Privacy Policy

1. Who We Are

WelliRecord Ltd is a health technology company registered in Nigeria. We operate wellirecord.com — a patient-owned electronic health vault that allows individuals to securely store, manage, and share their medical records. Our registered office is in Abuja, Federal Capital Territory, Nigeria.

2. Data We Collect

We collect only what is necessary to deliver our services:

• Identity data: full name, date of birth, NIN (where provided), gender
• Contact data: email address, phone number, home address
• Health data: medical records, lab results, prescriptions, diagnoses uploaded by you or your care providers
• Usage data: login timestamps, pages visited, features accessed
• Device data: IP address, browser type, operating system

3. How We Use Your Data

• To create and maintain your Health Vault
• To facilitate sharing of records with care providers you explicitly authorise
• To send transactional notifications (appointment reminders, access alerts)
• To improve platform security and detect fraud
• To comply with Nigerian law, including the Nigeria Data Protection Act (NDPA) 2023 and the Nigeria Health Records Officers Act

We do not sell, rent, or broker your health data to insurers, employers, pharmaceutical companies, or any third party for commercial purposes.

4. NDPA Compliance

WelliRecord processes personal data in accordance with the Nigeria Data Protection Act (NDPA) 2023, administered by the National Data Protection Commission (NDPC). The NDPA 2023 superseded the earlier NDPR 2019 and establishes the current legal framework for data protection in Nigeria. This means:

• We obtain your explicit consent before processing sensitive health data
• You may request access to, correction of, or deletion of your data at any time
• We maintain a Data Protection Officer (DPO) — contact: privacy@wellirecord.com
• We conduct Data Protection Impact Assessments for high-risk processing activities

5. Data Security

All data is encrypted in transit using TLS 1.3 and encrypted at rest using AES-256. Access to health records is role-based and audit-logged. You control which providers can view your records through the consent dashboard in your Health Vault.

6. Data Retention

We retain your data for as long as your account is active. If you delete your account, your personal data is purged within 30 days, except where retention is required by Nigerian law (e.g., health records regulations require retention for a minimum period).

7. Your Rights

Under the NDPA 2023, you have the right to:

• Access a copy of your personal data
• Request correction of inaccurate data
• Request deletion of your data ("right to erasure")
• Withdraw consent at any time without affecting prior processing
• Lodge a complaint with the National Data Protection Commission (NDPC)

To exercise any right, email privacy@wellirecord.com.

8. Contact

WelliRecord Ltd
Abuja, Federal Capital Territory, Nigeria
General: inquiry@wellirecord.com
Privacy / DPO: privacy@wellirecord.com