hello@avahealthcareltd.com +234 803 467 8355

Ava CRM

Ava CRM privacy policy

Last updated: 9 October 2026

Ava CRM is a customer relationship management app for pharmaceutical and life-sciences field sales teams, made by Ava Healthcare Limited ("we", "us"). It runs on Android and the web (including iPhone and iPad through the browser) at avahealthcareltd.com/AvaCRM. This policy explains what data Ava CRM collects, why, where it is stored, who it is shared with and how it is deleted. It applies alongside our general privacy policy and is written in line with the Nigeria Data Protection Act 2023.

Who controls the data

Each company that uses Ava CRM (the "customer") decides what its staff record in the app and owns that data. The customer is the data controller for its CRM records. We provide the software and a small connection service, and act as the customer's processor for that data. For the account and licence details we keep ourselves (listed below), we are the controller.

Where the CRM data is stored

Ava CRM does not keep a central database of customers' CRM records. When a company sets up Ava CRM, its administrator links their own Google Drive or Microsoft OneDrive, and Ava CRM creates an "Ava CRM" folder there. All of the company's working data is saved as files in that folder:

  • the company profile, logo and settings (tiers, products, cycle length, saved report definitions);
  • the list of users and their roles, reporting lines, staff IDs and territory IDs, and optional profile photos;
  • sign-in passwords, stored only as salted hashes, never in readable form;
  • accounts (doctors, pharmacies, hospitals and other customers of the company) with their contact details, tier and location;
  • calls and visits: date, time, products and key messages discussed, notes, follow-ups, and the GPS location of the check-in when the user allows it;
  • cycle plans, approvals, and CSV exports the company creates.

Each phone, tablet or browser also keeps a copy of the data its user is allowed to see, so the app works offline. That copy is held in the app's private storage on the device and is removed when the user signs out or uninstalls the app.

How Ava CRM uses Google Drive

If the administrator chooses Google Drive, Ava CRM asks Google for these permissions only:

  • See, edit, create and delete only the specific Google Drive files you use with this app (https://www.googleapis.com/auth/drive.file). Ava CRM can read and write only the folder and files it creates itself. It cannot see or change any other file in your Google Drive.
  • Your email address and basic sign-in identity (openid, email), used only to confirm which Google account was linked and to show it to the administrator.

We use this access only to create the company's Ava CRM folder and to read and save the company's Ava CRM files on behalf of its signed-in users. We do not use Google user data for advertising, we do not sell it, we do not use it to train artificial-intelligence models, and no person at Ava Healthcare reads it unless the customer asks us to for support, or the law requires it.

Ava CRM's use and transfer to any other app of information received from Google APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements.

Microsoft OneDrive works the same way: Ava CRM asks for permission to read and write files (Files.ReadWrite), to read the basic profile of the signed-in account (User.Read) and to stay connected (offline_access), and uses them only for the company's Ava CRM folder.

What our connection service keeps

Our server at avahealthcareltd.com passes each user's reads and writes to the company's folder. It does not keep copies of the CRM files. It stores only what it needs to keep the link working and to run licences:

  • the company's name, contact details, administrator's name and email, company code, folder location and licence dates;
  • the Google or Microsoft access and refresh tokens for the company's folder, encrypted with a key held only by the server;
  • daily counts of AI requests per company, and short-lived, anonymised (hashed) IP address counters used to stop abuse;
  • temporary records of a company setup in progress, which expire after setup.

Signed-in users receive a signed session token that is stored on their own device.

Microphone, speech and AI features

  • Voice input: when a user taps the microphone, the app uses the device's or browser's built-in speech recognition to turn speech into text. Ava CRM does not record or store audio. Depending on the device, the speech service provided by Google, Apple or the browser maker may process the audio under its own privacy terms.
  • Ava AI (including "Ask Ava"): when a user asks for help (for example to tidy a call note, plan visits, suggest a cycle plan, brief them on an account or answer a question), the app sends the request and only the CRM details needed for that task, from data the user is already allowed to see, through our server to Anthropic (the provider of the Claude AI model) to produce the answer. Anthropic processes this data as our service provider and does not use it to train its models. Our server does not log the text of requests or answers. Administrators can turn the AI features off for their company. The app asks each user for permission before it first sends anything to AI, and the user can withdraw it at any time in My profile.
  • AI suggestions are never saved automatically: a user must review and accept them first.

Location and camera

The app asks for location permission so a user can record where a visit took place (check-in). It reads the location only when the user logs or checks in to a call, not in the background. The camera or photo library is used only when a user chooses to add a profile photo or company logo.

Who we share data with

  • Google or Microsoft, to store the company's files in the drive the administrator chose.
  • Netlify, which hosts our website and connection service.
  • Anthropic, only for AI requests, as described above.
  • Paystack, when a company administrator pays for a subscription online. Paystack collects the card or bank details on its own secure page; we receive only the payment reference, amount, date and the administrator's email address, never card numbers.

We do not sell personal data, share it with advertisers or data brokers, or use it for marketing. We may disclose information where the law requires it.

Security

All traffic uses HTTPS. Stored drive tokens are encrypted, passwords are stored only as hashes, sessions are signed and expire, and each user only receives the data their role allows (a representative sees their own territory, a manager sees their team). Every change is recorded in an audit log in the company's folder.

How long data is kept and how to delete it

  • Deleting your account: a company's administrators manage who has access. To delete your account, ask your administrator, who removes you in Users & roles; your sign-in and profile photo are then deleted and you cannot sign in again. Calls, plans and accounts you recorded belong to the company and stay in its drive. Administrators can delete their own account in the app (More > Delete my account). If the person is the company's only administrator, deleting their account closes the company: we delete its company code, everyone's sign-in passwords, the link to its drive and its licence record (payment records are kept for accounting). If your administrator cannot help, email hello@avahealthcareltd.com and we will pass on and follow up your request.
  • CRM data stays in the company's own Google Drive or OneDrive for as long as the company keeps it. The administrator can delete users, accounts and products in the app, or delete the Ava CRM folder at any time.
  • Removing Ava CRM's access: the administrator can remove access at any time from myaccount.google.com/permissions (Google) or myapps.microsoft.com / account.live.com/consent/Manage (Microsoft). After that Ava CRM can no longer read or write any file.
  • Our records: when a company stops using Ava CRM, or asks us, we delete its stored tokens and connection record. Licence records are kept as long as needed for accounting and legal obligations. To ask for deletion, email hello@avahealthcareltd.com from the administrator's address.
  • On devices: signing out or uninstalling the app removes the local copy.

Your rights

If you are a user of Ava CRM, or a healthcare professional whose details a company keeps in Ava CRM, you can ask to access, correct or delete your personal data. Please contact the company that uses Ava CRM first, as it controls that data; we will help it respond. You can also contact us directly, and you may complain to the Nigeria Data Protection Commission.

Children

Ava CRM is a business tool for adults and is not intended for children.

Changes

We will post any change to this policy on this page and update the date above. We will tell administrators of significant changes in the app or by email.

Contact

Ava Healthcare Limited, 49, Ben-Bright Ozurumba Street, Ago Palace Way, Lagos, Nigeria
Email: hello@avahealthcareltd.com · Phone: +234 803 467 8355

Chat on WhatsApp