1. Purpose and scope

This policy sets out how Afrimed Link Ltd governs the data on Afrimedlink: who is accountable, how data is classified, protected, shared, kept and disposed of, and how we respond when something goes wrong. It applies to all personal and health data on the Platform, to our staff and contractors, and to the clinicians and partners who use it. How we use your personal data is explained in our Privacy Notice.

2. Legal and regulatory framework

Where we serve users in other West African countries, we also follow their national data protection laws, including Ghana's Data Protection Act 2012 (Act 843), Senegal's Law No. 2008-12, Côte d'Ivoire's Law No. 2013-450 and Benin's Digital Code (Law No. 2017-20, as amended).

3. Accountability and roles

Contact the Data Protection Officer, at info@afrimedlink.com (subject line: "Data Protection").

We register with the Nigeria Data Protection Commission as a data controller of major importance where the law requires, and file compliance audit returns as the GAID requires.

4. Data classification

5. Security controls

• Encryption of personal and health data in the database (AES-256) and of all traffic in transit (HTTPS/TLS).
• Role-based access control across patient, clinician, pharmacy, laboratory, administrative and IT roles, on the principle of least privilege.
• Audit logging of access to and changes in records, supporting our duty to prevent unauthorised access (National Health Act 2014, s.29).
• Password hashing, session expiry and controls to suspend or lock accounts.
• Separate development and production environments, each with its own encryption keys and file storage.
• Regular review of access rights, dependencies and security settings.

6. Data lifecycle

• Collection: we collect only what each service needs (data minimisation, NDPA s.24), with a clear lawful basis.
• Quality: patients and clinicians can correct inaccurate data; clinical records are corrected by adding to them, not by deleting what was recorded.
• Retention: records are kept only as long as necessary for care, legal obligations and safety, then deleted or anonymised. Health records may need to be kept after an account closes.
• Disposal: secure deletion from live systems, with backups expiring on their normal cycle.

7. Sharing and third-party processors

• Data is shared with clinicians and partners only as needed for a patient's care, and with authorities only where the law requires it.
• Every service provider that processes data for us does so under a written agreement that limits use to our instructions and requires appropriate security.
• Transfers outside Nigeria follow NDPA ss.41–43: an adequate destination or another lawful ground, with contractual safeguards.
• We never sell personal data.

8. Impact assessments and new technology

Before starting processing that is likely to be high-risk — such as a new service handling health data at scale, a new country, or any automated or AI-assisted tool affecting patients — we carry out a data protection impact assessment (NDPA s.28) and consult the NDPC where significant risk remains.

9. Incident and breach response

• Anyone who suspects a breach or security incident must report it to the DPO immediately.
• We contain it, assess the risk to the people affected, and record it in our breach register.
• Where a personal data breach is likely to put people's rights at risk, we notify the NDPC within 72 hours of becoming aware of it (NDPA s.40), and inform the people affected immediately, in plain language and with advice on protecting themselves, where the risk to them is high (s.40(3)).
• Cyber attacks and system intrusions are reported to ngCERT within 72 hours, as the Cybercrimes Act (as amended in 2024) requires.
• Afterwards we review what happened and fix the cause.

10. Data subject requests

Requests to access, correct, delete, restrict, port or object to the processing of personal data are logged and answered by the DPO without undue delay, and within 30 days. We verify identity first and never charge for a reasonable request.

11. Training, audit and review

• Staff with access to personal data receive data protection and confidentiality training when they join and every year.
• We monitor compliance with this policy and carry out the annual data protection audit required by the GAID.
• This policy is reviewed at least once a year, and whenever the law or our services change significantly.