Privacy Notice

1. Introduction

Provita Clinical Services Limited ("Provita") is a health service provider committed to protecting the confidentiality, integrity, and security of personal and health information entrusted to it.

This Privacy Notice explains how we collect, process, store, and share personal data in compliance with the Nigeria Data Protection Act (NDPA) 2023, NDPA General Application and Implementation Directive (GAID) 2025, applicable international laws, and HIPAA principles where applicable.

2. Categories of Data Collected

Visitors to our website can access every area of our website, without having to disclose any personal data. However, we may collect information captured in our web logs, such as device information (e.g. device brand and model, screen dimensions, etc.), unique identification numbers (e.g. IP address and device ID), browser information (e.g. URL, browser type, pages visited, date/time of access), website traffic and pages viewed, behavioral information, and other information about how you interacted with our website.

During our business relationship with you, we may collect certain personal data that can be used to contact, identify you or for performance of our obligation. Personal data may include, but is not limited to:

1. Personal Identification Data such as name, surname, ID card number, face image, gender, date of birth, passport number or other identifiable numbers.
2. Contact Information such as address, telephone number, e-mail address.
3. Health Information (Sensitive Data) such as treatment information, reports about physical or mental health condition, health cares of service receivers, laboratory test results, diagnosis, diagnostic disease, information about drug use and drug allergy, history of food allergy, blood result, laboratory result, pathological result, radiological images and radiological report, list of prescribed medication, necessary information for medical services, information of feedback and treatments.
4. Payment & Financial Data such as billing information, credit or debit information, receipt information, invoice information.

3. Purpose of Processing

Our purpose of collecting data includes provision of care, record keeping, billing, compliance, and service improvement.

Our use of your personal data is limited to that which is reasonably required to provide our service to you and make improvements to that service that benefit both us and you. We do not use your personal data for any reasons not stated in this Privacy Notice and never use it in an excessive manner that is disproportionate to our aims of providing and improving our service or in a way that is contrary to your interests.

4. Legal Basis

Processing your data is done based on contractual performance, consent, medical necessity, legal obligations, public interest, and legitimate interests:

5. HIPAA Alignment

We implement safeguards including restricted access, encryption, and minimum necessary data use as relates to health regulatory and medical standards.

7. International Transfers

Provita is based in Nigeria and we store and process your personal data on our computers in Nigeria and in any other place where the parties involved in the processing are located. It means that this information may be transferred to — and maintained on — computers located outside Nigeria or other governmental jurisdiction where the data protection laws may differ than Nigeria.

8. Data Security

We take precautions to protect your information. When you submit sensitive information via the web platform, your information is protected both online and offline via data transit and data storage encryption.

Wherever we collect sensitive information, that information is encrypted and transmitted to us via secure channels. While we use encryption to protect sensitive information transmitted online, we also protect your information offline. Only designated employees who need the information to perform a specific job (for example, billing or customer service) are granted access to personally identifiable information.

The servers on which we store personally identifiable information are highly secure with state-of-the-art information security measures in place.

9. Data Retention

Data is retained only as long as necessary and securely deleted thereafter. Below are our guidelines regarding how data is stored:

1. Personal data will be processed lawfully and in a transparent manner;
2. Personal data will be processed for a specific purpose and not in a way which is incompatible with the purpose which we have collected it;
3. Personal data is adequate, relevant and limited to what is necessary in relation to the purposes for which it is processed;
4. Personal data will be kept accurate and, where necessary, kept up to date;
5. Personal data will not be kept for any longer than is necessary for the purposes for which it is processed;
6. Appropriate steps will be taken to keep personal data secure.

10. Your Rights as a Data Subject

Here is something we have not told you yet: because we determine the purposes for and the way your personal data may be processed, we are regarded as a data controller.

As a data subject, the law vests you with certain rights — they include the right to:

1. Access personal data we hold about you by requesting for a copy of the personal data we hold about you.
2. Rectify such information where it is inaccurate.
3. Restrict the processing of your personal data in certain circumstances e.g. restriction of processing for marketing purposes.
4. Object to the processing of your personal data for any reasons permissible under the extant legislation.
5. Withdraw your consent.
6. Request the erasure of your personal data (also known as the right to be forgotten).
7. Request the portability of your data; and
8. Lodge a complaint with a relevant authority, where you have reason to believe that we have violated the term(s) of this Privacy Notice.

11. Information Sharing with Third Parties

Occasionally, we may share your personal data with third-party service providers. We also share data with third parties during business including:

We share with our business partners, medical consultants, to provide medical service;

1. If you give your explicit consent;
2. If we must complete a contract on your behalf;
3. If your life or life of another is at stake;
4. If there is a legal obligation on us to share such data under existing laws and regulations. We may disclose your personal data in good faith and belief that such action is necessary to:
   1. Comply with a legal obligation;
   2. Prevent or investigate possible wrongdoing in connection with the service;
   3. Protect the personal safety of users of our services or the public; and
   4. Protect against legal liability.

12. How do I withdraw my consent?

If after you opt-in, you change your mind, you may withdraw your consent to the continued processing of your personal data or if you have any issues, concerns, wish to exercise any of your rights, then please contact our Data Protection Officer at dataprotection@provitaclinic.com

13. Changes to Our Privacy Notice

We will continually assess our privacy and data protection practices to ensure that your privacy is guaranteed. To this end, we may amend this Privacy Notice at any time. If changes are made, we will indicate at the top of this Privacy Notice when it was most recently updated or send you a notification that the Notice has been updated. Your continued use of our online channels or services will signify that you agree to any such changes. Please be assured that we will not use any previously collected personal data, to the extent that it is not collected under the new privacy notice, in a manner materially different than represented at the time it was collected.

14. Contact Us

Address: Number One Lagos, 1, Akin Adesola Street, Victoria Island, Lagos, Nigeria
Email: info@provitaclinic.com
Phone: 08055553074