Privacy Policy

This policy explains how personal data is handled in the Golad Smart Health System ("GSHS"), operated by Golad Technologies Limited ("Golad").

For clinical records created inside a hospital or clinic, that organisation is the data controller: it decides why and how the records are used. Golad is its data processor, acting on documented instructions. For the marketing website, the patient portal account itself, prescription verification and platform-wide audit logging, Golad is the controller.

Depending on how you interact with GSHS, the following categories may be held:

• Patient identity: name, date of birth, sex, and optionally phone, email, address, next of kin and National Identification Number. Only name and date of birth are ever required, so that a patient without a phone or an NIN can still be registered.
• Global Patient ID: a platform-issued identifier that links a person's records across organisations. It carries no personal details in itself.
• Clinical data: encounters, vital signs, notes, diagnoses, allergies, prescriptions and dispensing, laboratory and imaging orders and results, admissions and discharge summaries. This is sensitive personal data under the Nigeria Data Protection Act 2023.
• Financial data: charges, invoices and payments relating to care received.
• Staff data: name, work email, phone, role, branch and account status for authorised users.
• Consent and access data: health access codes (stored only as a cryptographic hash, never in readable form), consent requests, representative relationships and emergency access records.
• Technical and audit data: sign-in attempts, actions taken in the platform, the acting user, the affected record and the time. For prescription verification we retain a short-lived, coarse record of attempts to prevent code guessing.
• Website data: demo requests, newsletter sign-ups and basic technical information necessary to serve the site securely.

Clinical records are processed for the provision of healthcare by or under the responsibility of a health professional bound by a duty of confidentiality, and to protect the vital interests of the patient where consent cannot be obtained. Staff accounts and billing are processed to perform a contract. Audit logging, access control and fraud prevention are processed to comply with legal obligations and for the legitimate interest of keeping patient data safe. Marketing communications, including the newsletter, rely on consent, which you can withdraw at any time.

The defining rule of GSHS is that confirming a person exists must never disclose anything about them. When one organisation checks a Global Patient ID, the only answer returned is whether that identity exists and is active — no name, no date of birth, no clinical information.

For anything beyond that, the patient must authorise the disclosure. They can issue a health access code choosing which categories of record are covered, optionally restricting it to one named organisation, and setting how long it lasts. Alternatively, a hospital can send a request stating its reason and requested scope, which the patient approves or declines from the patient portal.

Codes are stored only as hashes, so nobody — including Golad staff — can read them back from the platform. Repeated failed attempts are rate-limited and recorded. Access ends automatically at expiry, and the patient can revoke it sooner. Every disclosure is written to the audit trail with the requesting organisation and the exact scope released.

Where a patient is unconscious, in a life-threatening emergency or otherwise unable to consent, a clinician may invoke emergency access. This requires the clinician to re-enter their own password and record a reason code and a written justification.

Emergency access returns a restricted safety dataset only: active allergies, current medicines and current diagnoses. Nothing else is disclosed. Access expires automatically, and each invocation is recorded and placed in a review queue where a security or privacy officer must confirm it was appropriate or flag it for investigation.

A patient may nominate a representative — for example a parent, carer or next of kin — giving them a defined scope and, where appropriate, an end date. Representatives see only what the patient allowed, only while the relationship is active, and the patient can revoke it at any time.

We do not sell personal data and we do not use patient data for advertising.

Data is shared with the treating organisation and its authorised staff; with another organisation only where the patient has authorised it or under emergency access; with partner systems only through scoped API credentials issued by an organisation, where every call is logged; and with infrastructure providers who host the platform under contractual confidentiality and security obligations. We also disclose data where compelled by a court order or other lawful requirement, and will notify the affected controller unless prohibited from doing so.

The public verification tool is deliberately limited. A successful check returns the prescription number, its status, the issuing organisation and the date issued. It never returns the patient's name, the medicine, the prescriber or any contact detail, so it cannot be used to learn anything about a person even by someone holding a genuine code.

Data is encrypted in transit and at rest. Access is controlled by role and by organisation, and enforced in the database itself rather than only in the application, so a record belonging to one organisation cannot be read by another even through direct interface calls. Sensitive secrets, including access codes and partner API secrets, are stored only as hashes. Administrative actions, clinical record access and sign-in attempts are logged, and unusual patterns such as repeated failed sign-ins or frequent emergency access are surfaced as alerts.

Clinical records are retained in accordance with Nigerian medical records requirements and the instructions of the controlling organisation, and in any event for the period required by applicable professional guidance. Audit records are retained for a minimum of seven years because they evidence who accessed patient data. Expired and revoked access codes are retained as hashed records for audit purposes only. Demo requests and newsletter sign-ups are retained until you ask us to remove them.

Patient data is hosted on infrastructure selected to meet Nigerian regulatory expectations. Where any processing occurs outside Nigeria, it takes place under safeguards permitted by the Nigeria Data Protection Act 2023, and details are available to subscribing organisations on request.

Subject to the Nigeria Data Protection Act 2023, you have the right to be informed, to access your personal data, to have inaccurate data corrected, to request erasure where no overriding legal or clinical obligation applies, to restrict or object to certain processing, to data portability, and to withdraw consent at any time — including revoking a health access code or a representative relationship.

Requests about clinical records should be made to the hospital that created them, as that organisation is the controller and is the only party able to amend its own clinical entries. We will support it in responding. Requests about your portal account, marketing preferences or platform-level audit data can be sent directly to us.

You also have the right to lodge a complaint with the Nigeria Data Protection Commission.

Records for children and for adults who lack capacity are managed through the guardian and trusted representative features, with the relationship recorded explicitly and with a defined scope, rather than by sharing an adult's login.

Where a personal data breach occurs, we will notify the affected controlling organisations without undue delay and support any notification they must make to the Nigeria Data Protection Commission and to affected individuals within the periods required by law.

Our Data Protection Officer can be reached at privacy@gshs.ng, or by post at the head office address published on this website. We aim to acknowledge every privacy enquiry within five working days.