Data Protection & NDPR Statement

Golad Technologies Limited ("Golad") is a company incorporated in the Federal Republic of Nigeria and the operator of the Golad Smart Health System ("GSHS"). This statement sets out how we meet our obligations under the Nigeria Data Protection Act 2023 and the Nigeria Data Protection Regulation (NDPR), and how you can exercise your rights.

It sits alongside our Privacy Policy, which describes in more detail what data GSHS holds and how sharing works. Where the two differ on a point of law, this statement governs.

For clinical records created inside a hospital or clinic, that organisation is the data controller and Golad is its data processor. For patient portal accounts, prescription verification, platform-wide audit logging and this website, Golad is the controller.

Health data is sensitive personal data. We do not rely on a single blanket consent for all of it. Each purpose has its own basis:

• Provision of healthcare — clinical records are processed for the provision of care by or under the responsibility of a health professional who owes a duty of confidentiality.
• Vital interests — emergency (break-glass) access is used only where a patient cannot consent and there is a risk to life or health; it returns a restricted safety dataset and is always reviewed afterwards.
• Consent — cross-hospital sharing through a Health Access Code or an approved consent request is based on the patient's explicit, scoped, time-limited consent, which the patient can withdraw at any time.
• Contract — staff accounts, organisation subscriptions and the hospital's own patient billing are processed to perform a contract.
• Legal obligation — medical record retention, audit logging and regulatory reporting.
• Legitimate interest — security monitoring, rate limiting and fraud prevention, balanced against the rights of the people whose data is protected by those controls.

Golad may produce aggregated, de-identified statistics — for example counts of encounters or average laboratory turnaround time — for service improvement and public-health reporting. This is done only where there is an explicit basis to do so, and only on data from which direct identifiers have been removed and which cannot reasonably be used to single out an individual. Identifiable patient data is never sold, and is never used for advertising or profiling.

Golad has appointed a Data Protection Officer who is responsible for overseeing compliance, handling data subject requests and acting as the contact point for the Nigeria Data Protection Commission.

Data Protection Officer, Golad Technologies Limited — email dpo@gshs.ng, or by post at the head office address published on the Contact page of this website. We acknowledge every enquiry within five working days.

Under the Nigeria Data Protection Act 2023 you have the right to be informed, to access a copy of your personal data, to have inaccurate data corrected, to request erasure where no overriding clinical or legal obligation applies, to restrict or object to certain processing, to data portability, and to withdraw consent at any time.

Several of these you can exercise yourself, immediately, inside the platform rather than by writing to anyone:

• Access — sign in to the patient portal and open "My health record" to see the identity, visit, prescription, result and appointment data held about you.
• Withdraw consent — open "My consent & access" in the portal to revoke a Health Access Code, decline a hospital's pending request, or end a trusted representative relationship. Revocation takes effect immediately.
• Correction — ask the hospital that created the record. Only the controlling organisation can amend its own clinical entries; clinical notes are corrected by a dated addendum rather than by overwriting, so the record stays honest.
• Export, erasure, restriction or objection — send the request to dpo@gshs.ng or use the Contact page. Tell us your name, date of birth and, if you have one, your Global Patient ID, and which hospital the records relate to.

We verify identity before releasing anything — this protects you, and it is the same principle that governs the whole platform: confirming that an identity exists never reveals anything about the person behind it.

We respond within thirty (30) days. If a request is complex we may extend this once, by a further thirty days, and will tell you why. There is no charge, unless a request is manifestly unfounded or repetitive.

Where the request concerns records controlled by a hospital, we forward it to that hospital, tell you we have done so, and support them in responding. Where we must refuse a request — for example an erasure request for records a hospital is legally required to retain, or for audit records that evidence who accessed patient data — we explain the reason and your right to complain.

You may lodge a complaint with the Nigeria Data Protection Commission at any time, whether or not you have contacted us first.

We maintain an incident response process covering detection, containment, assessment and notification. Where a personal data breach is likely to result in a risk to the rights and freedoms of individuals, we will notify the Nigeria Data Protection Commission within seventy-two (72) hours of becoming aware of it.

Affected subscribing organisations are notified without undue delay so they can meet their own obligations as controllers, and we support any communication they must make to affected patients. Where Golad is the controller — for example for portal accounts — we notify affected individuals directly where the risk is high. Every incident is logged, reviewed and used to improve our controls.

Data is encrypted in transit and at rest. Access is restricted by role and by organisation and is enforced in the database itself, not only in the application, so one hospital's records cannot be read by another even through direct interface calls. Health Access Codes and partner API secrets are stored only as cryptographic hashes. Sign-ins, record access, emergency access and administrative changes are written to an audit trail that users cannot alter or delete, and unusual patterns are surfaced as alerts for review.

In summary, and subject to the instructions of the controlling organisation:

• Clinical records — retained for the period required by Nigerian medical records requirements and applicable professional guidance; children's records are retained at least until the patient reaches adulthood plus the applicable period.
• Audit and access logs — a minimum of seven (7) years, because they evidence who accessed patient data.
• Health Access Codes — the code itself is never stored in readable form; expired and revoked codes are kept as hashed records for audit only.
• Emergency access records — retained with the audit trail and never deleted while the underlying clinical record exists.
• Subscription and payment records — retained for the period required by Nigerian tax and company law, currently six (6) years.
• Demo requests, support enquiries and newsletter sign-ups — retained until you ask us to remove them, and reviewed periodically.

A child's record is managed through the guardian relationship recorded at registration, and through the trusted representative model in the patient portal. A representative sees only the scope the patient or guardian allowed, only while the relationship is active, and the arrangement can be ended at any time. As a young person reaches an age where they can decide for themselves, the representative relationship should be reviewed and ended by the hospital or the patient.

Patient data is hosted on infrastructure chosen to meet Nigerian regulatory expectations. Where any processing takes place outside Nigeria — for example for resilient backup or for a subprocessor providing email delivery — it occurs only under a transfer mechanism permitted by the Nigeria Data Protection Act 2023, with contractual confidentiality and security obligations in place. Subscribing organisations can request the current list of subprocessors and the transfer basis relied upon.

We review this statement at least annually and whenever the platform changes in a way that affects how personal data is handled. Material changes are notified to subscribing organisations in writing and the revised date is shown at the top of this page.