Privacy Policy

Effective Date: 1 July 2026

Last Updated: 7 October 2026

Version: 2.2

1. Introduction and Scope

Alpha Nexus is a voluntary wellness, rewards, and safe-driving application operated by Alpha Direct Insurance Company (Pty) Ltd (“Alpha Direct”, “we”, “us”, “our”), a company duly registered in Botswana with its principal office in Gaborone. This Privacy Policy explains how we collect, use, store, protect, and share your personal information when you use the Alpha Nexus mobile application and related services (collectively, the “App”).

This Policy is drafted in compliance with the Botswana Data Protection Act 18 of 2024 (the “DPA”), which came into effect on 14 January 2025, and the South African Protection of Personal Information Act 4 of 2013 (“POPIA”), as the App is available to users in both Botswana and South Africa. Where there is any conflict between the two regulatory frameworks, we apply the stricter standard.

By creating an account and using the App, you acknowledge that you have read, understood, and agree to the collection and processing of your personal information as described in this Policy. If you do not agree, please do not use the App.

Important Notice: Alpha Nexus is a standalone wellness and rewards programme. Data collected through the App is not used for insurance underwriting, premium calculation, claims assessment, or any actuarial purpose whatsoever.

Are you an Alpha Direct insurance policyholder? See our Policyholder Privacy Notice.

2. Data Controller and Information Officer

The data controller responsible for your personal information is:

In accordance with Section 69 of the Botswana DPA and Section 55 of POPIA, our appointed Information Officer oversees all data protection compliance matters and serves as the primary contact point for the Information and Data Protection Commission (Botswana) and the Information Regulator (South Africa).

3. Lawful Basis for Processing

We process your personal information on the following lawful grounds, as required by Section 19 of the Botswana DPA and Section 11 of POPIA:

4. Categories of Personal Information We Collect

4.1 Account Information

When you register, we collect your email address (used to send one-time sign-in codes for passwordless authentication) and a display name of your choosing. We do not collect your national identity number, passport number, or physical address through the App.

4.2 Driving Behaviour Data (Click & Drive)

When you activate the Click & Drive feature and begin recording a trip, the App collects and processes the following data:

• GPS location data — used in real time on your device to calculate trip distance, speed, idle time, and harsh-driving events. Your drive’s location trail is never stored or transmitted.
• Speed changes derived from GPS — used to detect harsh braking and rapid acceleration. The App does not read your phone’s accelerometer or gyroscope and does not monitor phone usage while driving.
• Trip duration and timestamps — start and end times of each recorded journey.
• Driving score metrics — a composite safe-driving score calculated from the above inputs, including contributing factors for smooth driving, idling, and speed.
• Trip summary statistics — total distance, trip duration, idle time, number of harsh events, and maximum speed.
• Time over the speed limit — the App compares your speed with a map of Botswana road speed limits that is downloaded to your phone (from OpenStreetMap and the legal defaults). Getting the map does not send your location. Only the number of seconds you were over the limit, grouped by how far over, is sent with the trip — never where it happened.
• Fuel and carbon estimates and voice tips — worked out on your phone during the drive for your information only. They are not sent to us and do not affect your points.
• Weather tips — for weather tips (a hot-day reminder and a wet-roads chip) the App sends a rough area (about 11 km) to a free weather service (Open-Meteo); your exact location stays on your phone.
• Report a hazard (optional) — when you tap Send, the one spot you chose (your position then, or where your last drive ended) and your note go to Alpha Direct’s fleet team; nothing else about where you drove.
• Anti-cheating check — on iPhone the App creates a random security key that stays on your phone and uses it to sign each trip, so we can tell a genuine recording from a faked one. We receive only the public part of that key. It is not your phone’s serial number or an advertising identifier and is not used for tracking.

Points added and taken away automatically: Safe driving earns points. Speeding and harsh driving can take points away, and a serious speeding event counts as a strike; three strikes in 30 days pause reward redemption for 30 days. These decisions are made automatically by the App’s rules, with no person reviewing each trip. You can mark a trip as “not me driving” (twice a month), and you can tap Dispute on any trip to have our team review it. Points never affect your insurance cover or premium.

On-device processing: Raw GPS coordinates and sensor data are processed on your device during the trip. Once the trip ends and your driving score is calculated, the raw GPS track and raw sensor readings are discarded and not transmitted to our servers. Only the aggregated trip metrics and driving score are stored.

