How we handle your information

• We collect only what we need to answer you, run your account, and keep the systems we host working.
• We do not sell your data, and we do not share it for anyone else's advertising.
• Patient data in systems we host belongs to the health provider, not to us. We process it on their instructions and nothing else.
• Non-essential cookies stay off until you turn them on. Change your cookie settings.
• You can ask us for a copy of your data, or for its deletion, at any time.

Xeventy2.0 Health Limited is a digital health and healthcare technology company registered in Nigeria with the Corporate Affairs Commission under number RC 6860272, with its headquarters in Lagos, Nigeria. We work on electronic medical and health records, telemedicine, health information exchange and interoperability, healthcare analytics, applied AI, healthcare cybersecurity and data governance, advisory and implementation work, research, and training and capacity development.

For information you give us directly — a contact form, a newsletter sign-up, a webinar registration, a support request — we are the data controller.

For patient and clinical information inside systems we build or host for a hospital, clinic, pharmacy or laboratory, that organisation is the controller and we act as a data processor under a written agreement with them.

Everything below is an application of eight principles we hold ourselves to, and which the Nigeria Data Protection Act 2023 requires of us:

• Lawfulness, fairness and transparency — you should never be surprised by what we do with your information.
• Purpose limitation — collected for a stated purpose, not quietly reused for another.
• Data minimisation — we collect what the purpose needs and no more. Where a field is optional we label it optional. We do not collect personal data merely because it is technically possible to.
• Accuracy — kept correct and current, and corrected when you tell us it is wrong.
• Storage limitation — kept only as long as it is needed.
• Integrity and confidentiality — protected by measures proportionate to how sensitive it is.
• Accountability — we can show how we meet each of these, not merely assert that we do.
• Security by default — the safe configuration is the one you get without asking for it.

• Information you give us. Your name, email address, telephone number, organisation, team size, location and whatever you write in a message or support request.
• Account information. For client systems: your username, role, permissions and the record of actions you took inside the system.
• Technical information. IP address, browser and device type, referring page, and pages viewed. Collected in server logs for security and troubleshooting.
• Event, webinar and training information. When you register for a session: your name, email address, telephone number, organisation, professional designation and field of specialty, plus attendance records, any questions or comments you submit during the session, and the certificate issued to you afterwards.
• Transaction and billing information. For paid engagements: invoices, subscription details, transaction records and payment status. Card details are handled by the payment provider, never by us.
• Analytics information. Aggregate usage of this website — but only once you have accepted analytics cookies.

We do not ask for and do not want payment card numbers over email, chat or a web form.

• To answer your enquiry and follow up on it.
• To provide, host, support and improve the software you licence from us.
• To send the newsletter, if you asked for it.
• To meet legal, accounting and regulatory obligations.
• To detect, investigate and prevent abuse of our systems.

We do not use your information to make automated decisions that produce legal effects about you.

Under the Nigeria Data Protection Act 2023 and, where it applies, the UK and EU GDPR, we rely on:

• Contract — to deliver the services you or your organisation have engaged us for.
• Consent — for the newsletter and for non-essential cookies. You can withdraw it at any time.
• Legitimate interests — to keep our systems secure and to respond to business enquiries, balanced against your rights.
• Legal obligation — where a law or a regulator requires us to retain or disclose information.

When we host or support a records, pharmacy or laboratory system, patient information inside it remains under the control of the health provider. We act only on their documented instructions.

• Our engineers do not hold standing access to live clinical data.
• Support access is granted per incident, limited to what the incident requires, time-boxed and logged in an audit trail the provider can read.
• We do not use patient data to train models or to build other products.
• Where we need a sub-processor — for hosting, for example — the provider is told who it is before we engage them.

Health data, biometric and genetic information, and clinical records are sensitive personal data. We process them only where there is a lawful basis, where the processing is necessary and proportionate, and with safeguards matched to the risk: role-based access and least privilege, authentication, encryption in transit and at rest, audit logging, confidentiality undertakings, staff privacy and security training, vulnerability management, a written breach procedure, pseudonymisation or anonymisation where it does not defeat the purpose, and a Data Protection Impact Assessment where one is required.

If you are a patient and want to see, correct or delete your medical record, contact the health facility that treated you. They hold the record; we cannot release it on their behalf.

We share personal information only with:

• Service providers who host, email or support on our behalf, under contract and only for that purpose.
• Professional advisers — lawyers, auditors and insurers — where genuinely necessary.
• Authorities, where we are legally required to disclose. We tell you unless the law forbids it.

We do not sell personal information, and we do not disclose it to advertising networks or data brokers.

Some of the infrastructure we use — hosting, email, error monitoring — may store or process data outside Nigeria, or be accessed by our team from another country. Where that happens we put appropriate contractual and technical safeguards in place, as Nigerian data-protection law requires.

