Medrecit Privacy Policy

Medrecit is a health technology platform designed to make health information easier to access and share in a controlled manner.

Our objective is to provide infrastructure for access to health information rather than simply operate as a digital filing system.

Medrecit may allow individuals to organise and access their health information and, where supported, authorise healthcare providers to access relevant information.

Medrecit is not a healthcare provider and does not itself diagnose, treat or provide medical advice.

This Privacy Policy applies to personal information processed through:

• The Medrecit website;
• Medrecit accounts and platform environments;
• Product testing and controlled pilots;
• Communications with Medrecit;
• Provider onboarding and evaluation;
• Feedback and research relating to Medrecit’s products; and
• Other services expressly covered by this Policy.

Specific pilot activities may also be governed by a separate participant information notice, consent form or agreement.

Where a separate notice applies, that notice will explain the particular processing associated with the relevant activity.

The information we collect depends on how you interact with Medrecit.

3.1 Website and enquiry information

When you interact with our website, we may collect:

• Name;
• Email address;
• Telephone number;
• Organisation and professional role, where applicable;
• Information contained in enquiries or communications; and
• Technical information relating to your use of the website.

3.2 Account information

If you are invited to create or use a Medrecit account, we may collect:

• Name;
• Email address;
• Telephone number;
• Account credentials and authentication information;
• Account identifiers;
• User role;
• Organisation information, where applicable; and
• Information required to maintain account security.

3.3 Health information

Where Medrecit is used to test or provide health-record functionality, information may include:

• Medical history;
• Diagnoses;
• Clinical notes;
• Laboratory results;
• Diagnostic reports;
• Medications;
• Allergies;
• Procedures;
• Treatment information;
• Discharge information;
• Referrals;
• Medical documents; and
• Other information contained within a health record.

Health information is sensitive personal information and will be processed only for specified and lawful purposes.

3.4 Provider information

Healthcare professionals or organisations participating in Medrecit may provide:

• Name;
• Professional role;
• Organisation;
• Professional registration or verification information;
• Contact details;
• Account information; and
• Information relating to use of the platform.

3.5 Technical and security information

We may collect:

• IP address;
• Browser type;
• Device type;
• Operating system;
• Login and authentication events;
• Date and time of access;
• Platform activity;
• Security events;
• Error and diagnostic information; and
• Information collected through cookies or similar technologies.

Medrecit’s product development and validation activities may use synthetic or simulated health information that does not represent a real individual.

Where a controlled pilot involves real individuals and identifiable health information, Medrecit will provide participants with appropriate information about the processing before their information is collected or used.

Medrecit will seek to minimise the amount of real health information used during testing and will not use real health information where synthetic information can reasonably serve the same testing purpose.

We may process personal information to:

• Provide and operate Medrecit’s services;
• Authenticate users;
• Create and maintain user accounts;
• Facilitate controlled access to health information;
• Facilitate authorised sharing of information;
• Conduct product testing and validation;
• Improve usability, reliability and security;
• Generate or maintain product functionality, including AI-assisted summaries where applicable;
• Investigate errors, misuse or security incidents;
• Communicate with users and pilot participants;
• Provide technical support;
• Comply with legal and regulatory obligations;
• Protect the rights and safety of users and Medrecit; and
• Establish, exercise or defend legal claims.

We do not sell health records.

We do not use health information for targeted advertising.

Certain Medrecit functionality may use artificial intelligence to generate a summary or overview of health information available and authorised within a user’s record set.

The purpose of this functionality is to help users and authorised healthcare providers understand the available record more efficiently.

An AI-generated summary:

• Is generated from information available to Medrecit;
• May change when underlying records are added or updated;
• May contain errors, omissions or inaccuracies;
• Does not replace the underlying clinical records;
• Does not constitute a diagnosis or medical advice; and
• Must not replace appropriate clinical review or professional judgement.

Medrecit does not provide patients with an AI diagnostic or medical-advice chatbot through this functionality.

Where AI processing involves personal or health information, Medrecit will apply appropriate safeguards and use the information only for specified purposes consistent with applicable law.

Depending on the circumstances, Medrecit may rely on one or more lawful bases for processing personal information, including:

• Consent;
• Performance of a contract or steps requested before entering into a contract;
• Compliance with a legal obligation;
• Protection of vital interests;
• Public interest where legally applicable; or
• Another lawful basis permitted under applicable data-protection law.

