Privacy Policy

1. Introduction

Universal Health Systems Limited (“UHS”, “we”, “our”, or “us”) is committed to protecting the privacy, confidentiality, integrity, and security of personal data entrusted to us.

This Privacy Policy explains how we collect, use, disclose, store, transfer, retain, and protect personal data when individuals access or use Health Access and any related services operated by Universal Health Systems Limited.

This Policy has been developed in accordance with:

• Nigeria Data Protection Act 2023 (NDPA)
• General Application and Implementation Directive 2025 (GAID)
• Applicable Healthcare Regulations
• Industry Best Practices
• Privacy by Design and Privacy by Default Principles

By accessing or using our services, you acknowledge that you have read and understood this Privacy Policy.

2. Who We Are

Universal Health Systems Limited is a healthcare and digital health organisation providing healthcare access solutions through digital and community-based channels.

Health Access is a healthcare platform owned and operated by Universal Health Systems Limited.

For purposes of applicable data protection laws, Universal Health Systems Limited acts as the Data Controller.

3. Services Covered by This Policy

This Privacy Policy applies to Universal Health Systems Limited:

Digital Health Services

• Health Access Mobile Application
• Health Access Website
• National Health Number (NHN)
• Digital Health Card
• Family Health Accounts

Clinical Services

• Telemedicine Consultations
• Healthcare Navigation Services
• Follow-Up Care Services
• Prescription Management

Emergency and Access Services

• Ambulance Coordination Services
• Emergency Referral Services
• Healthcare Facility Navigation Services

Healthcare Coordination Services

• Hospital Referrals
• Laboratory Referrals
• Pharmacy Referrals
• Specialist Referrals

Community Health Services

• Community Health Outreach Programmes
• Health Education Campaigns
• Wellness Programmes
• Preventive Health Initiatives

Support Services

• Toll-Free Healthcare Support Line
• Customer Support Services
• Technical Support Services
• Administrative Services

4. Information We Collect

Identity Information

We may collect:

• Full Name
• Date of Birth
• Gender
• National Identification Number (NIN)
• National Health Number (NHN)
• Photograph
• Government-Issued Identification Information where required
• Emergency Contact Information

The National Identification Number (NIN) may be collected as part of our registration and identity verification process. Collection of NIN helps Universal Health Systems Limited to:

• Verify user identity
• Prevent duplicate registrations
• Reduce fraud and impersonation
• Maintain accurate healthcare records
• Improve patient safety
• Ensure healthcare services are delivered to verified individuals
• Support continuity of care
• Maintain one unique healthcare profile per registered individual

The NIN shall only be processed for legitimate healthcare, verification, security, regulatory compliance, and service delivery purposes.

Contact Information

• Telephone Number
• Email Address
• Residential Address
• Emergency Contact Information

Health Information

• Medical History
• Symptoms
• Diagnoses
• Consultation Notes
• Prescriptions
• Laboratory Results
• Referral Records
• Allergies
• Immunisation Information
• Existing Medical Conditions
• Disability Information
• Mental Health Information
• Family Health Records where applicable
• Height, Weight, BMI Information
• Blood Group
• Other health information voluntarily provided by users

Emergency Information

Where ambulance services or emergency healthcare support are requested:

• Current Location
• Emergency Contact Details
• Nature of Emergency
• Medical Information Relevant to the Emergency
• Healthcare Facility Destination
• Ambulance Dispatch Information

Service Usage Information

• Appointment History
• Consultation History
• Prescription History
• Referral History
• Customer Support Records
• Call Centre Interactions
• Subscription Information
• Service Preferences

Technical Information

• Device Information and Identifiers
• Operating System
• Browser Information
• IP Address
• Application Usage Logs
• Security Logs
• Analytics Information

Biometric Authentication Information

Where biometric login is enabled, the platform may utilise fingerprint authentication, face authentication, or device authentication credentials.

Universal Health Systems Limited does not store raw fingerprint images or raw facial recognition data. Authentication is managed through secure device-level authentication technologies.

