This policy explains what eBima collects when you buy or hold a micro-insurance policy with us, why we need each piece of it, and who else ever sees it. It covers our website, our WhatsApp service and your customer dashboard.
1. What we collect
We only collect what is needed to sell you a policy, keep it, and pay a claim.
| What | Why we need it |
|---|---|
| Your name and mobile number | To issue the policy, to contact you about it, and to sign you in. Your mobile number is your account. |
| Date of birth | Every plan has an age range. We check the age of the person being insured against it before an order is created. |
| Details of anyone else you insure | Their name, date of birth, their relationship to you and an optional contact number, so the policy names the right person. |
| Your messages to us | WhatsApp and website conversations, so we can answer you and so there is a record of what was agreed. |
| Your WhatsApp account identifier | WhatsApp gives each business an identifier for the people who message it. We store it so we still recognise you if you adopt a WhatsApp username and your number stops being sent to us. |
| Orders and payments | What you bought, the premium, and whether it was paid. We do not receive or store your card or mobile-banking credentials - those are handled entirely by the payment provider. |
| Claims and the documents you upload | What happened, when, the amount claimed, and files such as bills, prescriptions and reports. These often contain health information, which we treat as sensitive. |
| Sign-in codes and links, and the address you signed in from | To let you into your dashboard, and to spot someone trying to get into an account that is not theirs. |
2. How we use it
- To show you the plans you are eligible for, and to create and hold your policy.
- To take payment, and to send you the confirmation and the link to your dashboard.
- To receive a claim, review it, and tell you the decision.
- To answer your questions on WhatsApp and on the website.
- To keep the service secure - rate-limiting sign-in codes, and logging unusual activity.
- To meet obligations we have under Bangladeshi law, including to the insurer and to regulators.
We do not use your information to advertise to you on other platforms, and we never sell it.
3. Our automated assistant
Our WhatsApp and website assistant is partly automated. To answer a question, the text of your conversation may be sent to a third-party language-model provider that processes it on our behalf and returns a reply. Your name and mobile number may appear in that text where they are part of the conversation.
The assistant never decides a claim. Prices, plans, eligibility and claim decisions come from our own records and from our staff, not from the model.
4. Who else sees it
- The insurer underwriting the plan you bought. They receive the policy details and, if you claim, the claim and its documents.
- Our payment provider, to take the premium and confirm it. They collect your payment details directly - we never see them.
- WhatsApp (Meta), because that is how the messages reach you. Their own terms and privacy policy apply to the messages they carry.
- Our SMS provider, where a sign-in code or notice is sent by SMS.
- Our hosting and infrastructure providers, who store the data on our behalf.
- The language-model provider described in section 3.
- Courts, regulators or law enforcement, where we are legally required to.
Everyone above is given only what they need for that purpose. We do not sell, rent or trade your information to anyone.
5. Your claim documents
A hospital bill carries your name, your condition and your phone number, so claim documents are not published at a public web address. They are served only to you, once you are signed in to your dashboard, and to our staff who are handling the claim. Staff activity in our admin console is logged.
6. How long we keep it
- Sign-in codes and links - minutes to an hour. The code itself is stored only while it is still usable and is erased the moment it is used, replaced or expires; after that only a one-way hash remains.
- Policies, orders, payments and claims - for as long as the policy runs and afterwards for as long as the law and the insurer require us to keep financial and insurance records.
- Conversations - while they are useful for serving you and for resolving any dispute about what was agreed.
7. Your choices
- See what we hold. Your policies, claims and details are on your dashboard at any time.
- Correct it. You can change your name and date of birth on your dashboard. Details already printed on a paid policy are fixed - contact us and we will look at it with the insurer.
- Ask us to delete it. Contact us and we will delete what we are not legally required to keep. We usually cannot delete records of a policy or a claim while it is live or within the retention period above.
- Stop messages. You can block or stop our WhatsApp messages at any time. We will still need to contact you about a live policy or claim.
8. How we protect it
- There is no password to steal. You sign in with a one-time code sent to your number, or with a link sent to your WhatsApp that works once and expires after an hour.
- Codes are stored as one-way hashes, are limited in how often they can be requested, and lock after a few wrong attempts.
- Traffic to the site is encrypted, and session cookies are marked secure and cannot be read by scripts.
- Claim documents are served only to the person they belong to and to our staff.
No service can promise perfect security, but if something happens that puts your information at risk we will tell you and take it seriously.
9. Children
Our service is for adults. A child can be insured on a plan that allows their age, but the policy is bought and managed by an adult, who gives us the child's details and is responsible for them.
10. Changes to this policy
If we change how we use your information we will update this page and the date at the top. Where the change is significant, we will tell you on WhatsApp or on your dashboard.
Contact us
If you have a question about this privacy policy, or you want to see, correct or delete the information we hold about you, reach us at:
eBima
- Your policies and claims: your dashboard