Privacy Policy

Doctorcare247 provides telemedicine, remote patient monitoring, digital prescriptions and health record management services via a web and mobile platform in Nigeria.

This Privacy Policy explains in detail how we collect, use, store, protect, share and retain your personal and health data in compliance with the Nigeria Data Protection Act (NDPA) 2023 and Nigeria Data Protection Regulation (NDPR) 2019.

1. Our Role

Doctorcare247 acts as a Data Controller and Data Processor for personal and health data collected via our services.

2. Categories of Data We Collect

1. Personal Identification Data: Full name, phone number, email address, residential address, date of birth, gender, next of kin, emergency contacts, profile photo and identity verification data.
2. Sensitive Health Data: Medical history, diagnoses, prescriptions, allergies, lab results, consultation notes, medical reports, uploaded files, remote monitoring vitals, wearable integrations, images and audio/video consultation records.
3. Technical & Usage Data: IP address, device type, operating system, browser type, login timestamps, session logs, crash logs, cookies, analytics and location approximation.
4. Payment Data: All payments are processed by PCI-DSS compliant payment processors. Doctorcare247 does not store card or bank details.

3. How We Collect Data

We collect data when you:

1. Account Setup: Register and create an account
2. Medical Interactions: Book or attend consultations
3. Records Management: Upload health records or sync devices
4. Support Inquiries: Communicate with doctors or support
5. Marketing Opt-ins: Subscribe to product and services email listing
6. General Browsing: Use our website or mobile app

4. Legal Basis for Processing

We process data based on consent, healthcare provision, contractual necessity, legal obligation, legitimate interest and vital interest in emergencies.

5. How We Use Data

1. Primary Care: Deliver telemedicine services
2. Patient History: Maintain electronic health records
3. Scheduling: Appointment reminders and notifications
4. Risk Management: Fraud prevention and platform security
5. Legal Adherence: Regulatory compliance
6. Platform Optimization: Service analytics and improvement

6. Data Storage & Security

We use encrypted cloud hosting, multi-factor authentication, role-based access controls, monitoring, logging and regular security audits.

7. International Data Transfers

Where data is hosted outside Nigeria, contractual safeguards and encryption ensure compliance with NDPA cross-border requirements.

8. Data Retention Policy

1. Medical Records: Retained minimum 7 years after last interaction.
2. Financial Records: Retained minimum 8 years.
3. Technical Logs: Retained 12-24 months.
4. Backup Archives: Retained up to 5 years.
5. Data Expiry: After expiry, data is securely deleted or anonymised.

9. User Data Rights

You may:

1. Right to Access: Access your data
2. Right to Rectification: Correct inaccurate data
3. Right to Erasure: Request deletion
4. Right to Restrict: Restrict or object to processing
5. Right to Withdraw: Withdraw consent
6. Right to Portability: Request data portability
7. Right to Complain: Lodge complaint with Nigeria Data Protection Commission

10. Data Deletion Requests

Deletion requests are processed within 30 days. Some records may be retained to meet legal medical or financial obligations.

11. Data Sharing

We share data only with:

1. Medical Providers: Licensed healthcare professionals
2. Tech Partners: Cloud and infrastructure providers
3. Financial Partners: Payment processors
4. Authorities: Regulators and law enforcement when required

12. Cookies Policy

Cookies enable login sessions, preferences, analytics and security. You may disable cookies but some features may not work.

13. Children's Data

Children's data is processed only with parental or guardian consent.

14. Data Breach Response

In the event of a breach posing risk to users, affected individuals and regulators will be notified promptly.