Privacy Policy

Sevenz Healthcare Services Ltd. operates the KompleteCare EMR platform, a cloud-based Electronic Medical Records system serving healthcare providers across Nigeria and the broader West African region. For data protection law purposes including the NDPA 2023 and NDPR 2019 KompleteCare acts as a data processor on behalf of healthcare facilities (data controllers) that subscribe to the product

2.1. Purpose

This privacy policy explains how Sevenz Healthcare collects and processes the personal information on the Platform and the security measures we have in place to ensure confidentiality of your personal information.

2.2. Consent

By consenting to this Policy, you agree that you have read the contents of this Policy and they are acceptable to you, and you consent to Sevenz Healthcare processing your personal data as provided in this Policy.

2.3. Data Controller

Sevenz Healthcare is the data controller and is responsible for your personal data. However, it is also possible for Sevenz Healthcare to act as a data processor, depending on the specific contractual relationship between you and Sevenz Healthcare.

2.4. Changes to the Notice and your Duty to Inform Sevenz Healthcare of Changes in your personal data

We keep our Policy under regular review. We will notify you once we make any changes to our Policy. We will endeavour to notify you once we update the Policy. It is important that the personal data we hold about you is accurate and current. You are to keep us informed if your personal data changes during your relationship with us.

2.5. Third-Party Links

The present document may include links to third-party websites, plug-ins and applications. Clicking on those links or enabling those connections may allow third parties to collect or share data about you. We do not control these third-party websites and are not responsible for their privacy statements. When you leave our platform, we encourage you to read the Privacy Policy or Notice of every website, plug-in or application you visit.

2.6. Our Data Protection Officer

If you have any questions or concerns about this Policy or our data privacy practice, or if you believe we have breached any of your rights as a data subject under this Policy or under the law, please contact our Data Protection Office at [email protected].

3.1. Personal Information

Personal data or personal information refers to any information about an individual from which that person can be identified. When you register for our services, we will need to collect, use, store, and transfer kinds of personal data about you which we have grouped together as follows:

• Identity data: includes first name, maiden name, last name, username or similar identifier, marital status, title, date of birth and gender
• Contact data: includes billing address, residential address, business address, email address and telephone numbers
• Patient health data : entered by healthcare providers includes names, dates of birth, national IDs, medical history, diagnoses, clinical notes, prescriptions, lab results, vital signs, and insurance details.
• Healthcare provider & staff data : includes names, professional registration numbers, and system activity logs.
• Technical data: includes internet protocol (IP) address, your login data, browser type and version, time zone setting and location, browser plug-in types and versions, operating system and platform, and other technology on the devices you use to access our Platform
• Profile data: includes your username and password, purchases or orders made by you, your interests, preferences, feedback and survey responses
• Usage data: includes information on how you use our Platform
• Marketing and Communication Data: includes your preferences in receiving marketing from us and our third parties and your communication preferences.

3.2.

In addition to the above, your personal data may also be collected when you voluntarily provide such information, such as when you contact us with inquiries or respond to one of our surveys.

3.3. Other information

Some personally non-identifiable data may be collected when you make use of the Platform. Such information, which is collected passively using various technologies, cannot presently be used to specifically identify you. Sevenz Healthcare may store such information itself or such information may be included in databases owned and maintained by Sevenz Healthcare affiliates, agents or service providers. We may use such information and pool it with other information to perform certain tasks such as grant you access to some parts of the Platform or improve our services.

Where we need to collect personal data pursuant to Applicable Laws, or under the terms of a contract we have with you, and you fail to provide that data when requested or fail to update your details with us, we may not be able to perform the contract we have or are trying to enter into with you (for example, to provide you with our services). In this case, we may have to cancel a product or service you have with the Company but we will notify you if this is the case at the time.

4.1. Direct interactions

You may give us your information by filling in forms or by corresponding with us by post, phone, email or otherwise. This includes personal data you provide when you:

• create an account on any digital health product that we own;
• subscribe to our service or publications;
• request marketing to be sent to you;
• enter a competition, promotion or survey; or
• give us feedback or contact us.

4.2. Automated technologies or interactions.

As you interact with our Platform, we will automatically collect Technical Data about your equipment, browsing actions and patterns. We collect this personal data by using cookies, server logs and other similar technologies. We may also receive Technical Data about you if you visit other websites employing our cookies. Please see our cookie policy for further details.

4.3. Third parties or publicly available sources

We will receive personal data about you from various third parties.