Where consent is relied upon, consent will be requested in a manner appropriate to the processing and may be withdrawn subject to applicable legal limitations.

The NDPC’s published guidance emphasises that valid consent should be informed, specific, actively given and capable of being withdrawn.

Medrecit may facilitate access to health information by an authorised healthcare provider where the relevant Medrecit functionality and authorisation process permit it.

Access may be subject to:

• User authorisation;
• Authentication;
• Role-based permissions;
• Scope limitations;
• Time limitations; and
• Other security controls.

Medrecit may also share personal information with service providers and other parties where necessary to operate the service, comply with law or protect users.

We do not provide healthcare providers with unrestricted access to a user’s information merely because the provider uses Medrecit.

Medrecit may use third-party service providers for functions such as:

• Cloud hosting;
• Secure storage;
• Authentication;
• Communications;
• Security monitoring;
• Analytics;
• Infrastructure;
• Software services; and
• AI or machine-learning infrastructure.

Where a third party processes personal information on Medrecit’s behalf, we will seek to ensure that appropriate contractual, technical and organisational safeguards are in place.

Some service providers or infrastructure used by Medrecit may be located outside Nigeria.

Where personal information is transferred internationally, Medrecit will apply appropriate safeguards and comply with applicable requirements governing cross-border transfers.

Medrecit uses reasonable technical and organisational measures designed to protect personal information against unauthorised access, disclosure, alteration, loss or destruction.

Depending on the relevant service, these measures may include:

• Authentication;
• Access controls;
• Encryption where appropriate;
• Role-based permissions;
• Secure hosting;
• Logging and monitoring;
• Security testing; and
• Incident-response procedures.

No online system can guarantee absolute security.

Medrecit may maintain records of activities performed within the platform, including:

• Login events;
• Authentication events;
• Record access;
• Record-sharing events;
• Authorisation events;
• Changes to permissions;
• Administrative activity; and
• Security events.

These records help Medrecit maintain security, accountability and system integrity.

We retain personal information only for as long as reasonably necessary for the purposes for which it was collected, subject to applicable legal, regulatory, security, audit and dispute-resolution requirements.

Pilot information may be retained for a period necessary to evaluate the relevant product, maintain research or testing records, demonstrate compliance, resolve disputes or satisfy legal obligations.

Where information is no longer required, Medrecit will take reasonable steps to delete, anonymise or securely dispose of it, subject to applicable retention requirements.

Subject to applicable law, you may have rights including:

• The right to be informed about processing;
• The right to access your personal information;
• The right to request correction of inaccurate information;
• The right to request deletion where applicable;
• The right to object to certain processing;
• The right to restrict certain processing;
• The right to data portability;
• The right to withdraw consent where consent is the lawful basis; and
• Other rights provided under applicable data-protection law.

Requests should be submitted using the contact information provided below.

We may need to verify your identity before processing certain requests.

Medrecit may receive health information from users, healthcare providers or other authorised sources.

We do not independently verify every clinical record or document made available through the platform.

Where information is inaccurate, users should contact the organisation or person responsible for the relevant record where appropriate.

Medrecit may use cookies and similar technologies.

Our use of cookies is explained in our separate Cookies Policy.

Medrecit will not knowingly permit children to create accounts where doing so would be contrary to applicable law.

Where Medrecit processes information relating to a child as part of an authorised service or pilot, appropriate parental, guardian or other lawful authority may be required.

If Medrecit becomes aware of a personal-data breach, we will assess and respond to the incident in accordance with applicable law and our internal incident-response procedures.

Where notification to affected individuals or a regulatory authority is required, Medrecit will make the relevant notification within the applicable timeframe.

As Medrecit develops, our services and data-processing activities may change.

We may update this Privacy Policy from time to time.

Material changes will be communicated through reasonable means where appropriate.

The date at the beginning of this Policy indicates when it was last updated.

For privacy enquiries, data-subject requests or concerns:

Medrecit Technologies Ltd

Email: support@medrecit.com

Website: www.medrecit.com

This Policy should be read together with the Medrecit Terms of Use and Cookies Policy.