For clinical systems we host on a client's behalf, the hosting region is the client's decision and is written into the agreement. We do not move that data to another region without their instruction.

• Enquiries — up to 24 months after our last exchange, unless it became a client relationship.
• Newsletter subscriptions — until you unsubscribe, plus a short suppression record so we do not re-add you by mistake.
• Client account records — for the life of the contract and then as long as accounting and limitation rules require.
• Server and security logs — typically 90 days, longer where an incident is under investigation.
• Clinical data processed for a client — under their retention schedule, deleted or returned on their instruction when the contract ends.

• Encryption in transit, and at rest for stored records.
• Role-based access, least privilege by default, and multi-factor authentication for staff.
• Audit logging of reads and edits in clinical systems.
• Backups with tested restores, held in the region the client selects.
• A written incident procedure, with regulator and client notification timelines.

No system is perfectly secure. If a breach affects you, we will tell you and the relevant authority within the periods the law sets, and we will say what actually happened.

Privacy controls belong in the build, not in a policy written after it. Depending on what a system does and what it would cost to get wrong, that means some combination of: collecting less in the first place, role-based access and data segregation, encryption, pseudonymisation or anonymisation, secure development practice and security testing, auditability, configurable privacy controls the client can set for themselves, retention rules that actually fire, and secure deletion at the end.

We would rather ship a system that collects one field fewer than one that collects a field it never needed.

This website uses three categories of cookie:

• Strictly necessary — keep you signed in, remember your light or dark theme, and store your cookie choice itself. These cannot be switched off, because the site does not work without them.
• Analytics — anonymous counts of pages and clicks that tell us which parts of the site help and which get abandoned. Off until you accept them.
• Marketing — used to measure whether a campaign reached you. Off by default, and nothing in this category identifies you personally.

Your choice is stored on your own device and applies to this browser. Clearing your browser data will clear it, and you will be asked again.

You can accept optional cookies, reject them, or change your mind later — the control below is the same one the banner offers, and it stays reachable from the footer of every page. Strictly necessary items remain active because the site cannot function without them. You can also clear or block storage in your browser settings.

Do Not Track. Some browsers send a “Do Not Track” or similar signal. There is no agreed standard for what a site must do in response, so we do not rely on it. Use the cookie settings above instead — that choice we do honour.

What this website actually stores on your device today. We keep this list specific rather than generic, and update it when we add or remove a script.

We have not deployed analytics or marketing cookies on this site. The categories remain in the consent panel because we would rather ask you before that changes than add a tracker to a site you have already consented to.

You can ask us to:

• Give you a copy of the personal information we hold about you.
• Correct anything inaccurate.
• Delete it, where we have no continuing lawful reason to keep it.
• Restrict or object to a particular use.
• Send it to another provider in a portable format.
• Withdraw consent you previously gave, at any time.

Write to contact@xeventy2health.com. We respond within 30 days. There is no charge. If you are unhappy with our answer you may complain to the Nigeria Data Protection Commission, or to the supervisory authority where you live.

Where the law allows it, we may write to you about our products and services, webinars, conferences, training programmes, research and publications. Where consent is required, we ask for it first and we do not treat silence as agreement.

Every marketing email carries an unsubscribe link, and you can also ask us directly. Service, security and transactional messages — a password reset, a breach notification, an invoice, the joining link for a session you registered for — are not marketing and will continue.

This site links out to other services, and embeds video from YouTube. We are not responsible for how those services handle your data, and this policy does not cover them. Read their own notices before you give them anything.

Some of our services and research use analytics, automation, machine learning or AI. Where an automated decision would have a legal or similarly significant effect on someone, we apply the safeguards the law requires, including a route to human review.

We do not use personal data for a purpose incompatible with the one it was collected for without a lawful basis for the new purpose. In particular, and to say it plainly: we do not use patient or clinical data from systems we host to train models, for ourselves or for anyone else.

This website is not directed at children, and we do not knowingly collect information from them through it. Paediatric records inside client systems are handled under the health provider's own policies and the consent of a parent or guardian.

We update this page when our practices change. The date at the top always reflects the current version, and we will give notice of material changes to active clients and newsletter subscribers before they take effect.

For anything in this policy, including a data request, reach our Legal and Compliance Unit:

Prefer a form? Use the contact page and mark your message for the Legal and Compliance Unit.

Please come to us first — we would rather fix something than have you escalate it. But you do not have to, and if our answer does not satisfy you, you can complain to Nigeria's statutory data-protection authority:

Nigeria Data Protection Commission (NDPC), Federal Republic of Nigeria — ndpc.gov.ng

Using this website does not by itself amount to consent to every kind of processing described here. Where a particular activity needs your consent, we ask for it through a mechanism built for that purpose — the cookie panel, a registration checkbox, a signed agreement.