1. Who We Are Data Controller
CareHinge is operated by CareHinge Limited, a company registered in Nigeria under the Corporate Affairs Commission (CAC). We are the Data Controller for the personal information you provide through our platform.
🏢 Company Details:
Name: CareHinge Limited
Address: Abuja, Federal Capital Territory, Nigeria
Data Protection Officer: privacy@carehinge.com.ng
2. What Data We Collect 📋
We collect and process the following categories of personal data to provide our telemedicine services:
| Data Type |
Purpose |
Legal Basis |
Retention |
Identity Data
(Name, phone, email, date of birth, gender) |
Account creation, authentication, communication |
Contract performance |
Duration of account + 1 year |
Health Data
(Symptoms, medical history, vitals, complaints) |
AI triage, doctor consultation, diagnosis |
Consent (explicit) |
5 years (medical record retention) |
Clinical Data
(Lab results, imaging reports, prescriptions) |
Diagnostic support, treatment planning |
Consent (explicit) |
5 years (medical record retention) |
Payment Data
(Transaction ID, amount, payment method) |
Process consultation fees, refunds |
Contract performance |
7 years (FIRS requirement) |
Technical Data
(IP address, device info, browser type) |
Security, fraud prevention, platform optimization |
Legitimate interest |
90 days |
🔒 Sensitive Health Data: Your health information is treated as sensitive personal data under the Nigeria Data Protection Act (NDPA) 2023. We only process this data with your explicit consent, which you provide when creating an account and during consultations.
3. AI Processing 🤖
We use artificial intelligence (Google Gemini API) to assist doctors with symptom triage and clinical decision support. Here is how we protect your data:
- Anonymization: Only anonymized clinical data is sent to Google — specifically symptoms, age range, and non-identifying clinical notes.
- No Identifiers: We never share patient names, phone numbers, email addresses, national IDs, or any direct personal identifiers with Google.
- Data Processing Agreement: Google processes data under a strict Data Processing Agreement (DPA) with CareHinge Limited, ensuring compliance with Nigerian data protection laws.
- No Automated Decisions: AI outputs are always reviewed by a licensed doctor before any medical decision is made. You have the right not to be subject to automated decision-making.
📊 Training Data: Anonymized consultation data may be used to improve our AI models. You can opt out of this by contacting our Data Protection Officer. No identifiable patient data is used for training.
4. WhatsApp Communications 📱
We use Meta WhatsApp Business API to deliver important healthcare communications where you have given consent:
- Digital Prescriptions: Your approved prescriptions are sent via WhatsApp for convenience.
- Drug Reminders: Automated reminders at scheduled dose times.
- Follow-up Messages: 48-hour health check-ins after consultations.
- Appointment Confirmations: Booking and reminder notifications.
⚠️ Important: WhatsApp is a third-party service. While we minimize sensitive information in messages, you should review
WhatsApp's Privacy Policy. You can opt out of WhatsApp messages at any time by replying "STOP" or updating your notification preferences in the app.
5. Your Rights Under NDPA 2023 ⚖️
The Nigeria Data Protection Act (NDPA) 2023 grants you the following rights regarding your personal data:
Right to be Informed
You have the right to know how we use your data
Right of Access
Request a copy of your personal data
Right to Rectification
Correct inaccurate or incomplete data
Right to Erasure
Request deletion of your data ("right to be forgotten")
Right to Restriction
Limit how we process your data
Right to Portability
Receive your data in a portable format
Right to Object
Object to certain types of processing
No Automated Decisions
Right not to be subject to automated decision-making
✉️ To exercise any of these rights: Contact our Data Protection Officer at privacy@carehinge.com.ng. We will respond within 30 days as required by law. There is no fee for reasonable requests.
6. Data Security 🔐
We implement robust security measures to protect your personal and health information:
- Encryption: All data is encrypted at rest and in transit using TLS 1.3 encryption.
- Access Controls: Strict role-based access control — only authorized clinicians and staff can access identifiable medical records.
- Audit Logs: Comprehensive audit trails track all access to patient data.
- Regular Testing: We conduct regular security assessments and vulnerability scans.
- Data Minimization: We only collect data necessary for providing healthcare services.
🔒 Breach Notification: In the event of a data breach affecting your personal information, we will notify you and the Nigeria Data Protection Commission (NDPC) within 72 hours as required by law.
7. Cookies 🍪
CareHinge uses minimal cookies to ensure platform functionality:
- Session Cookies: Essential for maintaining your authenticated session while using the platform.
- Preference Cookies: Remember your language and notification preferences.
- No Tracking: We do not use cross-site tracking cookies, advertising cookies, or third-party analytics cookies that track you across other websites.
You can disable cookies in your browser settings, but this may affect platform functionality.
8. Changes to This Policy 📝
We may update this Privacy Policy from time to time to reflect changes in our practices, legal requirements, or platform features.
- Minor Changes: Will be posted on this page with an updated "Last Updated" date.
- Material Changes: We will notify you via email or in-app notification at least 14 days before changes take effect.
- Your continued use of CareHinge after changes constitute acceptance of the updated policy.