5. How We Collect Information

We collect information:

• Directly from users
• During registration
• During identity verification
• During healthcare consultations
• Through healthcare professionals
• Through customer support interactions
• Through toll-free support calls
• Through ambulance requests
• Through healthcare referrals
• Through laboratories and pharmacies
• Through website and application usage
• Through authorised third-party integrations

6. Data Protection Governance

Universal Health Systems Limited maintains a comprehensive data protection governance framework to ensure compliance with the Nigeria Data Protection Act 2023 (NDPA), the General Application and Implementation Directive 2025 (GAID), and other applicable laws. This framework includes:

• Data Protection Officer oversight
• Privacy by Design and Privacy by Default principles
• Data Protection Impact Assessments (DPIAs)
• Data Subject Rights Management Procedures
• Information Security Controls
• Incident Response and Breach Management Procedures
• Staff Training and Awareness Programmes
• Vendor and Third-Party Risk Management Processes
• Periodic Compliance Reviews

7. Identity Verification and Patient Authentication

To maintain accurate healthcare records and ensure patient safety, Universal Health Systems Limited may require users to undergo identity verification. Verification may involve:

• National Identification Number (NIN)
• Telephone Number Verification
• Email Verification
• Date of Birth Verification
• Government-Issued Identification Verification

Upon successful registration, users may be assigned a National Health Number (NHN) which serves as their unique healthcare identifier within the Health Access ecosystem.

8. Protection of National Identification Information

National Identification Numbers (NIN) and other government-issued identifiers are treated as highly sensitive personal information. Universal Health Systems Limited collects NIN information solely for:

• Identity verification
• Prevention of duplicate registrations
• Fraud prevention
• Patient safety
• Continuity of care
• Regulatory compliance
• Maintenance of accurate healthcare records
• Legitimate healthcare operational purposes

National Identification Numbers shall not be sold, publicly displayed, disclosed without lawful authority, shared for marketing purposes, or used for purposes incompatible with those for which they were collected.

Access to NIN information shall be restricted to authorised personnel with a legitimate operational requirement and protected through enhanced technical and organisational security controls.

9. Purposes of Processing

We process personal data to:

• Deliver healthcare services
• Facilitate telemedicine consultations
• Coordinate ambulance services
• Manage healthcare referrals
• Provide healthcare navigation support
• Operate the National Health Number system
• Maintain healthcare records
• Manage family healthcare accounts
• Coordinate laboratory services
• Coordinate pharmacy services
• Provide toll-free healthcare support
• Deliver community health programmes
• Improve service quality
• Detect fraud and misuse
• Protect patient safety
• Comply with legal and regulatory obligations

10. Health Data and Explicit Consent

Health information is Special Category Personal Data under the NDPA. By using Health Access and submitting health information, you provide explicit consent for Universal Health Systems Limited to process such information for healthcare delivery, care coordination, patient safety, healthcare referrals, ambulance coordination, and related healthcare services.

Consent may be withdrawn at any time subject to legal, regulatory, and healthcare record retention obligations.

11. Toll-Free Healthcare Support Services

Universal Health Systems Limited operates toll-free healthcare support channels to improve healthcare access for individuals who may not have internet access. The toll-free service may be used for:

• Hospital Referrals
• Healthcare Navigation
• Community Health Support
• Ambulance Coordination
• Health Access Support
• General Health Information
• Administrative Support

Calls may be recorded for quality assurance, staff training, service improvement, complaint investigation, security and fraud prevention.

12. Ambulance Coordination Services

Where ambulance assistance is requested, we may process and share relevant information with emergency responders and healthcare facilities to facilitate emergency response and continuity of care. Only information necessary to provide emergency assistance shall be disclosed.

13. Healthcare Referrals

We may share relevant information with hospitals, clinics, specialists, laboratories, pharmacies, and healthcare professionals where necessary to facilitate healthcare services and continuity of care.

14. Sharing of Information

We may share information with:

• Licensed Healthcare Professionals
• Ambulance Service Providers
• Hospitals and Clinics
• Laboratories
• Pharmacies
• Technology Service Providers
• Payment Service Providers
• Regulatory Authorities
• Law Enforcement Agencies where legally required

Universal Health Systems Limited does not sell personal data.

