Privacy Policy

NairaClinic ("NairaClinic", "we", "us") provides a digital platform that helps patients connect with licensed healthcare professionals and relevant partners (e.g., labs, pharmacies, dispatch/logistics where applicable).

Company name

NairaClinic Ltd

Email

hello@nairaclinic.com

DPO contact

support@nairaclinic.com

This Privacy Policy explains how we collect, use, share, store, and protect your personal data when you use:

• our website, mobile apps, or USSD/WhatsApp channels (if any)
• our patient support and provider support channels
• telemedicine consultations and related features (uploads, prescriptions, referrals, billing)

We collect only what we need to run a safe service. Depending on what you use, we may collect:

A) Account & identity data

• Name, phone number, email, date of birth, gender
• Login credentials (hashed), verification codes
• Next of kin / emergency contact (if you provide it)

B) Health and clinical data (sensitive personal data)

• Symptoms, history, diagnoses, treatment notes, prescriptions
• Vitals you enter, images/files you upload (e.g., lab results, photos)
• Referrals, follow-up plans, triage outcomes

Health status data is treated as sensitive personal data under Nigeria's Data Protection Act.

C) Payment & transaction data

• Payment reference IDs, billing history, subscription details (if any)
• We do not store full card details if a licensed payment processor handles payments.

D) Communications

• Messages and call metadata (time, duration, participants)
• Chat transcripts and support tickets (where needed for safety, continuity, and dispute handling)

E) Device & usage data

• IP address, device type, app version, crash logs, session identifiers
• Basic analytics events (e.g., "booked appointment")

We do not use sensitive-health data for ad targeting.

• Create and manage accounts, verify users, prevent fraud
• Deliver consultations, maintain medical records, coordinate care
• Manage payments, refunds, invoices
• Provide customer support and handle complaints
• Improve safety and service quality (audits, incident reviews)
• Meet legal/regulatory obligations (records, taxation, compliance)

• Consent — especially for sensitive personal data like health status
• Contract — to deliver the service you requested
• Legal obligation — e.g., compliance duties
• Vital interests — rare; life-threatening situations
• Legitimate interests — e.g., security, fraud prevention — but not in ways that override your rights

Where we rely on consent, you can withdraw it. We'll make it as easy to withdraw as it was to give. Withdrawing consent may limit your ability to use some features.

If you are under the age of majority, a parent/guardian may need to create the account or provide consent. NairaClinic does not knowingly market to children.

A) Licensed healthcare professionals

To provide care and continuity (notes, prescriptions, referrals).

B) Labs, pharmacies, and partner services

We share only what is needed to fulfil your request.

C) Payment processors

For payment processing and fraud prevention.

D) Cloud and infrastructure providers

We may use reputable cloud services. Cross-border transfers only occur where appropriate safeguards exist.

E) Legal/regulatory disclosures

We may share data if required by a valid legal request, court order, or regulator mandate.

What we do NOT do

• We do not sell your health data.
• We do not allow advertisers to target you using your health information.
• We do not put tracking pixels in clinical areas for ad profiling.

If personal data is transferred outside Nigeria, we will apply the NDPA's rules on adequacy/safeguards and keep records of the transfer basis.

• Encryption in transit and at rest (where feasible)
• Role-based access controls, logging, and monitoring
• Staff confidentiality obligations and access on a need-to-know basis
• Regular security reviews and incident response plans

We retain personal data only as long as needed for care continuity, medical record obligations, dispute resolution, audit needs, and legal compliance. We then securely delete or de-identify it where feasible.

Subject to NDPA and applicable limits, you can request:

• Access to your data, copies, and information about processing
• Correction of inaccurate/outdated data
• Deletion/erasure where applicable
• Restriction or objection to certain processing
• Withdrawal of consent
• Info about automated decision-making where applicable

If we use automation to support triage or workflow, we do not let it be the only basis for decisions with significant effects without appropriate safeguards. We treat it as "support," not a substitute for clinical judgment.

If a breach occurs, NairaClinic will notify the regulator within 72 hours where required and notify affected users in clear language where high risk exists.

Contact us at support@nairaclinic.com. You also have the right to lodge a complaint with Nigeria's Data Protection Commission (NDPC).

We may update this policy from time to time. If changes are significant, we'll provide a clear notice in-app or by email/SMS.