Your health data, handled to a defined standard

GuardiaMed Nigeria Ltd. ("GuardiaMed", "we") is the data controller for the personal and health information processed through this platform. Our Data Protection Officer can be reached at coo@guardiamed.com.

This policy explains what we collect, why we collect it, who we share it with, how long we keep it, and the rights you can exercise. It is written to the Nigeria Data Protection Act 2023 (NDPA).

Identity and contact data: name, phone number, email address, date of birth, and — for professionals — licence number, NIN and BVN used only to confirm identity.

Care data: the reason for a visit, the care plan you or your clinician provides, visit notes, vitals, medications administered, photographs where you have consented, and escalations.

Location data: the service address for a visit, and GPS-stamped attendance for professional visits so that attendance can be evidenced.

Transaction data: fees, invoices, payout references and reconciliation records.

Technical data: device and browser information, and audit logs of who accessed which record and when.

To provide care and coordinate professionals — performance of our contract with you, or steps taken at your request before a contract.

To protect health and manage clinical escalation — vital interests, and in some cases the provision of health care under Article 6(1)(d) of the NDPA, handled under confidentiality obligations.

To verify professional credentials and prevent fraud — our legitimate interest, and a legal obligation where a regulator requires verification.

To meet legal, tax and regulatory obligations, including NDPA accountability and audit requirements.

Where we rely on consent — for example photographic visit updates, or a transfer of data outside Nigeria where consent is the mechanism — you may withdraw it at any time without affecting care already delivered.

Health information is sensitive personal data. Access is limited to the professionals involved in your care, the coordinating team, and — where you have authorised it — a named relative, guardian or treating physician.

Access is tied to a care relationship and is logged. Staff access is reviewed, and access outside a care relationship is a reportable incident.

The professional assigned to your care, and the facility or clinician who referred you.

People you authorise: a family member using the family portal, a guardian, or a physician overseas where you have asked us to report to them.

Service providers acting on our instructions under contract — payment and settlement providers, laboratories, communication and hosting providers — who may not use the data for their own purposes.

Regulators, law enforcement or a court where the law compels disclosure, and the Nigeria Data Protection Commission where a breach or complaint requires notification.

We never sell personal data, and we never share your health information for advertising.

Some care arrangements involve a relative, guardian or physician outside Nigeria, including diaspora and international patient programmes. Where data is transferred outside Nigeria, we rely on your consent and on contractual safeguards that require the recipient to protect it to a standard consistent with the NDPA.

Clinical records are retained for the period required by applicable health record-keeping rules and professional obligations, after which they are securely destroyed.

Financial and audit records are retained for the period required by tax and regulatory rules. Verification records for professionals are kept while the professional is active and for the statutory period afterwards.

Access is role-based and least-privilege, records are tied to a care relationship, and access to records is audited. Data is encrypted in transit, and stored on secured infrastructure with backup and recovery controls.

If a personal data breach occurs, it is recorded in our breach register and notified to the Commission and to affected individuals where the NDPA requires it.

You have the right to be informed, to access your data, to correct it, to have it deleted, to restrict or object to processing, to data portability, and to be free from a decision based solely on automated processing. You also have the right to lodge a grievance with us, and to complain to the Nigeria Data Protection Commission.

To exercise a right, email coo@guardiamed.com with enough detail for us to locate your records. Requests are logged, acknowledged within the period set by the NDPA, and resolved within the statutory window. Exercising a right will not affect the care you receive.

We use strictly necessary storage to keep you signed in and to remember your cookie choice, and nothing else is set until you agree. See the Cookie Policy for the categories and how to change your mind.

When this policy changes materially, the updated version is published here with a new date, and where the change affects how your data is used we will tell you directly.