Driving style profile: Over time, the App builds a driving style profile based on your historical trip summaries. This profile is used solely to provide you with personalised coaching tips, track your improvement over time, and award rewards points. It is never shared with insurers, employers, or third parties for any purpose other than operating the rewards programme.

4.3 Wellness and Health Data

4.3.1 Fingertip Pulse Scan

The App uses your device’s rear camera and flash to perform a non-invasive fingertip pulse scan: three rounds of about 12 seconds each (about 36 seconds in total), with the flash switched off for a short pause between rounds so you can change fingers. During the scan:

• Camera images are processed entirely on your device using photoplethysmography (PPG) algorithms.
• No camera images, video frames, or raw optical data are uploaded to our servers or stored anywhere.
• Only the derived health metrics are saved: resting heart rate (BPM), heart-rate variability (HRV), breathing rate, an estimated stress level, and an overall wellness score. The beat-to-beat timing intervals detected during the scan are sent to our servers solely to compute these metrics and are not stored. The App does not measure blood pressure or blood oxygen (SpO2).

4.3.2 Step and Workout Sync (Health Connect / Apple Health)

Step and workout sync is an optional feature and may not be available in your version of the App. Where it is offered, it is off until you switch it on and grant permission. If it is not available in your version, or you never switch it on, the App reads no data from Google Health Connect or Apple Health at all.

If you do switch it on and grant permission, the App reads two things only: (1) your daily step count total — on Android from Google Health Connect (the READ_STEPS permission), and on iOS from Apple Health; and (2) your exercise sessions — on Android from Google Health Connect (the READ_EXERCISE permission): the type of exercise, its start and end time and its duration. Both are used solely to award wellness rewards points for physical activity — never for insurance pricing. We read the current and previous two calendar days only. We do not read exercise routes or GPS traces, heart rate, nutrition, body measurements, reproductive health, or any other category. The App never writes any data to Health Connect or Apple Health. Reading happens only when you tap “Sync steps and workouts” in the App — there is no background reading. You can withdraw the permission at any time in your phone’s settings, which stops the reading immediately.

4.3.3 Ready-to-Drive Sleep Check (optional)

The sleep check is off until you switch it on (“Connect sleep”) and grant permission. If you do, the App reads last night’s total sleep — on Android from Google Health Connect (the READ_SLEEP permission), and on iOS from Apple Health — and works out one number on your phone: the minutes you slept between 18:00 yesterday and 12:00 today. Only that one number (rounded to 15 minutes) is sent to us, at most once a day; we do not read or keep sleep stages, times or any other sleep detail. It is used only to show whether you look rested before driving and to award a small wellness reward — never for insurance pricing. You can switch it off at any time on the card (“Turn off”), which also deletes the sleep numbers we hold.

4.4 Food and Nutrition Review Data

The App includes a meal-logging feature that allows you to photograph meals and earn rewards points for healthy eating. When you submit a meal photo:

• The image is transmitted to an automated food-recognition service (powered by machine learning) solely to verify that the image contains real food and to classify the meal type and general nutritional category.
• The food-recognition service processes the image in real-time and returns a classification result. We do not store your meal photo. It is processed by the service solely to return the classification and is not used to train its models.
• We store only: the date and time, the foods the service recognised, its calorie and nutrient estimate, the healthy-meal score, and the points awarded. The photo itself is never stored.
• Meal photos are never used to identify you, other individuals in the image, your location, or any information beyond the food content itself.
• No one at Alpha Direct ever sees your meal photos — they are not kept.

4.5 Activity and Rewards Data

We collect and store information related to your participation in the rewards programme: points earned, redeemed, and current balance; tier status and progression history; meal photos you submit for verification (scored, not stored), daily step totals and exercise sessions (type, start/end time, duration) you sync from your phone; challenges you join and your completion status; leaderboard rankings and achievement badges.

4.6 Technical and Device Information

To ensure the App functions correctly and to diagnose technical issues, we collect: device type, operating system version, and App version; anonymised crash reports and performance metrics; push notification tokens (if you enable notifications); and IP address (used for security purposes and approximate geographic region only — not stored long-term).

We do not collect your device’s unique hardware identifiers (IMEI, MAC address) or access your contacts, call logs, SMS messages, or files stored on your device.

