Privacy Policy — WellNaija

1. Who Operates WellNaija

WellNaija operates a telemedicine and digital healthcare platform in Nigeria that connects patients with licensed healthcare professionals. Pending legal review, the registered legal entity, business address, and official dedicated contact details will be published here before public launch.

2. Information We Collect

We collect the information needed to operate the platform. Not every category applies to every user. This includes:

Account and contact information — full name, email address, and phone number used to create and secure your account.
Profile information — gender, date of birth or age, address, and a profile photo if you choose to add one.
Professional information — for healthcare professionals: designation, specialization, practice or hospital affiliation, professional biography, licence information, and verification documents.
Verification information — documents you upload so we can review professional credentials.
Patient medical information — health information you choose to provide, such as medical history, current medications, allergies, lifestyle, vitals, and emergency contact details.
Consultation information — records of consultations, including the professional involved, dates, and status.
Clinical notes — notes and records created by your treating professional during consultations.
Messages — chat messages exchanged during consultations, which are stored to provide the service.
Call metadata — metadata about audio and video consultations, such as call time, duration, and outcome. Call media is transmitted via the Agora service and is not retained by us by default.
Wallet and transaction information — wallet balance, transaction history, payment references, amounts, and statuses.
Ratings and reviews — reviews you submit and aggregate ratings connected to your account.
Notifications — notification preferences and device push tokens where you enable push notifications.
Pharmacy information — where pharmacy services are used, pharmacy profile details, medicine listings, inventory, and order information.
Health-program information — information submitted through optional health tools on the platform that you control.
Technical information — device and browser information and technical logs necessary to operate and secure the service.

3. How Information Is Collected

Information is collected when:

You create an account and complete your profile.
You add health information, send messages, fill in forms, or submit reviews.
You participate in consultations.
The platform automatically records technical information as you use it.
Service providers, such as Paystack, confirm payment status so we can credit your wallet.

4. Why We Collect Information

We use your information to provide the platform and its services, including to:

Create and manage your account and verify your identity and role.
Enable you to find professionals and manage consultations.
Operate consultations and related wallet transactions.
Store and display your health records.
Verify professional credentials.
Process payments and withdrawals through Paystack.
Send account, consultation, payment, and safety notifications.
Operate, secure, and improve the platform and comply with law.

5. Who May Receive or Access Information

We do not sell your personal information. We share information only as needed to operate the service:

Professionals treating you — your chosen professional and the care team for an active consultation can access the information needed for your care.
WellNaija staff and administrators — to support the platform and users, verify credentials, and administer the service, subject to access controls.
Payment providers — Paystack processes and manages payments and receives the information necessary for that purpose under its own policies.
Infrastructure providers — providers such as Supabase (database, authentication, storage) and Agora (calls) may process data to provide their services. Data may be processed on servers outside Nigeria.

6. How Professionals Access Patient Information

A professional can access your information only as part of an active consultation with you. Access is scoped to what is needed for care. Once a consultation is completed or terminated, this access is limited in accordance with the access controls in place.

Two categories of health information are treated differently: patient-controlled biodata — the profile and health information you control and may edit; and doctor-controlled clinical notes — clinical notes created by a professional during care, which you can view but not edit.

7. Payment Providers

Payments are processed by Paystack. When you fund your wallet, you direct the transaction to Paystack, which may collect payment details under its own privacy policy. WellNaija receives confirmation of payment status and credits your wallet only based on verified payment events.

8. Infrastructure and Third-Party Providers

WellNaija relies on service providers to host and operate the platform. Supabase provides database, authentication, and storage; Agora provides real-time communication. These providers may store data on servers outside Nigeria, and their applicable terms and privacy policies may apply to your use of their services.

9. Data Retention

We retain data as long as needed to provide the service, comply with legal obligations, resolve disputes, and enforce agreements:

Account information is retained while your account is active.
Clinical and health records are retained for the period required by applicable healthcare regulation.
Transaction history is retained for the period required for accounting, tax, and fraud-prevention purposes.
Support records are retained for as long as needed to resolve issues.

Where you request deletion, we remove personal data we no longer have a legal obligation or legitimate reason to keep. Some records may be retained where required by law, accounting, safety, or operational obligations.

10. Security Safeguards

We take reasonable technical and organizational measures to protect your information, including access controls, secure authentication, and user-scoped data access rules. Health information receives additional protection under these controls. No security system is impenetrable, and we cannot guarantee absolute security.

11. Your Rights

Under Nigeria's data protection laws, including the Nigeria Data Protection Act 2023, you have rights that include:

Access — view your data on your dashboard or request a copy.
Export — download your data from Settings.
Rectify — correct inaccurate information via your profile or by asking us.
Erase — request deletion of your account and associated data where legally and technically applicable.
Withdraw consent — withdraw consent to consent-based processing at any time.
Object — object to processing in the circumstances recognised by law.
Complain — lodge a complaint with the Nigeria Data Protection Commission.

We aim to respond to data subject requests within 30 days. Where a request conflicts with a legal obligation to retain data, we may not be able to honour it in full.

12. Consent and Lawful Processing

We process personal information based on lawful grounds, including performance of the contract with you (providing the service), our legitimate interests (operating and securing the platform), compliance with legal obligations, and consent where we rely on it. Where consent is the basis, you may withdraw it at any time without affecting processing that occurred before withdrawal.

13. Cookies and Local Storage

We use essential cookies to keep you signed in, remember your privacy preferences, and securely restore your session. The platform also uses browser local storage to preserve your session and preferences. We do not use third-party advertising or tracking cookies. Declining essential cookies may affect features such as staying signed in.

14. Children and Minors

WellNaija is intended for users who are at least 18 years of age or the applicable age of majority. We do not knowingly collect personal information from children. If you believe a minor has provided us with personal information without consent, please contact us.

15. International Transfers

Because we use cloud infrastructure providers, your data may be stored or processed on servers outside Nigeria. Where data is transferred to another jurisdiction, we rely on the provider's safeguards and applicable legal mechanisms.

16. Data Breach Response

We take reasonable steps to detect and respond to security incidents. Where a breach is likely to result in a risk to your rights, we will notify you and the relevant supervisory authority as required by applicable law.

17. Changes to This Policy

We may update this Privacy Policy. Material changes will be reflected by an updated effective date and, where appropriate, notified through the platform or by email. Continued use after changes take effect constitutes acceptance of the updated policy.

18. Contact

For data protection queries or requests, contact our support team through the support channels in the app or by email to support@wellnaija.ng. Pending legal review, a dedicated data protection contact will be published here before public launch.