Privacy Policy

1. Who this covers

Businesses use Ariium to answer their own customers (for example, an HMO answering its members). This policy explains what happens to personal data in Ariium: your data if you're a customer messaging one of those businesses, and your data if you work for a business that uses Ariium.

2. Who is responsible

For customers' messages, the business you're messaging decides how your data is used (it is the "data controller"); Aeros Marketing Solutions runs Ariium on its behalf (the "data processor"). For people who sign up for or use Ariium at work, Aeros is the controller. Contact: privacy@ariiumbyaeros.com.

3. What we collect from customers

Your name and contact details as the channel provides them (phone number, email address, or a social media account ID), the messages and attachments you send and the replies you receive, delivery and read status, and the details a business needs to check who you are before it shares private information, such as a member or policy number. For health insurers this can include health-related information you choose to share, such as a benefit, hospital or claim you ask about.

4. What we collect from businesses and their staff

Name, work email, phone number, company details, billing details (handled by the payments provider; we never see full card numbers), and a record of actions taken in the product (sign-ins, approvals, settings changes) for security and audit.

5. Why we use it

To deliver the service the business has switched on: receiving and routing messages, writing and sending replies, checking identity before private information is shared, handing conversations to the business's team, measuring response times and resolution for the business's own reports, keeping the service secure, and billing. We don't sell personal data, use it for advertising, or use it to train AI models.

6. How the AI uses your messages

To answer you, the AI reads your conversation and the business's approved knowledge. Health-related details are only used to answer your question and are only shown back to you after the business's identity check. The AI doesn't make decisions about cover or claims on its own; those stay with the business's team.

7. Who can see it

People at the business you're messaging, according to their role. Ariium staff only when needed to support the service or meet a legal obligation, and that access is logged. Our sub-processors, only to run the service: Supabase (database, sign-in and file storage); our website hosting provider (currently Vercel); our email provider (currently Mailgun) for sending and receiving email; Anthropic, which writes the AI replies; Voyage AI, which turns text into search data so the AI can find the right approved answer; and, only when a business connects them, Meta (WhatsApp, Messenger, Instagram), Telegram and an SMS provider. Payments for business plans go through a payments provider; customers' payment details never pass through Ariium. Data from one business is never visible to another.

8. How long we keep it

While the business's workspace is active, conversations are kept so the business can see your history and keep records it may be required to keep. When a business cancels, its data is deleted 30 days later. A single person's data can be deleted earlier on request (see Data Deletion). Backups held by our database provider expire on that provider's own schedule.

9. How it's protected

Data is encrypted in transit and at rest by our providers. Each business's data is kept apart in the database itself and that separation is tested. Access is role-based and checked on the server, and sensitive actions are recorded in an audit log.

10. International transfers

Some of our providers process data outside Nigeria. We use providers that commit to protecting personal data, and we rely on the safeguards the Nigeria Data Protection Act 2023 allows for such transfers.

11. Your rights

Under the Nigeria Data Protection Act 2023 you can ask to see, correct or delete your personal data, object to how it's used, or withdraw consent. For messages you sent to a business, you can ask that business or use our data deletion page; we'll help the business respond. You can also complain to the Nigeria Data Protection Commission.

12. Children

Ariium is a tool for businesses and isn't directed at children. A business that serves minors (for example family health plans) is responsible for having a lawful basis to message them.

13. Changes and contact

We'll update this page when how we use data changes and change the date at the top. Questions or requests: privacy@ariiumbyaeros.com, or Aeros Marketing Solutions, Lagos, Nigeria.