Privacy Notice

This Privacy Notice (“Notice”) describes our practices regarding your personal information. By accessing and using the Website and Services you agree to processing as described here. If you need clarity, contact us via the details at the end of this Notice.

Overview

We receive and collect data you provide directly, data from your devices, and data you provide to third parties who have permission to share it with us. Types collected depend on whether you are a visitor, customer, merchant or other user.

When we collect information

• You access, register or sign up to our Services
• You visit, use, or interact with the Website or Services
• You visit our offices, agent shops or physical events (identification, events management, security)
• You contact support, live chat or social media
• You participate in marketing/promotional activity or surveys
• You subscribe to newsletters or updates about Services
• You submit personal data for any other Service-related reason

We also automatically collect technical information on visits (e.g. IP address, pages viewed) to understand interests and improve services.

Information we collect

• Identifying: full name, ID number, age, DOB, gender, social profiles, marital status, image.
• Contact: mobile, state of residence, residential/business address, email.
• Account: user ID, username, password, preferences, transaction history/details, feedback, survey responses, usage.
• Technical: device type, unique device identifiers (IP, IMEI/serial, SIM, etc.), login info, browser/OS, time zone, plug-ins, network, products viewed/searched, response times, errors, interaction.
• Financial: bank details, BVN, wallet deposit/withdrawal transactions.
• Location: device location and delivery details.
• Medical: history, prescriptions, lab reports, vitals, appointment/consultation notes, provider notes, order details.

Sensitive Personal Information

As defined by the Nigeria Data Protection Commission (race, ethnic origin, genetic/biometric, religious/philosophical/ political opinions, health status, sex life, trade union membership, etc.). We collect/process health status and medical history to facilitate medical and health-related Services.

Cookies & similar technologies

We use cookies, beacons, SDKs and analytics to authenticate users, prevent fraud, store preferences, analyse campaigns and traffic, personalise content and provide Services. They may collect mobile network, IP, OS, Device ID, pages viewed, links tapped and related actions. You may disable non-essential cookies, but some Services may be limited. See our Cookies Notice.

Web analytics

We use services such as Google Analytics to collect anonymised data (visit frequency, pages, referral sites) for reports on usage. Some providers may use data to contextualise/personalise their own ad networks.

We collect, use and store data to provide, promote, maintain, personalise and improve the Website and Services — including medical/social and other health-related products and services — to develop new products, and to protect us, partners and users from fraudulent/illegal activity.

Specific purposes include:

• Conclude and fulfil the Terms with you
• Establish, personalise and maintain your account
• Maintain safety, security and integrity (authenticate identity, account security, fraud detection)
• Fulfil your requests on the Website/Services
• Assess compliance with Terms, respond to claims or rights-violation concerns
• Understand needs and communicate changes/upgrades
• Personalise experience and content (including advertising/messaging campaigns)
• Customer support, contests/surveys, winner notification and prizes
• Legal obligations, claims/disputes investigation, and business-partner contractual obligations
• Marketing (with consent), including tailored advertising
• Internal operations: analysis, development, improvement, testing, research, security, data analysis
• Verify users/providers; facilitate appointments/consultations; coordinate pharmacy orders and lab bookings; route delivery/payment; manage wallet; maintain patient history; enable remote monitoring; premium/Health QR; HMO/insurance packages
• Fraud and transaction monitoring for suspicious behaviour/patterns
• Customer Due Diligence, AML/CFT, KYC and other regulatory compliance
• Establish, exercise and defend legal claims; investigate violations/fraud; protect rights/property/safety

Data is used only for purposes identified above; secondary purposes must be compatible with the initial purpose or separately disclosed with consent where required.