5. How We Use Your Information

We use the personal information collected through the App for the following purposes only:

• Operating the rewards programme — creating and maintaining your account, calculating points and scores, determining tier status, processing reward redemptions, and displaying your standing on leaderboards.
• Providing personalised insights — delivering driving coaching tips, wellness trend reports, activity summaries, and nutritional guidance based on your data.
• Improving the App — analysing aggregated, de-identified usage patterns to improve features, fix bugs, and develop new functionality.
• Communicating with you — sending transactional messages (sign-in codes, points notifications, reward confirmations) and, with your separate consent, promotional messages about new features or challenges.
• Ensuring security and preventing fraud — detecting unusual account activity, preventing abuse of the rewards system, and protecting the integrity of leaderboards.
• Complying with legal obligations — responding to lawful requests from regulatory authorities and maintaining records as required by law.

6. What We Do NOT Do With Your Data

• No insurance use. Your wellness scores, driving data, meal submissions, step counts, or any other App data are never used for insurance underwriting, premium calculation, claims decisions, policy cancellations, or any actuarial purpose.
• No sale of data. We do not sell, rent, lease, or trade your personal information to any third party for their marketing or commercial purposes.
• No profiling for automated decisions with legal effect. We do not use your data to make automated decisions that produce legal effects or similarly significant effects on you, as contemplated by Section 43 of the Botswana DPA and Section 71 of POPIA.
• No surveillance. The App does not continuously track your location. GPS is active only during a Click & Drive recording that you start yourself. It ends when you tap Stop, or by itself after 20 minutes without moving. While it records, the App shows a notification, and on Android it keeps recording with the screen locked; if you choose “Allow all the time”, it can also carry on after your phone restarts mid-drive. When no drive is open, location is used only for the one spot you choose to send in a hazard report, and a rough area (about 11 km) for weather tips.
• No biometric identification. Camera data from the wellness scan is not used for facial recognition or any biometric identification purpose.
• No audio recording. Although the microphone permission may be requested by the device during the wellness scan, no audio is recorded, processed, or stored.

7. Data Sharing and Third-Party Processors

We share your personal information only in the following limited circumstances:

All third-party processors are bound by written data processing agreements that require them to process your data only on our instructions, maintain appropriate security measures, and delete or return data upon termination of the agreement, in accordance with Section 30 of the Botswana DPA and Section 21 of POPIA.

8. Cross-Border Data Transfers

Your personal information may be transferred to and processed in countries outside of Botswana and South Africa where our service providers operate. In such cases, we ensure that:

• The receiving country has been determined to provide an adequate level of data protection (as per the Botswana Commission’s list of adequate jurisdictions), or
• Appropriate safeguards are in place, including binding contractual clauses that guarantee the same level of protection as afforded under the DPA and POPIA, or
• You have provided explicit, informed consent to the transfer after being made aware of the potential risks.

South Africa is recognised as an adequate jurisdiction by the Botswana Commission. Data transfers between our Botswana and South African operations are therefore permitted without additional safeguards.

9. Data Security

We implement appropriate technical and organisational measures to protect your personal information against unauthorised access, unlawful processing, accidental loss, destruction, or damage, as required by Section 62 of the Botswana DPA and Condition 7 of POPIA. These measures include:

• Encryption: All data is encrypted in transit using TLS 1.3 and at rest using AES-256 encryption.
• Access control: Strict role-based access controls ensure that only authorised personnel can access personal data, on a need-to-know basis.
• Authentication: Passwordless authentication via one-time codes reduces the risk of credential theft.
• Infrastructure security: Our hosting infrastructure is protected by firewalls, intrusion detection systems, and regular vulnerability assessments.
• Employee training: All staff with access to personal data receive regular data protection training.
• Incident response: We maintain a documented data breach response plan and will notify the relevant supervisory authority within 72 hours of becoming aware of a qualifying breach, and affected individuals without undue delay where the breach poses a high risk to their rights and freedoms.

10. Data Retention

We retain your personal information only for as long as necessary to fulfil the purposes for which it was collected, in accordance with the storage limitation principle (Section 22 of the Botswana DPA):

Upon account deletion, we will erase or de-identify all personal information within the timeframes specified above, unless retention is required by law.

