Privacy Policy
Last updated: 16 July 2026
DawaHQ Limited ("DawaHQ", "we", "our", or "us") is committed to protecting the privacy of our clinic customers ("Clinic") and their patients ("Data Subjects"). This Privacy Policy explains how we collect, use, disclose, and safeguard information in connection with our healthcare management platform.
Built to align with the Nigeria Data Protection Act 2023. NDPC registration is in progress. This policy is updated as our compliance programme completes Phase 1 legal review.
DawaHQ operates in accordance with the Nigeria Data Protection Act (NDPA) 2023 and the Nigeria Data Protection Commission (NDPC) General Application and Implementation Directive (GAID) 2025.
1. Data Controller vs Data Processor
Your clinic is the Data Controller — you determine the purposes and means of processing patient data. DawaHQ acts as a Data Processor — we process patient data only on your clinic's instructions. We never use patient data for our own commercial purposes.
2. Information We Collect
Account information: Clinic name, owner name, email address, phone number, clinic address, and registration details.
Patient data (on behalf of your clinic): Patient demographics, medical history, clinical notes, lab results, prescriptions, billing records, and other healthcare information entered by your clinical staff. Optional national identifiers (NIN, NHIA enrollee ID) may be stored when your clinic chooses to collect them with appropriate notice and purpose.
Usage data: Log data, IP addresses, browser type, pages visited, and feature usage analytics to improve the platform.
Payment information: Payment transactions are processed by Paystack. DawaHQ does not store card numbers or bank account details.
3. How We Use Information
We use the information we collect to:
- Provide, maintain, and improve the DawaHQ platform
- Process payments and manage billing
- Send service notifications (appointment reminders, system alerts)
- Provide customer support
- Comply with legal obligations
- Monitor platform security and detect fraud
We do not sell, rent, or share patient data with any third party for marketing or commercial purposes.
4. Data Sharing and Subprocessors
We share data only with subprocessors necessary to operate the Service, including:
- Supabase — encrypted database hosting (Ireland, eu-west-1)
- Vercel — application hosting and global delivery
- Paystack — payment processing (Nigeria)
- Anthropic — optional clinical AI features (United States)
- Email and SMS providers — transactional delivery
- Sentry — error monitoring
- Upstash — rate limiting
- Telegram — optional critical staff alerts
A maintained register is published at dawahq.com/subprocessors. All subprocessors are contractually bound to process data only as necessary and under data protection obligations.
4.1 International Data Transfers
Your data is processed and stored on our behalf by service providers located outside Nigeria, including in Ireland (database hosting) and the United States (optional clinical-AI features). These transfers are made under the Nigeria Data Protection Act 2023 on the basis that each provider is bound by contractual data-protection clauses affording an adequate level of protection, and, where a provider is in Ireland, is additionally subject to European data-protection law. A list of our sub-processors and the safeguards applied is available at dawahq.com/subprocessors.
4.2 Artificial Intelligence
DawaHQ offers optional clinical decision-support features powered by Anthropic (United States). When enabled by your clinic, relevant clinical text (such as consultation summaries, diagnoses, or lab context) may be transmitted to Anthropic's API. Prompts are designed not to include patient names, national IDs, or other direct identifiers. We do not use patient data to train third-party foundation models. AI features are subject to usage limits, role permissions, and clinic configuration. Your clinic should ensure patients are informed and, where required, obtain appropriate consent for optional AI processing.
5. Data Retention
Patient records and clinic data are retained for the duration of your active subscription plus a 30-day grace period after cancellation. After this period, data is permanently deleted from our systems. You may export all your data at any time from within the platform. Clinical audit logs may be retained longer where required for compliance (typically up to seven years).
6. Your Rights (NDPA)
Under the NDPA, your clinic patients have the right to:
- Access their personal data held by your clinic
- Correct inaccurate data
- Request erasure of their data
- Object to processing
- Data portability
As Data Controller, your clinic is responsible for responding to patient data rights requests within the timelines required by the NDPA (generally 30 days). DawaHQ will assist where technically necessary.
7. Security
We implement AES-256 encryption at rest, TLS 1.3 in transit, multi-tenant data isolation between clinics, and role-based access control. See our Security page for full details.
8. Cookies
DawaHQ uses essential session cookies for authentication and functional cookies to maintain your login session. We do not use tracking or advertising cookies.
9. Complaints
If you have a privacy concern, contact our Data Protection Officer first (see below). You may also lodge a complaint with the Nigeria Data Protection Commission (NDPC) if your concern is not resolved.
10. Changes to This Policy
We may update this Privacy Policy from time to time. Significant changes will be communicated via email to clinic administrators at least 14 days before taking effect.
11. Contact Us
Data Protection Officer: Stanley Jacob
Email: privacy@dawahq.com
DawaHQ Limited
RC 9448673
Nigeria