Privacy notice

Who we are

AutiTunza is run from Nairobi, Kenya. We are the data controller for the information described here, under Kenya’s Data Protection Act, 2019.

• Emailhello@autitunza.com
• Based inNairobi, Kenya

What we collect

Only what the app needs to work for you:

• About you: your email address, used to sign in with a one-time code. A phone number only if you choose to add one, for text-message reminders.
• About your child: a name or nickname you choose (initials are enough), the month and year of birth (never the full date), and the answers you give when setting up the profile: how your child communicates, assessment stage, school, strengths, triggers, sensory notes and your goals. Everything after the name and birth month can be skipped.
• What you record: routines, daily logs, notes, picture-card boards and answers to screening questions.
• Who you invite: the email address of each person you invite to help.
• Payments: if you subscribe through M-Pesa, the phone number used to pay and the transaction reference. We never see your M-Pesa PIN.
• Technical details: an identifier for each phone you use and the times it last synced, so your information reaches the right devices.

What we do not collect

• Your child’s full legal name or full date of birth.
• Your location, your contacts, your photos or anything else on your phone.
• Advertising or tracking data. AutiTunza has no adverts and no advertising trackers.

Why we use it

We use your information only to:

• Build daily routines that are predictable for your child.
• Keep a record of how days go, on your phone and backed up on our servers.
• Show you patterns, always with what they are based on.
• Let the people you invite help, and send reminders and sign-in codes.
• Keep the service secure and working, and handle payments.

We rely on your consent, which you give when you start using the app and again when you add a child. You can withdraw it at any time; see “Your rights” below.

Insight, never a diagnosis

AutiTunza cannot tell you whether your child is autistic. Patterns and screening questions are a starting point for a conversation with a professional. Nothing in AutiTunza makes a decision about your child automatically.

Who can see it

• You, on your own phones.
• People you invite, such as a teacher, therapist or relative. Each invitation is for one child, lasts at most 12 months, and you can remove anyone at any time.
• A clinician you send a report to. A shared report link expires (after 14 days unless you choose otherwise, never more than 90) and you can cancel it at any time. Reports never include your free-text notes.
• Our staff, only when needed to fix a problem you have raised. That access is limited, approved by a second person, time-limited and recorded.

We never sell your information, and we never use it for advertising.

Services that help us

A few companies process information for us, only to provide AutiTunza, and never see your child’s records:

• Resend sends our emails: sign-in codes and invitations. It receives an email address and, for an invitation, the link. Never a child’s name.
• Safaricom (M-Pesa) processes payments if you subscribe.
• Africa’s Talking will send text-message reminders, only to a number you add yourself.
• Google Firebase will deliver notifications to your phone.

How we protect it

• Your information is encrypted when it travels between your phone and our servers. Our servers sit behind a firewall, and the database can only be reached from inside them.
• Every request for a child’s information is checked against the access you have given. Someone without access is told the child does not exist.
• We keep children’s names, notes and screening answers out of our system logs.
• If a breach ever puts your information at risk, we will tell the Office of the Data Protection Commissioner within 72 hours and tell you in plain language what happened and what to do.

How long we keep it

• While your account is open, we keep your information so the app works.
• When you ask us to delete your account, we delete you, your children and everything recorded about them within 30 days.
• We keep a record that consent was given, with your identity removed, because the law requires it. Security records are kept for 7 years under a code that does not name you.
• Counts we use to understand how AutiTunza is used (for example, how many families used it last month) contain no names and never describe fewer than 5 people.

Your rights

Under Kenya’s Data Protection Act, 2019, you can:

• Get a copy of the information we hold about you and your child.
• Correct anything that is wrong. Most of it you can change in the app.
• Ask us to delete your account and your children’s information.
• Withdraw your consent, or object to how we use your information.
• Complain to the Office of the Data Protection Commissioner (odpc.go.ke) if you are not happy with how we handled your request.

To use any of these rights, email us from the address you sign in with. We reply within 7 days and act on your request within 30.

Children

A child never has an AutiTunza account. Information about a child is added by a parent or guardian who consents to it, or by someone that parent or guardian has invited.

Changes to this notice

If we change how we use your information, we will update this notice, change the date above, and ask for your agreement in the app before the change applies to you.