This Privacy Policy is issued in compliance with the Nigeria Data Protection Act 2023 (NDPA), the Nigeria Data Protection Regulation 2019 (NDPR), and all subsidiary legislation. ExCare Health is committed to the lawful, fair, and transparent processing of personal data.
1. Who We Are
ExCare Health (operating as ExCare Group) is a healthcare services company incorporated under the laws of the Federal Republic of Nigeria, providing pharmacy dispensing, laboratory diagnostics, vaccination services, and specialist referrals. ExCare Health is the Data Controller in respect of personal data collected through our website, branches, and service channels.
Registered address: 6b Francis Ojei Close, Chevron Alternative, Lekki Phase 3, Lagos, Nigeria
Website: excarehealth.com
Contact email: [INSERT OFFICIAL EMAIL]
Telephone: [INSERT PHONE NUMBER]
2. Scope of This Policy
This Privacy Policy applies to all personal data collected and processed by ExCare Health through:
- Our website at excarehealth.com and any related subdomains
- Our physical branch locations across Lagos and Ogun State
- Our WhatsApp, telephone, and social media customer service channels
- Our online booking and appointment systems
- Our e-commerce and pharmacy ordering platform
This Policy does not apply to third-party websites or services linked from our website.
3. Personal Data We Collect
3.1 Identity and Contact Data
- Full name, date of birth, and gender
- Home or delivery address
- Email address and telephone number
- Next of kin or emergency contact details
3.2 Health and Medical Data
- Prescription details and medication history
- Vaccination records and health screening results
- Laboratory test requests and results
- Referral letters and specialist consultation summaries
- HMO membership number and insurance plan details
3.3 Transaction and Payment Data
- Purchase history and payment records
- HMO or insurance claim information
- Delivery address and order history
3.4 Technical and Usage Data
- IP address, browser type, and device information
- Pages visited and time spent on our website
- Cookies and similar tracking technologies
4. Lawful Basis for Processing
We process your personal data only where we have a lawful basis under the NDPA 2023 and NDPR 2019:
- Contract performance — processing necessary to provide healthcare services you have requested or to fulfil a purchase
- Legal obligation — processing required to comply with Nigerian law, including healthcare regulations and reporting obligations
- Vital interests — processing necessary to protect your life or the life of another person in an emergency
- Consent — where you have given clear and informed consent for a specific purpose, including marketing communications
- Legitimate interests — processing for fraud prevention, network security, and service improvement
Health and medical data is treated as sensitive personal data under the NDPA 2023. We process such data only where explicitly necessary for the provision of healthcare services and with appropriate safeguards in place.
5. How We Use Your Personal Data
- To process and fulfil your pharmacy orders, laboratory tests, vaccination bookings, and specialist referrals
- To manage your patient record and maintain continuity of care
- To process payments and manage HMO or insurance claims
- To send appointment confirmations, prescription reminders, and service updates
- To comply with healthcare regulations, including reporting to the Pharmacists Council of Nigeria and NPHCDA
- To respond to your enquiries, complaints, and feedback
- To improve our services, website functionality, and patient experience
- To prevent fraud and protect the security of our systems
6. Sharing Your Personal Data
We do not sell, rent, or trade your personal data to third parties. We may share your personal data in the following limited circumstances:
6.1 Service Providers
We share data with trusted third-party providers who process data on our behalf, including delivery partners, payment processors, IT service providers, and laboratory reference partners. All such providers are contractually bound to process data only on our instructions.
6.2 Healthcare Partners
With your knowledge and for the purpose of your care, we may share relevant medical information with specialist physicians, hospitals, or diagnostic facilities to whom we refer you.
6.3 HMO and Insurance Providers
We share relevant claims and treatment data with your HMO solely for verifying eligibility and processing claims. Our HMO partners include AXA Mansard, Hygeia, NEM Health, Bastion Health, Total Health Trust, Reliance HMO, Avon HCM, Clearline HMO, and Wellahealth.
6.4 Regulatory and Legal Authorities
We may disclose personal data to government agencies, regulatory bodies, or law enforcement where required by law, including to the Nigeria Data Protection Commission (NDPC), the Pharmacists Council of Nigeria (PCN), or NAFDAC.
7. Data Retention
We retain personal data for as long as necessary to fulfil the purposes for which it was collected, including compliance with legal, regulatory, accounting, and reporting obligations. Medical and pharmacy records are retained in accordance with Nigerian healthcare regulations. Where data is no longer required, it is securely deleted or anonymised.
8. Your Rights Under the NDPA 2023
Subject to applicable law, you have the following rights:
- Right of access — request a copy of the personal data we hold about you
- Right to rectification — request correction of inaccurate or incomplete data
- Right to erasure — request deletion where there is no lawful basis for continued processing
- Right to restrict processing — request that we limit how we use your data
- Right to data portability — request your data in a structured, commonly used format
- Right to object — object to processing based on legitimate interests or direct marketing
- Right to withdraw consent — withdraw consent at any time without affecting prior lawful processing
To exercise any of these rights, contact us using the details in Section 11. We will respond within 30 days. We may need to verify your identity before processing your request.
9. Cookies
Our website uses cookies and similar tracking technologies to improve your browsing experience and analyse website traffic. We use:
- Strictly necessary cookies — required for the website to function
- Analytics cookies — help us understand how visitors use our website
- Preference cookies — remember your settings and choices
You can control cookies through your browser settings. Disabling certain cookies may affect website functionality.
10. Data Security
We implement appropriate technical and organisational measures to protect your personal data, including secure server infrastructure with access controls, encrypted transmission of sensitive data, restricted staff access on a need-to-know basis, staff training on data protection, and regular security reviews.
Despite these measures, no data transmission over the internet is entirely secure. In the event of a data breach that poses a risk to your rights and freedoms, we will notify you and the Nigeria Data Protection Commission as required by law.
11. Contact Us and Complaints
If you have questions about this Privacy Policy, wish to exercise your data rights, or wish to make a complaint:
ExCare Health — Data Privacy
Email: [INSERT DATA PRIVACY EMAIL]
Telephone: [INSERT PHONE NUMBER]
Address: 6b Francis Ojei Close, Chevron Alternative, Lekki Phase 3, Lagos, Nigeria
If you are not satisfied with our response, you have the right to lodge a complaint with the Nigeria Data Protection Commission (NDPC) at ndpc.gov.ng.
12. Changes to This Policy
We may update this Privacy Policy from time to time to reflect changes in our practices, services, or legal obligations. Material changes will be communicated via our website or by direct notification where appropriate.