15. International Data Transfers

Universal Health Systems Limited may utilize secure cloud infrastructure, technology providers, and service providers that process or store information outside Nigeria. Where personal data is stored outside Nigeria, the Organisation shall:

• Conduct appropriate transfer risk assessments
• Assess the adequacy of protection afforded by the recipient jurisdiction
• Implement contractual safeguards
• Implement organisational safeguards
• Implement technical safeguards
• Conduct vendor due diligence
• Comply with applicable NDPA 2023 and GAID 2025 requirements

Personal data shall not be transferred internationally unless appropriate safeguards have been established.

16. Data Retention

Personal data shall be retained only for as long as necessary to:

• Deliver services
• Meet legal obligations
• Maintain healthcare records
• Protect patient safety
• Resolve disputes
• Support legitimate healthcare operations

Information shall be securely deleted, anonymised, or destroyed when no longer required.

17. Data Security

Universal Health Systems Limited implements appropriate technical and organisational security measures including:

• Encryption
• Access Controls
• Multi-Factor Authentication
• Audit Logging
• Security Monitoring
• Vulnerability Assessments
• Penetration Testing
• Incident Response Procedures
• Vendor Due Diligence
• Confidentiality Agreements

National Identification Numbers (NIN) and other government-issued identifiers are treated as highly sensitive information. Access to such information is restricted to authorised personnel and protected through enhanced security controls.

18. Your Rights

Subject to applicable law, individuals have the right to:

• Access Personal Data
• Correct Inaccurate Personal Data
• Request Deletion of Personal Data
• Restrict Processing
• Object to Processing
• Withdraw Consent
• Request Data Portability
• Lodge Complaints
• Request information regarding the processing of their personal data

Requests may be submitted to the Data Protection Officer. Universal Health Systems Limited shall acknowledge requests within a reasonable period and respond in accordance with applicable requirements of the Nigeria Data Protection Act 2023 and the General Application and Implementation Directive 2025.

The Organisation may request additional information where necessary to verify identity before responding to requests.

19. Automated Processing and Artificial Intelligence

Universal Health Systems Limited may deploy technology-assisted systems, analytics tools, digital health technologies, decision-support systems, automated workflows, or artificial intelligence technologies to improve healthcare access, operational efficiency, service delivery, fraud prevention, and patient safety.

Such systems are intended to support healthcare operations and shall not replace the professional judgment of licensed healthcare professionals.

Users have the right not to be subject solely to automated decisions that produce legal effects or similarly significant consequences without appropriate safeguards and human oversight where required by applicable law.

Any processing involving such technologies shall be conducted in accordance with the Nigeria Data Protection Act 2023, the General Application and Implementation Directive 2025, and applicable healthcare regulations.

20. Children and Vulnerable Persons

Additional safeguards shall apply where services involve:

• Children
• Elderly Persons
• Persons with Disabilities
• Vulnerable Individuals

Parental or guardian consent may be required where applicable.

21. Cookies and Similar Technologies

Health Access websites and applications may utilize cookies and similar technologies to improve functionality, security, analytics, and user experience.

22. Personal Data Breaches

Universal Health Systems Limited maintains Incident Response and Data Breach Management Procedures in accordance with NDPA 2023 and GAID 2025. Where required by law, affected individuals and relevant authorities shall be notified.

23. Changes to This Privacy Policy

We may update this Privacy Policy periodically. Updated versions shall be published on our website, mobile application, and other appropriate channels.

24. Data Protection Officer

Universal Health Systems Limited has appointed a Data Protection Officer (DPO) responsible for:

• Monitoring compliance with NDPA 2023 and GAID 2025
• Advising on privacy and data protection matters
• Managing Data Subject Requests
• Coordinating breach response activities
• Conducting compliance monitoring activities
• Serving as the primary point of contact for privacy-related enquiries

Individuals may contact the Data Protection Officer using the contact information provided in this Privacy Policy.

25. Contact Details

Acknowledgement

By accessing, registering for, or using Health Access or any service operated by Universal Health Systems Limited, you acknowledge that you have read, understood, and agreed to this Privacy Policy.