Privacy Policy

1. Introduction

Welcome to the Privacy Policy of Health Vault NG Ltd, a patient-owned digital health records platform that enables individuals to securely store, organise, access, manage, and share their medical records. The platform allows users to upload and maintain health information such as laboratory results, diagnostic reports, prescriptions, medication history, vital signs, hospital visit records, and other health-related documents.

When we mention "Health Vault", "we," "us," or "our" in this Privacy Policy, we are referring to Health Vault NG Ltd.

This Privacy Policy outlines how we collect, use, safeguard, disclose and generally process the Personal Data of our Data Subjects such as customers, visitors and other individuals that use our Services or interact with us. We are committed to data privacy and protection and ensuring compliance with the principles of data processing and the provisions of the Nigeria Data Protection Act, and other applicable regulations.

2. Definitions

• Cookies are small files stored on your device (computer or mobile device).
• Data Controller means a natural or legal person who (either alone or jointly or in common with other persons) determines the purposes for which and the manner in which any Personal Data are, or are to be, processed.
• Data Processors (or Service Providers) means any natural or legal person who processes the data on behalf of the Data Controller. We may use the services of various Service Providers in order to process your Personal Data more effectively.
• Data Protection Laws means the Nigeria Data Protection Act 2023, General Application and Implementation Directive 2025 and other applicable regulations.
• Data Subject means any individual whose Personal Data is being processed.
• Personal Data means any information relating to an individual, who can be identified or is identifiable, directly or indirectly, by reference to an identifier, such as a name, an identification number, location data, an online identifier or one or more factors specific to the physical, physiological, genetic, psychological, cultural, social, or economic identity of that individual.
• Service means the services and products offered by us.
• Usage Data is data collected automatically either generated by the use of the website or from the use of our Service infrastructure and products (for example, the duration of a page visit).

3. Our Guiding Principles on Data Processing

As we process Personal Data, we adhere to certain guiding principles to ensure that your Personal Data is:

• Processed fairly, lawfully, and in a transparent manner.
• Obtained for a specified and lawful purpose and not processed in any manner incompatible with such purposes.
• Adequate, relevant, and limited to what is necessary to fulfil the purpose of processing.
• Accurate and, where necessary, kept up to date.
• Not kept for longer than necessary for the purpose of processing.
• Processed in accordance with the Data Subject's rights.
• Kept safe from unauthorised processing, and accidental loss, damage, or destruction using adequate technical and organisational measures for confidentiality, integrity, and availability of Personal Data.

4. Types of Personal Data We Collect

We collect different types of Personal Data when you use our Services, use our web portals, or communicate with us:

Type	Description
Analytics	Details about you and your interactions with our services, website and platforms for analytical and improvement purposes.
Contact	Address (State, City), email, and telephone numbers for communications, employment and any interaction with Health Vault.
Health-related Data	Laboratory results, diagnostic reports, prescriptions, medication history, vital signs, hospital visit records, and other health-related documents.
Marketing & Communications	Details about you and your preferences in receiving our communications and updates about our Services, employment and events.
Personal Identifiers	Names, identification number, gender, age, date of birth, passport details, citizenship, photograph, and other identifiers used for Health Vault's records or Services.
Technical	IP address, browser type, browser version, pages visited, time and date of visit, unique device identifiers, and other diagnostic data.
Transaction	Bank details, payment card details, and other personally identifiable data during payments to, from, or for you.
Usage	Information about how websites, online resources and other Services are used, including pages visited, time spent, and device information.

5. How We Obtain Personal Data

We obtain Personal Data directly and indirectly to provide our Services and as part of our operations. Some of the ways Personal Data may be obtained include:

• From customers during applications and our onboarding processes.
• When you engage with our Services or participate in our activities and events.
• Through vendor relationships or services provided to Health Vault.
• Through website visits and use of our online platforms.
• Through communication channels such as email, social media interactions, or subscriptions to our Services and newsletters.

6. Purpose for Processing Personal Data

At Health Vault, we collect and process personal data for the following purposes:

• Provision of Services: To provide and maintain our Services, notify you about changes, provide customer support, and monitor usage to improve our Service.
• Performance of a Contract: To carry out our obligations and enforce our rights arising from any contracts entered into between you and us, including for billing and collection.
• Communication: To contact you with information regarding our Services, your account and/or subscription, including expiration and renewal notices, events, and relevant updates.
• Financial Transactions: To process subscription fees, discounts, and other financial transactions related to our interaction with you.
• Legal Compliance: To comply with legal and regulatory requirements, including record-keeping and reporting obligations.
• Research and Development: To conduct research and analysis to improve our programs, services, and facilities.
• Marketing and Promotions: To send you information about Health Vault's programs, events, special offers, and general information about goods, services and events which we offer, unless you have opted not to receive such information.
• Feedback and Improvement: To gather feedback from users, staff, and other stakeholders to improve our services and enhance the user experience.

