, enforce the photo-upload limits that keep the service sustainable

Notify you

Tell you when a doctor proposes a record for your approval, or when something needs your attention

3 Data Sharing

No Sale Policy

We never sell, rent, or trade your personal or health data to third parties. Full stop.

We share data only with the infrastructure providers that make the app work, and only what each one needs to do its job:

Service Providers

Partners who help us run the platform:

Stripe and PaySuite: process payments, never see your health records
Cloudflare (R2 storage): stores your record photos and generated documents in encrypted, access-controlled storage

Legal Obligations

We may disclose data if legally required to (a valid court order or equivalent legal process), or to protect the safety of you or others in a genuine emergency. We do not proactively share health data with any government body.

4 Data Security

We treat your health data with the caution it deserves:

Encryption in transit

All communication with the app is encrypted (HTTPS/TLS)

Password encryption

Passwords are hashed, never stored as readable text

Private by default

Record photos and exported documents are never publicly accessible. Every link to view one is short-lived and generated only when you ask for it

Doctor confirmation, not automatic trust

A doctor can only add a record to your history after you personally approve it. Nothing enters your record without your say

Important: no system is 100% secure. We follow strong practices, and we recommend using a unique password for your Vutomi account and never sharing your login with anyone.

5 Your Rights

Regardless of what local law formally requires, we give every user these rights:

Right of Access

Request a copy of everything we hold about you, at any time, through the app's export feature or by contacting us

Right of Rectification

Correct any inaccurate self-reported record directly in the app, at any time

Right to Erasure

Delete individual records yourself in the app, or request full account deletion, which permanently removes your data

Right to Portability

Export your full history as a PDF, in a format you can hand to any doctor or keep for yourself, independent of Vutomi

How to Exercise Your Rights

For anything the app doesn't let you do directly, contact us at:

valdompinga57@gmail.com

6 Data Retention

Because the point of Vutomi is a record that survives, we don't auto-delete your data for inactivity. Specifically:

While your account exists

Your records are kept for as long as your account exists, whether you open the app daily or once a year. This is not accidental. It's the point of the product.

If you request deletion

Deleting your account removes your records within 30 days, except where we're legally required to keep certain data longer (for example, payment records for tax purposes)

Where your data physically lives

Record photos and exports are stored on servers located in Western Europe (via our storage provider), even though the service is built for Mozambique. This is disclosed here for transparency, not hidden in technical fine print

7 Changes to This Policy

We may update this Privacy Policy as the app or the legal landscape changes. Material changes will be flagged clearly, not buried.

How We'll Notify You

A notice inside the app for significant changes
An updated 'Last updated' date at the top of this page
For changes affecting how your health data is used, an in-app notice requiring you to acknowledge it before continuing

Contact - Data Protection

Questions, concerns, or want to exercise your rights over your data? Reach us at:

Privacy Email:

valdompinga57@gmail.com

Address:

Av/Rua Albert Lithuli, Bairro Alto Maé, Quarteirão 0, Casa n.º 651, Andar 3, Cidade de Maputo, Mozambique — Vutomi is operated by MPINGA TECH & SERVIÇOS, EI (a Mozambican individual-proprietor business), tax ID (NUIT) 124954835, held by Valdo Voliz Mpinga.

This Privacy Policy is part of our Terms of Service.