Privacy Policy

1. Introduction

Call My Doctor ("we", "our", or "us") is committed to protecting the privacy and personal data of our users. This Privacy Policy explains how we collect, use, disclose, and safeguard your information when you use our telemedicine platform, in compliance with the Nigeria Data Protection Act (NDPA) 2023, the Nigeria Data Protection Regulation (NDPR) 2019, and other applicable data protection laws.

2. Data Controller Information

Call My Doctor operates as both a data controller and data processor. We determine the purposes and means of processing personal data and also process data on behalf of healthcare providers using our platform.

3. Personal Data We Collect

We collect the following categories of personal data:

3.1 Identity & Contact Data

• Full name, email address, phone number
• Date of birth, gender
• Profile photograph
• National identity information (for doctors: license number)
• Delivery addresses

3.2 Health & Medical Data (Sensitive)

• Blood group, genotype, allergies
• Medical conditions, chronic conditions, current medications
• Vitals (blood pressure, heart rate, temperature, etc.)
• Medical reports and test results
• Prescriptions and consultation records
• Emergency contact information

3.3 Financial Data

• Payment transaction references and amounts (processed via Paystack)
• Order and purchase history

3.4 Technical Data

• IP address, browser type, device information
• Cookies and session data
• Connected device tokens (encrypted at rest)
• Google OAuth access tokens and refresh tokens (encrypted at rest) — only when a doctor voluntarily connects their Google Calendar

3.5 Google Calendar Data (Doctors only — optional)

When a doctor chooses to connect their Google Calendar, we access the following data solely via the Google Calendar API:

• The ability to create calendar events representing confirmed patient appointments
• Event details we write: appointment date/time, patient first name, consultation type, and a platform link
• We do not read, scan, or store any pre-existing events on the doctor's calendar
• We do not share this calendar data with any third party

4. Purpose of Data Processing

We process your personal data for the following purposes:

• Account registration and authentication — to create and manage your account
• Healthcare delivery — to facilitate doctor-patient consultations, appointments, and prescriptions
• Pharmacy services — to process prescription orders and product purchases
• Payment processing — to process and track payments for services
• Notifications — to send appointment reminders, payment confirmations, and health alerts
• Emergency services — to enable emergency contact functionality
• Platform improvement — to analyze usage patterns and improve our services
• Legal compliance — to meet our legal and regulatory obligations
• Google Calendar integration — when a doctor connects their Google Calendar, we create calendar events for confirmed appointments so doctors can track their schedule. This is entirely optional and can be disconnected at any time from the doctor's account settings

5. Legal Basis for Processing

We process your data based on the following legal grounds:

• Consent — you provide explicit consent during registration and for specific processing activities
• Contract performance — processing necessary to provide our healthcare services
• Legal obligation — compliance with healthcare regulations and data protection laws
• Vital interests — in medical emergencies where your health is at risk
• Legitimate interest — for platform security, fraud prevention, and service improvement

6. Data Recipients & Sharing

Your personal data may be shared with the following recipients:

7. International Data Transfers

Some of our third-party service providers operate outside Nigeria. When we transfer your data internationally, we ensure appropriate safeguards are in place, including:

• Standard contractual clauses with service providers
• Ensuring recipients maintain adequate data protection standards
• Encryption of data in transit and at rest

8. Data Retention

We retain your personal data for the following periods:

• Account data — retained while your account is active, plus 30 days after deletion request
• Medical records — retained for a minimum of 5 years as required by healthcare regulations
• Payment records — retained for 7 years for tax and legal compliance
• Session and log data — retained for 90 days
• Expired appointment data — automatically purged after 365 days
• Google Calendar OAuth tokens — retained while the doctor's calendar remains connected. Immediately deleted when the doctor disconnects their Google Calendar or deletes their account

9. Security Measures

We implement the following security measures to protect your data:

10. Your Rights

Under the Nigeria Data Protection Act and NDPR, you have the following rights:

• Right of Access — request a copy of the personal data we hold about you
• Right to Rectification — request correction of inaccurate or incomplete data
• Right to Erasure — request deletion of your data (subject to legal retention requirements)
• Right to Restriction — request limitation of processing in certain circumstances
• Right to Data Portability — receive your data in a structured, machine-readable format
• Right to Object — object to processing based on legitimate interests
• Right to Withdraw Consent — withdraw consent at any time

11. Complaints

If you are dissatisfied with how we handle your personal data, you have the right to lodge a complaint with the Nigeria Data Protection Commission (NDPC) at ndpc.gov.ng.

12. Changes to This Policy

We may update this Privacy Policy from time to time. We will notify you of any material changes by posting the updated policy on this page and sending an email notification to registered users where appropriate.

13. Google API Services — Limited Use Disclosure

Call My Doctor's use of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements.