Privacy Policy

LishePoa is operated by the African Population and Health Research Center (APHRC), APHRC Campus, Manga Close, off Kirawa Road, Kitisuru, P.O. Box 10787-00100, Nairobi, Kenya.

The mobile app is published as LishePoa (package org.aphrc.lishebora). The public website is lishepoa.aphrc.org. Both are part of the same APHRC nutrition service.

This policy applies to:

• the LishePoa Android app
• the LishePoa public website
• account, scan, and support services behind those products

It does not cover third-party websites or apps that we do not control, including Google, the Play Store, or Open Food Facts, except where we receive data from them to run LishePoa.

Depending on how you use LishePoa, we may collect the following.

Account and identity

• Name
• Email address
• Phone number (if you sign up with phone)
• User ID created for your account
• Google account identifier and profile details if you choose Continue with Google (name, email, and a stable Google user ID)

Nutrition profile

• Age
• Height and weight, and optional target weight
• Dietary preferences and health goals

Scan and product activity

• Barcodes you look up
• Photos of packaged food, barcodes, or nutrition labels
• OCR text and extracted nutrients (for example sugar, fat, saturated fat, sodium/salt)
• KNPM / front-of-pack classification results
• Healthier-swap recommendations and related explanations
• Scan history and timestamps

Technical and device information

• App version and basic device information needed to run the service
• Approximate network/server logs (IP address, time, request path) for security and reliability
• Optional on-device analytics preferences you can turn off in Settings

We do not sell personal information. We do not use your data for third-party advertising, and the app does not use an advertising ID for ads.

We use personal information to:

• create and secure your account
• return barcode, photo, and search results
• classify products using Kenya Nutrient Profile Model (KNPM) guidance
• show healthier-swap recommendations
• keep a useful scan history when you are signed in
• personalize summaries using the profile details you provide
• detect missing or incomplete products so we can improve coverage
• provide support and investigate scan or account issues
• improve product matching, OCR quality, and service reliability
• support APHRC research or reporting with appropriate safeguards, using aggregated or de-identified data where possible
• meet legal, security, and audit obligations

If you photograph a package, barcode, or nutrition label, that image is sent to our servers so we can read the label, extract nutrients, and return a KNPM-aligned result.

Images may be stored so that:

• you can review them in scan history
• authorized APHRC staff can investigate failed OCR, missing barcodes, or product-reference gaps
• we can improve label-reading quality over time

Please photograph packaged food labels only. Do not upload photos of people, identity documents, or unrelated personal material.

You can create an account with email or phone, or sign in with Google. If you use Google Sign-In, Google authenticates you and shares a limited profile (typically name, email, and a unique Google user ID) so we can create or link your LishePoa account.

Google’s handling of your Google Account is governed by Google’s Privacy Policy. You can disconnect Google access from your Google Account permissions at any time; that does not automatically delete your LishePoa account unless you also request deletion below.

We share personal information only as needed to operate LishePoa:

• Service providers that host or process data on our behalf (for example cloud hosting, email delivery, and Google authentication), under contractual or platform safeguards
• Product reference sources such as barcode and nutrition datasets (including Open Food Facts where used) to look up packaged foods
• Authorized APHRC staff for support, data quality, monitoring, and approved reporting
• Legal authorities when required by law or to protect users, APHRC, or the service

We do not sell your personal information to data brokers or advertisers.

We keep account, profile, and scan data for as long as your account is active and as needed to provide the service. After you delete your account, we remove or irreversibly de-identify personal data associated with that account, except where we must retain limited records for security, legal, or audit reasons.

Shared food-reference records (for example a public barcode nutrition entry) are retained because they do not identify you.

We protect LishePoa data using industry-standard controls, including:

• HTTPS encryption in transit
• authenticated access to accounts and admin tools
• role-based permissions for staff
• server-side access controls and operational monitoring

No online service is perfectly secure. Please keep your device and sign-in details safe, and tell us promptly if you believe your account has been misused.

LishePoa is intended for users aged 13 and older. We do not knowingly collect personal information from children under 13. If you believe a child under 13 has created an account, contact us and we will delete that information.

Subject to applicable law, including Kenya’s Data Protection Act, you may request to:

• access the personal information we hold about you
• correct inaccurate information
• delete your account and associated personal data
• object to or restrict certain processing
• withdraw consent where processing is based on consent

You can update many profile details in the app. For other requests, use the contacts below. You may also contact Kenya’s Office of the Data Protection Commissioner if you have an unresolved complaint.

You can request permanent deletion in either of these ways:

• In the app: Profile → Personal details → Account → Delete account and data
• On the web: https://apilishebora.aphrc.org/api/v1/auth/delete-account

Email accounts receive a confirmation link (valid for 24 hours). After confirmation we delete your profile, preferences, scan history, uploaded scan images, and sign-in data. Phone-only accounts are reviewed by our privacy team so we can verify identity before deletion.

For privacy questions, data-rights requests, or concerns about how LishePoa handles information:

• Email: info@aphrc.org or dpo@aphrc.org
• Organisation: African Population and Health Research Center (APHRC)
• Address: APHRC Campus, Manga Close, off Kirawa Road, Kitisuru, P.O. Box 10787-00100, Nairobi, Kenya
• Website: aphrc.org

We may update this policy as LishePoa changes. The “Last updated” date at the top will change when we do. Continued use of the app or website after an update means you accept the revised policy.

Related: Terms and Conditions and Support.