Privacy Policy & Health Data Protection
How Virtual Doctors Africa and SurroTrak Health Technologies Limited collect, process, safeguard, and respect personal data and electronic health records in accordance with the Nigeria Data Protection Act 2023 and African health standards.
1. Data Controller & Data Protection Officer (DPO)
This Privacy Policy applies to the digital telemedicine platform Virtual Doctors Africa, accessible via virtualdoctors.ng, app.virtualdoctors.ng, affiliated mobile applications, and Care Point kiosks.
The Data Controller responsible for your personal data and health information is SurroTrak Health Technologies Limited, registered under the laws of the Federal Republic of Nigeria.
SurroTrak Health Technologies Limited has appointed a certified Data Protection Officer overseeing privacy compliance, statutory audits with the Nigeria Data Protection Commission (NDPC), and handling data subject inquiries.
Direct Contact: [email protected]
2. Categories of Data Collected
Depending on your user role on the Platform, we collect and process the following categories of information:
- Identity & Contact: Full name, telephone number (standardized E.164), email address, gender, date of birth, residential state, city, and optional physical address.
- Electronic Health Records (EHR): Medical complaints, symptoms, triage questionnaire answers, vital signs, existing medications, known drug allergies, past medical/surgical history, clinical consult summaries, digital prescriptions, and diagnostic lab results.
- Emergency & Guardian Info: Designated emergency contacts, and parent/guardian information for minor dependents.
- Professional Credentials: Full name, MDCN registration number, medical school qualifications, postgraduate fellowships, years of clinical experience, specialization, consultation fees, digital signature specimen, and valid practicing licenses.
- Practice Logistics: Availability schedules, bank account details for consultation disbursements, and patient review ratings.
- Facility Governance: Registered business name, CAC registration number, PCN pharmacy premise license, MLSCN laboratory certification, physical address, geolocation coordinates, and designated Superintendent Pharmacist / Laboratory Scientist credentials.
- Fulfillment & Referral Records: Prescription fulfillment logs, diagnostic test requisition statuses, and hospital admission referral slips.
- Device & Telemetry: IP addresses, browser user-agent, operating system, login timestamps, and referral attribution codes.
- Payment References: Transaction reference IDs and receipts from authorized payment processors (Paystack, Flutterwave, or bank transfer slips). We never store credit card CVV or full PAN numbers.
3. Lawful Basis for Processing under NDPA 2023
Under Section 25 of the Nigeria Data Protection Act 2023, processing of personal data must be anchored on a recognized legal ground. We process your data based on:
- Explicit Consent (NDPA Section 25(1)(a)): When registering, you provide affirmative consent for us to store your electronic health profile, facilitate virtual consultations, and transmit prescriptions or lab requests to your chosen healthcare providers.
- Performance of a Contract (NDPA Section 25(1)(b)): Processing is necessary to deliver booked medical appointments, manage active subscription plans, issue verified e-prescriptions, and process referral commissions.
- Vital Interests of the Data Subject (NDPA Section 25(1)(d)): Processing medical details when necessary to protect the life or physical integrity of a patient during clinical escalation.
- Compliance with Legal & Health Regulations (NDPA Section 25(1)(c)): Mandatory statutory recordkeeping required by the Medical and Dental Council of Nigeria (MDCN), Pharmacy Council of Nigeria (PCN), and tax authorities.
4. Video, Audio & Real-Time Consultation Privacy
- No Secret Recording: We do NOT passively record, store, or monitor real-time video or audio streams on our servers. The live consultation stream is ephemeral and ceases immediately when the session ends.
- Room Code Security: Consultation rooms utilize isolated, cryptographically generated room codes with host doctor admission controls and guest waiting rooms to prevent unauthorized eavesdropping.
- Clinical Summaries: What is permanently retained in your electronic health record is the written clinical summary, diagnosis, vitals, and prescription entered by the doctor following standard medical documentation protocols.
5. Data Sharing & Third-Party Disclosures
We strictly protect the confidentiality of medical information. We share your data ONLY under these authorized circumstances:
- With Your Consulting Healthcare Professional: The doctor assigned to your appointment receives access to your profile, symptoms, triage history, and prior consultation notes to provide informed clinical care.