We will only use your personal data when the law allows us to. Most commonly, we will use your personal data in the following circumstances:

• Where we need to perform the contract between you and Sevenz Healthcare
• Where you provide consent. You have the right to withdraw consent to marketing at any time by contacting us.
• Where it is necessary for our legitimate interests (or those of a third party) and your interests and fundamental rights do not override those interests.
• Where we need to comply with a legal obligation.

We may process your personal data for any of the purposes below:

• To process your registration on the Platform.
• To allow us to better serve you in responding to your customer service requests.
• To quickly process your transactions.
• To follow up with you after correspondence (email or phone inquiries).
• To help us to develop the Platform and our services.
• To provide your information to our customer service agents for research and analysis purposes so that we can monitor and improve the services we provide. We or our agents and sub-contractors may contact you by post, e-mail or telephone to ask you for your feedback and comments on our services.
• To provide you with information about special features of our App or any other service or products we think may be of interest to you.
• To provide you with related information from third parties we think may be of interest to you.
• To provide your information to carefully selected third parties whose products or services we believe may be of interest to you. These third-party sites have separate and independent privacy policies. We therefore have no responsibility or liability for the content and activities of these linked sites. We seek to protect the integrity of our site and welcome any feedback about these sites.

Other information

We will only use your personal data for the purposes for which we have collected it unless we reasonably consider that we need to use it for another reason and that reason is compatible with the original purpose. If you wish to get an explanation as to how the processing for the new purpose is compatible with the original purpose, please contact us.

If we need to use your personal data for an unrelated purpose, we will notify you and we will explain the legal basis which allows us to do so.

Please note that we may process your personal data without your knowledge or consent, in compliance with the above rules, where this is required or permitted by Applicable Law.

We may share your personal data with certain third parties without further notice to you, in certain instances. We have set out some of the instances below:

Related Companies

We may share your personal data with our related companies for purposes consistent with this Policy.

Agents, Consultants and Related Third Parties

Sevenz Healthcare may engage other companies and professionals within and outside Nigeria to perform certain business-related functions. Examples of such functions include mailing information, maintaining databases. When we employ another entity to perform a function of this nature, we will only provide them with the information that they need to perform their specific function.

Legal Requirements

Sevenz Healthcare may disclose your personal data if required to do so by law or in the good faith belief that such action is necessary to (i) comply with a legal obligation, (ii) protect and defend the rights or property of Sevenz Healthcare, (iii) act in urgent circumstances to protect the personal safety of users of the services or the public, or (iv) protect against legal liability.

Business Transfers

As we develop our business, we might sell or buy businesses or assets. In the event of a corporate sale, merger, reorganization, dissolution or similar event, personal data may be part of the transferred assets.

We require all third parties to respect the security of your personal data and to treat it in accordance with the law. We do not allow our third-party service providers to use your personal data for their own purposes and only permit them to process your personal data for specified purposes and in accordance with our instructions.

In operating the Platform, we may use a technology called "cookies". A cookie is a piece of information that the computer that hosts our Website gives to your browser when you access the Website. Our cookies help provide additional functionality to the Website and help us analyze Website usage more accurately. For instance, our Site may set a cookie on your browser that allows you to access the Services without needing to remember and then enter a password more once during a visit to the Site. In all cases in which we use cookies, we will not collect Personal Data except with your permission or use information gathered for tracking purposes.

We have put in place various appropriate security procedures as set out in this policy, to prevent your personal data from being lost, used or accessed without authorisation.

• Our Platform is scanned on a regular basis for security holes and known vulnerabilities in order to make your visit to our Platform as safe as possible.
• We use regular malware scanning.
• Your personal information is contained behind secured networks and is only accessible by a limited number of persons who need to know. They have special access rights to such systems and are required to only process your personal data on our instruction and to keep the information confidential. In addition, all sensitive/credit information you supply is encrypted via Secure Socket Layer (SSL) technology.
• We have put in place procedures to deal with any suspected personal data breach and will notify you and any applicable regulator of a breach where we are legally required to do so.

10.1. Data Retention

We keep your personal and health information only as long as needed to provide your care and comply with the law. In a telemedicine setting, this means keeping consultation notes, prescriptions, diagnostics and related billing records for the duration of your treatment and any required follow-up. We consider factors like the type and sensitivity of the data, the purpose of processing, and the risk of misuse when deciding how long to retain records. For example, we retain data as long as we have a lawful basis to do so – only while it is needed for your care or as required by regulations. If a dispute, audit or legal issue arises (e.g. a complaint or litigation), we may retain the relevant data longer to resolve it. Once the data is no longer needed for your care or any legal requirement, we will securely delete it or irreversibly anonymise it so it can't be linked back to you.

