1. Who we are

Afrimed Link Ltd operates Afrimedlink and is the data controller for personal data processed on the Platform, at Victoria Island, Lagos, Nigeria. Contact our Data Protection Officer, at info@afrimedlink.com (subject line: "Data Protection").

This notice explains what we collect, why, who we share it with, how long we keep it and your rights. It is written to meet the Nigeria Data Protection Act 2023 (NDPA) and the NDPC's General Application and Implementation Directive 2025 (GAID). Health information is also protected by the National Health Act 2014 and the professional duty of confidentiality owed by every clinician on the Platform.

2. What we collect

Health information, and data revealing race, ethnicity or religion, is sensitive personal data under NDPA s.30. We only process it for your care or as the law allows, with the safeguards described below.

3. Why we use it and our lawful basis

We do not make decisions about your care or eligibility by automated means alone. Clinical decisions are always made by a licensed clinician.

4. Who we share it with

• Clinicians and facilities involved in your care — only what they need; access to certain sensitive records requires a recorded request.
• Partner pharmacies, laboratories and imaging centres fulfilling your prescription or order.
• Service providers acting on our instructions under contract (data processors): cloud hosting (Vercel; MongoDB Atlas), secure file storage (Cloudinary), email delivery (Brevo; Google Gmail as a fallback), payments (Flutterwave), and mapping and location lookups (OpenStreetMap, Google Maps, ipapi.co).
• Regulators, courts or law enforcement, only where the law requires it (National Health Act 2014, s.26(2)).

We never sell your personal data, and we do not use your health information for advertising.

5. Transfers outside Nigeria

Some of our service providers store or process data on servers outside Nigeria, including in the United States and the European Union. Under NDPA ss.41–43 we only transfer data where the destination offers adequate protection, or where another lawful ground applies, such as the transfer being necessary to provide the service you asked for or your consent. We use contracts that require providers to protect your data and use it only on our instructions.

6. How we protect it

• Personal and health information is encrypted in our database (AES-256), and all connections use HTTPS.
• Access is role-based: each user sees only what their role needs, and access to certain sensitive records requires a logged request.
• Actions on records are recorded in an audit log.
• Passwords are stored only as one-way hashes.

If a breach is likely to put your rights at risk, we will notify the NDPC within 72 hours of becoming aware of it (NDPA s.40(2)) and tell you immediately, in plain language, where the risk to you is high (s.40(3)).

7. How long we keep it

• Health records: for as long as needed for your continuing care and as required by law and professional record-keeping rules, even after you close your account.
• Account data: until you close your account, then deleted or anonymised, except what we must keep for legal, financial or safety reasons.
• Payment records: for the period required by tax and financial regulations.
• Audit and security logs: for as long as needed to investigate misuse and meet legal obligations.

We keep personal data no longer than necessary for the purpose it was collected for (NDPA s.24).

8. Your rights

Under NDPA ss.34–38 you have the right to:

• access your data and receive a copy in a common electronic format;
• have inaccurate data corrected;
• have data deleted or its use restricted, where the law allows (some health records must be kept);
• withdraw consent at any time, without affecting processing already done;
• object to processing based on legitimate interests, and to direct marketing at any time;
• not be subject to decisions based solely on automated processing; and
• data portability.

To use these rights, contact our Data Protection Officer, at info@afrimedlink.com (subject line: "Data Protection"). We will verify your identity and respond without undue delay, and within 30 days. If you are unhappy with our response, you can complain to the Nigeria Data Protection Commission (ndpc.gov.ng).

9. Children

A child is anyone under 18 (Child's Rights Act 2003, adopted by NDPA s.65). Our policy is that children's accounts are created and managed by a parent or legal guardian. Where we rely on consent to process a child's data, we obtain it from the parent or guardian and take appropriate steps to verify age and their authority (NDPA s.31).

10. Cookies and similar technologies

We only use cookies that are strictly necessary to run the Platform:

We do not use advertising or analytics cookies. If we ever add non-essential cookies, we will ask for your consent first and let you refuse them, as the GAID requires.

11. Changes to this notice

We will update this notice when our practices or the law change, show the new date at the top, and tell registered users about significant changes.