- With Chosen Partner Pharmacies or Labs: If a prescription or lab test is issued, and you elect to route fulfillment through a network partner, only the necessary clinical details (medication name, dosage, lab tests ordered) and delivery address are shared.
- Payment Gateways: Name, email, and transaction amount are transmitted via encrypted TLS to certified payment aggregators (Paystack, Flutterwave) for payment verification.
- Statutory Disclosures: We may disclose data if formally subpoenaed by a court of competent jurisdiction in Nigeria, or mandated by statutory public health reporting requirements (e.g. notifiable infectious disease outbreaks per NCDC directives).
- ABSOLUTE PROHIBITION ON DATA SELLING: Virtual Doctors Africa has never sold, and will NEVER sell, lease, or monetize your health data, personal details, or consult transcripts to insurance companies, data brokers, or advertising networks.
6. Technical, Administrative & Physical Security
We implement comprehensive organizational and technical security safeguards:
- Encryption Standards: Data in transit is secured with TLS 1.3 / SSL encryption. Sensitive database fields are protected with AES-256 cryptographic hashing.
- Role-Based Access Control (RBAC): Administrative staff, receptionists, and coordinators are restricted by granular permission boundaries; non-clinical personnel cannot view private clinical consultation notes.
- Automated Session Security: Anti-CSRF protection, secure cookie flags, and automated timeout sessions prevent unauthorized session hijacking.
- Audit Logging: All medical record views, updates, and prescription issuances generate immutable audit logs with timestamps and user identifiers.
7. Electronic Health Record Retention Policy
Healthcare regulations require the preservation of clinical medical records for patient safety and clinical continuity:
- Adult Medical Records: In compliance with Nigerian health guidelines, electronic medical histories, prescriptions, and consult summaries are retained for a minimum of seven (7) years from the date of the last medical consultation.
- Pediatric / Minor Records: Records for patients who were minors at the time of consultation are retained until the individual reaches twenty-five (25) years of age (seven years past the age of majority), in accordance with pediatric medico-legal standards.
- Account Deletion: If a user requests account deletion, non-clinical personal data (marketing preferences, cookies) is removed immediately, while statutory clinical records are archived in secure, access-restricted cold storage until the statutory retention period lapses.
8. Your Data Subject Rights under NDPA 2023
As a data subject in Nigeria or participating African states, you possess statutory rights enforceable against the Data Controller:
- Right of Access (NDPA Section 34): You have the right to request a copy of the personal data and medical records we hold about you.
- Right to Rectification (NDPA Section 35): You may request correction of any inaccurate or incomplete personal contact details through your dashboard profile settings.
- Right to Data Portability (NDPA Section 38): You may download your digital health record summaries and electronic prescriptions to share with another healthcare provider.
- Right to Restrict or Object (NDPA Section 36): You may object to the processing of your data for promotional marketing or affiliate tracking at any time.
- Right to Lodge a Complaint: If you believe your data has been handled in breach of the NDPA 2023, you have the right to lodge a complaint directly with the Nigeria Data Protection Commission (NDPC) at [email protected] or via ndpc.gov.ng.
9. Children & Minor Privacy Protections
Virtual Doctors Africa takes stringent precautions regarding minors (individuals under 18 years of age):
- No child may register an independent account. Minor patients must be registered as dependents under a verified parent or legal guardian account.
- In compliance with Section 31 of the NDPA 2023, consent for the processing of a child’s health data must be explicitly granted by the parent or legal guardian.
11. Cross-Border Data Transfers & African Health Networks
Where telehealth consultations involve international specialist second opinions or pan-African partner facilities across West or East Africa:
Any cross-border transfer of personal data complies strictly with Part VIII of the Nigeria Data Protection Act 2023, requiring that the recipient jurisdiction provides adequate data protection standards or that the transfer is governed by Standard Contractual Clauses (SCCs) guaranteeing equivalent data protection.
12. Contact the Privacy Team & DPO
To exercise any of your data rights, request medical record exports, or report a suspected privacy concern, please contact:
SurroTrak Health Technologies Limited
Email: [email protected] / [email protected]
General Support: [email protected]
Lagos, Nigeria