Privacy Policy

1. Who we are

Hospitals247 is a telemedicine platform operating in Nigeria. We connect patients with doctors licensed by the Medical and Dental Council of Nigeria (MDCN), route prescriptions to pharmacies and tests to laboratories, and operate a naira wallet used to pay for those services.

For the purposes of the Nigeria Data Protection Act 2023 (the “NDPA”), the data controller for the information described in this notice is:

This notice covers hospitals247.ng, the Hospitals247 web application, and the Hospitals247 mobile apps. It sits alongside our Terms and Conditions.

2. The short version

• We do not record your consultations. Video and voice calls are carried live and are not captured, stored or transcribed by us.
• We do not track you across the internet. This website sets no advertising or analytics cookies, and we do not sell or rent your data to anyone, ever.
• Your medical records are visible to you and to the clinicians treating you— not to our commercial staff, and not to whoever pays your bill.
• You can take your data with you, and you can delete your account from inside the app, without asking us.

3. What we collect

Information you give us

• Account details — your name, email address, phone number and gender.
• Where you are — your State and Local Government Area, so we can show you pharmacies and laboratories near you. We do not collect GPS or precise location.
• Health information — the symptoms you describe, your medical history, and anything you tell a doctor during a consultation.
• Messages — the text of consultation chats, and any complaint you raise.
• If you are a doctor or a facility — your professional credentials (identity document, MDCN licence, medical and specialisation certificates) and the bank account we pay your earnings into.

Information created as you use the service

• Clinical records — consultation notes, diagnoses, prescriptions, laboratory requests and results, and referrals.
• Money records — your wallet balance and every transaction on it, and the orders you place with pharmacies, laboratories and our store.
• Sign-in records — one record per signed-in device, holding the browser or app identifier and when it was last used. We store a one-way hash of your session token, never the token itself, so a database breach does not hand over a usable login.
• Notification tokens — an identifier for each device you allow push notifications on.

What we do not collect

We do not record consultations. We do not collect precise location. We do not build advertising profiles, and we do not buy personal data about you from anyone else. Your card details are entered on our payment provider’s systems and are never stored by us.

4. Why we use it, and our lawful basis

The NDPA requires us to have a lawful basis for everything we do with your information. Ours are:

Where we rely on your consent, you may withdraw it at any time. Withdrawing consent does not affect anything we did lawfully before you withdrew it.

5. Your health information

Health information is sensitive personal data under the NDPA and is additionally protected by the confidentiality provisions of the National Health Act 2014. We treat it accordingly:

• Your clinical record is available to you and to the clinician treating you. It is not open to our commercial or operations staff as a matter of course.
• A pharmacy or laboratory receiving your order sees only what it needs to fill it — the items or tests, and enough to identify you at the counter. It does not receive your wider medical history.
• If your care is paid for through a family or corporate account, the account administrator sees what was spent, never what it was for. Their view carries no clinical detail.
• Consultations are carried live. We do not record, store or transcribe the audio or video.

6. Who we share it with

We do not sell your personal data. We share it only as set out here.

People delivering your care

The doctor treating you, and any pharmacy, laboratory or hospital you or your doctor selects for an order — limited, in each case, to what that provider needs to do its part.

Service providers acting on our instructions

• Paystack — payments, wallet top-ups and payouts. Your card details go to Paystack directly and are never held by us.
• Agora — carries the live audio and video of a consultation. No recording is made.
• Google (Firebase) — delivers push notifications to your device.
• Our email provider — sends service email such as verification links, receipts and appointment reminders.
• Our hosting and database providers — run the servers the service operates on.

These providers act on our instructions and may not use your information for their own purposes.

Where the law requires it

We may disclose information where we are obliged to by law, court order, or a lawful request from a regulator — including the Nigeria Data Protection Commission, the MDCN, the Pharmacy Council of Nigeria or the Medical Laboratory Science Council of Nigeria.

7. Sending information outside Nigeria

Some of the providers above operate outside Nigeria, so your information may be processed abroad. Sections 41 to 43 of the NDPA permit this only where the destination gives adequate protection or an appropriate legal safeguard is in place. We rely on contractual safeguards with each provider, and we keep the list of providers under review.

8. How long we keep it

We keep your information for as long as your account is open. When you delete your account, we do something more careful than simply erasing everything, and it is worth being plain about it:

• Your identifying details are scrubbed. Name, email address, phone number and profile picture are removed, and your login credentials are destroyed.
• Your clinical and financial records survive, without your name on them.Medical records and money ledgers carry retention obligations that outlive an account, so they remain as de-identified records rather than being destroyed.

Sign-in sessions expire on their own and are cleared automatically. Uploaded files that no record refers to are removed by a daily clean-up.

9. Your rights

Under the NDPA you have the right to access your data, to have inaccurate data corrected, to ask for erasure, to ask us to restrict or to object to what we do with it, to portability of the data you gave us, and to withdraw consent where we rely on it.

Two of these you can exercise yourself, immediately, without contacting anyone:

• Download your data — your profile, wallet and transactions, consultations, prescriptions, laboratory requests, referrals, orders, reviews and complaints, from your account settings.
• Delete your account — from your account settings. We will tell you first if anything stands in the way (money still in your wallet, a consultation in progress, an open order), and what we keep afterwards and why.

For anything else, write to support@hospitals247.ng. We will respond within the time the NDPA allows. We may need to verify your identity first — we will not hand your medical records to someone claiming to be you.

10. Cookies

This website sets no cookies at all — no analytics, no advertising, no third-party tags. That is why you are not being asked to dismiss a cookie banner.

The Hospitals247 application, at app.hospitals247.ng, sets one cookie that keeps you signed in, plus local storage on your own device holding your session. These are strictly necessary for the service to work; there is no way to use the application without them, and they are not used to track you.

11. How we protect your information

• Traffic between your device and our servers is encrypted in transit.
• Passwords are stored hashed. Session tokens are stored hashed, never in the clear.
• Access to records is enforced by the service on every request, not merely hidden in the interface.
• Uploaded files are checked for malicious content before they are stored, and are served only to people entitled to see them — never from a public link.
• Signing in on a new device creates its own session, so you can sign out one device without disturbing the others. Changing your password ends every session everywhere.

No system is perfectly secure. If a breach occurs that is likely to put your rights at risk, we will notify the Nigeria Data Protection Commission and, where the NDPA requires it, you.

12. Children

Our Terms require account holders to be 18 or over. A parent or guardian may hold an account and seek care for a child in their care. We do not knowingly create accounts for children on their own; if we learn that we have, we will remove the account.

13. Complaints

If you are unhappy with how we have handled your information, please raise it with us first at support@hospitals247.ng — it is usually the fastest way to get it fixed.

You also have the right to complain directly to the Nigeria Data Protection Commission (NDPC), the authority that supervises data protection in Nigeria. You do not need our permission, and you do not need to come to us first.

14. Changes to this notice

We will update this page when what we do with your information changes, and we will move the “last updated” date at the top. If a change materially affects your rights, we will tell you directly rather than relying on you to notice.

15. Contact us