• Retention criteria: We use only the minimum retention period necessary. Our team reviews records and deletes any data that are no longer needed or where we no longer have a lawful basis to keep them. We follow legal and professional guidelines – for example, UK health guidance generally requires keeping adult medical records about 8–10 years after treatment, and Nigeria's NDPA explicitly mandates deleting data once its lawful basis ends.
• Legal and regulatory requirements: Certain laws or regulations may obligate us to keep data longer (for tax, accounting, or safety reasons). We keep some information for these purposes only as long as required. Backup copies may exist briefly for disaster recovery, but they are automatically purged or rendered unusable after a short time.
• Your rights: You have the right to request access to, correction of, or deletion of your personal and health data. For example, you can ask us to erase your data (the "right to be forgotten"), except where the law requires us to retain certain records. We will honour such requests promptly unless a legal obligation prevents us from doing so. (You can find more detail on your rights in the "Your legal rights" section below.)
• Anonymisation: When we delete data, we remove all identifiers so it can no longer identify you. In some cases we may use anonymised (de-identified) data for research, training or statistics. Since anonymised information can't be traced back to an individual, we may keep and use it indefinitely.

In summary, we retain your telemedicine records only for as long as necessary for your care or to meet legal requirements. After that, we delete or de-identify the data. This helps ensure your privacy and complies with healthcare data laws. For exact retention periods (which can vary by record type and jurisdiction), you can request our data retention policy.

Under certain circumstances, you have rights under the Applicable Laws in relation to your personal data.

You have the right to:

11.1. Request access to your personal data (commonly known as a "data subject access request").

This enables you to receive a copy of the personal data we hold about you and to check that we are lawfully processing it.

11.2. Request correction of the personal data that we hold about you

This enables you to have any incomplete or inaccurate data we hold about you corrected, though we may need to verify the accuracy of the new data you provide to us.

11.3. Request erasure of your personal data

This enables you to ask us to delete or remove personal data where there is no good reason for us continuing to process it. You also have the right to ask us to delete or remove your personal data where you have successfully exercised your right to object to processing (see below), where we may have processed your information unlawfully or where we are required to erase your personal data to comply with local law. Note, however, that we may not always be able to comply with your request of erasure for specific legal reasons which will be notified to you, if applicable, at the time of your request.

11.4. Objecting to Process your personal data

Object to processing of your personal data where we are relying on a legitimate interest (or those of a third party) and there is something about your particular situation which makes you want to object to processing on this ground as you feel it impacts on your fundamental rights and freedoms. You also have the right to object where we are processing your personal data for direct marketing purposes. In some cases, we may demonstrate that we have a compelling legitimate basis to process your information which overrides your rights and freedoms.

11.5. Request restriction of processing of your personal data.

This enables you to ask us to suspend the processing of your personal data in the following scenarios:

• If you want us to establish the data's accuracy.
• Where our use of the data is unlawful but you do not want us to erase it.
• Where you need us to hold the data even if we no longer require it as you need it to establish, exercise or defend legal claims
• You have objected to our use of your data, but we need to verify whether we have an overriding legitimate basis to use it.

11.6. Request the transfer of your personal data to you or to a third party

We will provide to you, or a third party you have chosen, your personal data in a structured, commonly used, machine-readable format. Note that this right only applies to automated information which you initially provided consent for us to use or where we used the information to perform a contract with you.

11.7. Withdraw consent at any time where we are relying on consent to process your personal data

However, this will not affect the lawfulness of any processing carried out before you withdraw your consent. If you withdraw your consent, we may not be able to provide certain products or services to you. We will advise you if this is the case at the time you withdraw your consent.

If you wish to exercise any of the rights set out above, please contact us.

In the case of a breach of any of the obligations with respect to your personal data, a data breach procedure is established and maintained in order to deal with incidents concerning personal data or privacy practices leading to the accidental or unlawful destruction, loss, alteration, unauthorized disclosure of, or access to, personal data transmitted, stored or otherwise processed. On notification of such breach, Sevenz Healthcare will investigate to determine if an actual breach has occurred and Sevenz Healthcare will take such actions required to manage such breach.

In the event you believe we have breached any applicable law or this Policy, you have the right to file a complaint with the Nigeria Data Protection Commission. You may however contact our Data Protection Office to enable us to rectify such breach as soon as possible.

You can contact us at our office at 1st Floor, UAC Building, Central Business District, Garki, Abuja, FCT, Nigeria.

Email address: [email protected]

You may contact our Data Protection Office via [email protected]

Phone number: +234 (0) 817 4290 703, +234 (0) 817 4290 702