We may disclose data to:

• QuickMedic employees, contractors, consultants, associates, suppliers, agents and affiliates for the purposes above
• Service providers: hosting, cloud storage, software/dev, support/security, analytics, customer support, banking/payment/reconciliation, couriers, independent auditors
• Independent healthcare providers, pharmacies, laboratories, HMOs, insurers, logistics/payment/wallet partners, professional advisers, prospective investors/acquirers and others necessary to provide the platform, comply with law, protect users, enforce terms or complete a corporate transaction
• Fraud prevention and KYC/AML verification providers
• Marketing providers: agencies, email/marketing tools, social platforms (e.g. Facebook, Google) and analytics
• Regulators, courts and similar bodies to comply with law, enforce contracts, respond to process, assist law enforcement, protect rights/property/safety
• Prospective investors/acquirers and counterparties in a reorganisation or acquisition of assets/shares/management

Outside the above, sharing with third parties requires your express consent. We contractually require recipients to protect data consistent with this Notice, the NDPA 2023 and applicable regulations.

We process data fairly, transparently and lawfully — only for identified purposes, accurately, no longer than necessary, and with appropriate technical/organisational security.

We may contact you with marketing about products, services or surveys. You have the right to object/opt out; transactional and service messages about our ongoing relationship may still be sent. Notification permissions are requested separately — Services still work if you decline.

We make commercially reasonable efforts to keep data accurate. You are primarily responsible for ensuring submissions are accurate, complete and current, and for notifying us of changes. We may verify information via trusted third parties and may ask for document copies. Please keep us informed of changes during your relationship with us.

• Access & portability: request access/copies in machine-readable format; request transfer to a third party where technically feasible.
• Rectification: correct inaccurate/out-of-date data; complete incomplete data.
• Erasure (right to be forgotten): request deletion, subject to limits (investigations, subsisting contracts, criminal records, financial/tax compliance, legal claims). For marketing opt-outs, a core suppression record may be retained.
• Object: object to marketing and, unless another lawful basis applies, to processing based on legitimate interest.
• Be informed: know how data is collected and processed.
• Withdraw consent: withdraw at any time; processing ceases where consent was the sole basis (prior processing remains lawful).

Exercising your rights

Contact our Data Protection Officer at michaelbaloguna@gmail.com. Where legal/regulatory duties prevent compliance, we will explain why. We aim to resolve complaints about rights within 72 hours.

If exercising rights via your account is difficult, contact support at michaelbaloguna@gmail.com; for security you may be asked to confirm via login. You may also complain to the Nigeria Data Protection Commission; we will help you contact the regulator if needed.

You consent when you access our platforms or use our services, content, features or technologies on the Website or other digital platforms.

We retain data for the duration of your QuickMedic account and thereafter only as necessary/permitted/required — no longer than the period for expiry of claims — for:

• Compliance with applicable laws
• Establishment, exercise or defence of legal claims and compliance with judgments/decisions of public authorities
• Research and analytics (anonymised)
• Account maintenance per termination provisions

After cancellation/termination, your account and related personal data/information is deleted and not available on re-subscription, except where retention is required for a legitimate legal purpose under applicable law.

Where processing is based solely on consent, we process only while consent is valid and to the extent necessary for the permitted/required purposes.

Where appropriate we encrypt, pseudonymise, anonymise and/or segregate information to avoid unnecessary identification and enhance security.

We take reasonable steps and maintain technical/operational measures to protect information from unauthorised access, loss or destruction, restrict access on a need-to-know basis and require staff and third parties to meet security standards. We maintain breach procedures including notification to you and the regulator where necessary. Keep your passwords confidential and do not share them.

From time to time we may transfer personal information outside Nigeria (e.g. offshore cloud storage or foreign service providers).

Conditions of transfer

• Recipient country offers the same level of protection
• Due diligence shows the recipient has a comprehensive protection framework, principles and practices ensuring continuity of protection
• Recipients agree to contractual data-protection clauses/agreements

By using the Services you consent to cross-border transfers on the above conditions.

Technology and regulation change, so we may update this Notice from time to time. The most recent version will always be on the Website. Where this Notice conflicts with the Terms and Conditions, this Notice prevails.