7. Lawful Basis for Processing

Our processing of Personal Data may be carried out on any of the following lawful bases:

• Consent: We may rely on consent in certain circumstances to process your Personal Data. You have the right to withdraw your consent at any point.
• Fulfilment of a contractual obligation.
• Compliance with legal and/or regulatory requirements and obligations that Health Vault is subject to.
• Protection of your vital interest or any other natural person.
• Performance of a task carried out in the public interest or in the exercise of official authority vested in us.
• Cases where the processing is required for Health Vault's legitimate interests or a third party's, insofar as this does not conflict with the requirements for the protection of Personal Data.

8. Data Retention

We retain your data for the period necessary for the purposes for which it was collected and for the provision of our Services to you. The storage duration of Personal Data may also be determined by legal, regulatory, administrative, or operational requirements. We follow an internal data retention policy to ensure your Personal Data is kept only as long as necessary and securely disposed of when no longer required.

9. Data Transfer

Your information, including Personal Data, may be transferred to and maintained outside of Nigeria where the data protection laws may differ from those of Nigeria. We may share your personal data in furtherance of any of our Services and to the extent permitted by law or by you, with our processors, vendors, regulatory bodies and other third parties.

Such transfers will only be carried out with your consent or agreement to our Terms; to perform our obligations under a contract with you; solely for your benefit where consent was not possible to obtain; to establish or in defence of a legal claim; or to protect your vital interests. Health Vault takes appropriate safeguards to ensure your data is treated securely and in accordance with this Privacy Policy.

10. Third Parties and Service Providers

We may employ third party companies and individuals to facilitate our Service, provide Services on our behalf, perform Service-related services or assist us in analysing how our Service is used. We may disclose Personal Data to contractors, Service Providers, and other third parties we use to support our business, and to regulatory bodies or law enforcement agencies where required by law.

These third parties have access to your Personal Data only to perform these tasks on our behalf and are obligated not to disclose or use it for any other purpose.

11. Data Security

We strive to make your Personal Data secure. We adopt technical and organisational measures to prevent loss, unauthorised access, misuse, modification or disclosure of Personal Data under our control. We require all parties, including our staff and third parties processing data on our behalf, to comply with relevant policies and guidelines to ensure that information is protected in use, when stored, and during transmission.

12. Children's Privacy

Our Services are not intended for use by children under the age of 18. We do not knowingly collect personally identifiable information from Children under 18. If you become aware that a Child has provided us with Personal Data, please contact us. If we become aware that we have collected Personal Data from Children without verification of parental or guardian consent, we take steps to remove that Personal Data from our servers.

13. Cookies

We use cookies and similar tracking technologies to track the activity on our Service and hold certain information. Our website may use cookies to enhance your browsing experience. Please refer to our Cookie Policy for more details.

14. Your Rights

You have certain rights regarding your personal data as prescribed under Nigerian data protection instruments, including:

• Right to be Informed: You have the right to be informed about your Personal Data in our custody.
• Right to Access: You have the right to request a copy of any Personal Data we hold about you by contacting us at [email protected].
• Right to Rectify: You have the right to request that we correct any personal information you believe is inaccurate, outdated, or incomplete.
• Right to Withdraw Consent: Where you have given consent for us to use your personal data, you can withdraw that consent at any time.
• Right to Restrict or Object: You can restrict or object to the processing of your Personal Data in certain cases.
• Right in Relation to Automated Processing: You have the right to request human intervention where your personal data is being processed through automated means.
• Right to Data Portability: If we process your personal information based on your consent or to fulfil a contract, and this processing is automated, you have the right to receive your data in a machine-readable format.
• Right to Erasure: You have the right to request that we delete your Personal Data where it is no longer necessary for the purpose it was collected, or where our use of your personal information is against the law or other legal obligations.

We try to respond to all legitimate requests within one month. Occasionally, it could take us longer if your request is particularly complex, in which case we will notify you and keep you updated.

15. Contact Details

To exercise any of your rights, or if you believe there has been a breach of this Privacy Policy, or if you have any concerns regarding the processing of your Personal Data, please contact us:

• Email: [email protected]
• Address: No 7 Kunde Street, Maitama, Abuja FCT, Nigeria

You also have the right to lodge a complaint with the data protection supervisory authority in Nigeria, the Nigerian Data Protection Commission (NDPC), at [email protected].

16. Changes to this Privacy Policy

We regularly review and update our Privacy Policy to ensure it reflects our commitment to protecting your Personal Data and remains in line with applicable legal and regulatory requirements. Any updates will be posted on our website. This Privacy Policy was last updated in August 2026.