This policy is a starting template covering what Nigeria's Data Protection Act 2023 / NDPR generally
require a health data controller to disclose. It has NOT been reviewed by a lawyer — have one review
and adapt it (registration details, retention periods, third parties actually used) before treating
it as your official policy. Placeholder text is marked [LIKE THIS].
Last updated: July 2026
1. Who We Are
NovaCare Hospital ("we", "us", "the hospital") is a healthcare provider located
at Behind Baale house, Dada Estate, Osogbo, Osun State. We are the data controller for personal information
collected through this website and in the course of providing care.
[Add your NDPR data controller registration number here once registered with the Nigeria Data Protection Commission, if your patient volume requires registration.]
2. What We Collect
- Contact & identity: name, phone number, email, address, date of birth, gender.
- Health information: medical history, allergies, diagnoses, treatment records, prescriptions,
lab results, vital signs — collected as part of providing clinical care.
- Billing information: invoices, payment records. We do not store your card details — online
payments are processed directly by our payment providers (Paystack, Flutterwave, or Monnify,
whichever you use), not by us.
- Website usage: basic technical data (IP address, browser) collected automatically when you
use our booking or contact forms, used only for security (spam/abuse prevention) — see Section 6.
3. Why We Collect It (Legal Basis)
- To provide healthcare — consultations, diagnosis, treatment, prescriptions, lab work.
- To manage appointments and billing — scheduling, invoicing, payment processing.
- To contact you — appointment confirmations and reminders, lab results ready notices, payment
receipts, responses to enquiries you send us.
- Legal and safety obligations — record-keeping requirements for healthcare providers, and
responding to lawful requests from authorities where required.
4. Who We Share It With
We do not sell your data. We share it only where necessary:
- Clinical staff directly involved in your care (doctors, nurses, pharmacists, lab technicians)
within the hospital.
- Payment processors (Paystack / Flutterwave / Monnify) if you pay online — they receive what's
needed to process the transaction, governed by their own privacy policies.
- SMS/email providers used to send you appointment and result notifications.
- Regulators or law enforcement, only where legally required.
5. How Long We Keep It
Clinical records are retained in line with standard healthcare record-keeping practice
[state your specific retention period here — commonly 6 years after
last treatment for adults in many jurisdictions, longer for minors; confirm the applicable
Nigerian requirement with your legal advisor]. Website enquiry messages not converted into a
patient record are retained for a limited period and then deleted.
6. Website Forms & Spam Protection
Our appointment booking and contact forms use basic anti-spam measures (a hidden field bots fill in
but humans don't, and a submission-speed check) to keep the system usable. We also keep a short-term
log of submission attempts by IP address purely to prevent abuse — this log is not used for any
other purpose and is not linked to your care record.
7. Your Rights
Under the Nigeria Data Protection Act, you generally have the right to:
- Know what personal data we hold about you and why.
- Request a copy of your data.
- Request correction of inaccurate data.
- Request deletion, where we are not legally required to keep it (note: we cannot delete active
clinical records we are legally obligated to retain).
- Withdraw consent for non-essential communications (e.g. promotional messages, if we ever send any).
To exercise any of these rights, contact us using the details below.
8. Security
We restrict access to patient records to authorized staff only, based on their role. Sensitive
clinical notes may be encrypted in storage. We recommend you also protect your own account/portal
password and do not share it with anyone.
9. Contact Us
Questions about this policy or your data:
NovaCare Hospital
Behind Baale house, Dada Estate, Osogbo, Osun State
Phone: 0806 406 7557
Email: info@novacarehospital.ng