11. Your Rights as a Data Subject

Under the Botswana Data Protection Act (Part VIII) and POPIA (Chapter 2, Section 5), you have the following rights:

• Right to Be Informed — You have the right to know what personal information we collect, why we collect it, how we use it, and with whom we share it.
• Right of Access — You may request a copy of all personal information we hold about you. We will respond within 30 days.
• Right to Rectification — If any personal information we hold about you is inaccurate, incomplete, or outdated, you have the right to request correction.
• Right to Erasure — You may request the deletion of your personal information. We will erase your data in accordance with the retention schedule in Section 10.
• Right to Object — You may object to the processing of your personal information on grounds relating to your particular situation, and to processing for direct marketing at any time.
• Right to Data Portability — You may request your personal information in a structured, commonly used, and machine-readable format.
• Right to Withdraw Consent — Where processing is based on your consent, you may withdraw that consent at any time without affecting the lawfulness of prior processing.
• Right Not to Be Subject to Automated Decision-Making — You have the right not to be subject to decisions based solely on automated processing that produce legal effects concerning you.
• Right to Lodge a Complaint — You may lodge a complaint with the Information and Data Protection Commission (Botswana) or the Information Regulator (South Africa).

12. How to Exercise Your Rights

To exercise any of the rights described above, contact us at privacy@alphadirect.co.bw with the subject line “Data Subject Request”. We will verify your identity before processing any request and respond within 30 calendar days. If a request is particularly complex, we may extend this period by a further 30 days with notice. There is no fee for exercising your rights unless a request is manifestly unfounded or excessive.

13. Device Permissions Explained

You may revoke any permission at any time through your device’s settings. Revoking a permission will disable the corresponding feature but will not affect the rest of the App’s functionality.

14. Children’s Privacy

Alpha Nexus is not intended for use by anyone under the age of 18. We do not knowingly collect personal information from children. If we become aware that we have inadvertently collected personal information from a child under 18, we will take immediate steps to delete that information. In accordance with Section 35 of the Botswana DPA and Section 34 of POPIA, processing of children’s personal information requires the consent of a competent person (parent or guardian).

15. Data Protection by Design and Default

In compliance with Section 52 of the Botswana DPA, we have implemented data protection by design and by default throughout the App:

• Minimisation by design: We collect only the minimum data necessary for each feature. Raw sensor data and images are processed on-device wherever possible.
• Privacy by default: All data-sharing features (step and workout sync, Click & Drive, meal logging) are opt-in and off until you switch them on. No data is collected until you actively enable them.
• Pseudonymisation: Where feasible, we use pseudonymised identifiers rather than directly identifying information in our analytics.
• Separation of concerns: Rewards data, wellness data, and driving data are stored in logically separated databases and are not cross-referenced with any insurance policy data held by Alpha Direct.

16. Data Protection Impact Assessment

Given that the App processes health-related data and location data, we have conducted a Data Protection Impact Assessment (DPIA) as required by Section 55 of the Botswana DPA for high-risk processing activities. The DPIA concluded that the safeguards described in this Policy adequately mitigate the risks to data subjects’ rights and freedoms. A summary of the DPIA is available upon request to our Information Officer.

17. Cookies and Tracking Technologies

The Alpha Nexus mobile application does not use browser cookies. We do not employ cross-app tracking, advertising identifiers, or third-party tracking pixels. We do not participate in any advertising networks or share data with advertisers.

18. Changes to This Privacy Policy

We may update this Privacy Policy from time to time to reflect changes in our practices, the App’s features, or applicable law. When we make material changes, we will update the “Last Updated” date at the top of this Policy and notify you via an in-app notification or email before the changes take effect. Where required by law, we will seek your renewed consent for any new processing activities.

19. Governing Law and Jurisdiction

This Privacy Policy is governed by the laws of the Republic of Botswana. Any disputes arising from or in connection with this Policy shall be subject to the exclusive jurisdiction of the courts of Botswana, without prejudice to your right to lodge a complaint with the relevant data protection authority in your country of residence. For users in South Africa, this Policy is additionally subject to the provisions of POPIA.

20. Contact Us

If you have any questions, concerns, or requests regarding this Privacy Policy or our data protection practices, please contact us:

This Privacy Policy was last reviewed and approved by the Alpha Direct Insurance Company Board of Directors on 30 July 2026.