Privacy Policy

Nafara Health Technologies Limited (“Nafara”, “we”, “us”) helps patients in Nigeria find and book licensed physiotherapists. Doing that well means handling your personal data — including, sometimes, sensitive health information — and we take that responsibility seriously.

This Privacy Policy explains what we collect, why we collect it, who we share it with, and the rights you have over your data. It is written to comply with the Nigeria Data Protection Regulation 2019 (NDPR), the Nigeria Data Protection Act 2023 (NDPA), and related guidance from the Nigeria Data Protection Commission.

Nafara is the data controller for the personal data collected through this platform. The physiotherapist you book is separately responsible for the clinical records they create during your treatment, as required by their professional obligations.

You can reach our Data Protection Officer at privacy@nafara.ng.

We collect the following categories of data:

• Identity and contact details: your full name, phone number, email address, date of birth, and gender (if you choose to provide them).
• Location details: your local government area (LGA), neighbourhood, and home address — needed mainly for home visits and to match you with nearby practitioners.
• Health information, including medical notes: the condition you describe in a care request, medical notes you add to your profile, emergency contact details, and the services you book. This is sensitive personal data and we apply extra protection to it.
• Booking and payment records: sessions booked, amounts paid, deposits and cash balances, refunds, and cancellation history. We do not store your full card number — payments are processed by licensed payment providers.
• Reviews and communications: reviews you write, messages you send to support, and records of WhatsApp/SMS/email notifications we send you.
• Technical data: device type, browser, IP address, and usage information that helps us keep the platform secure and improve it.

Under the NDPR and NDPA, we only process your data where we have a lawful basis:

• Contract: to create your account, process bookings and payments, and connect you with your chosen practitioner — the core service you signed up for.
• Consent: for your health information (medical notes and condition descriptions), marketing messages, and WhatsApp/SMS communications. You give this consent when you provide the information or opt in, and you can withdraw it at any time.
• Legal obligation: to keep certain financial and tax records, and to respond to lawful requests from regulators or courts.
• Legitimate interest: to prevent fraud, secure the platform, and improve our services — always balanced against your rights.

• to match you with suitable, MRTB-verified physiotherapists;
• to create, confirm, reschedule, and cancel bookings;
• to process online payments, deposits, and refunds;
• to share necessary details with the practitioner you book — for example your name, contact details, address (for home visits), and the condition information you chose to share;
• to send booking confirmations, reminders, and important service updates;
• to publish reviews you choose to leave;
• to provide customer support and resolve disputes; and
• to keep the platform safe, prevent fraud, and meet our legal obligations.

We do not sell your personal data to anyone.

We use WhatsApp, SMS, and email to send you booking confirmations, appointment reminders, care-request updates, and OTP codes for login. By providing your phone number and using the platform, you consent to receive these service messages.

Marketing messages are different — we will only send them if you opt in, and every marketing message includes a simple way to opt out. You can also change your communication preferences from your profile or by contacting privacy@nafara.ng. Please note that messages sent over WhatsApp are handled by Meta’s WhatsApp Business service under its own terms; we keep the health details in such messages to the minimum necessary.

• Your practitioner: the details needed to deliver your session, as described above.
• Payment providers: licensed Nigerian payment processors who handle your card or bank transfer payments.
• Service providers: hosting, messaging (SMS/WhatsApp/email), and analytics providers who process data on our instructions under contracts that meet NDPR requirements.
• Authorities: regulators, law enforcement, or courts where the law requires it.

Where any provider stores data outside Nigeria, we only allow it in line with the NDPR and NDPA rules on cross-border transfer, including using countries or safeguards that provide adequate protection.

Security practices we apply include:

• encryption of data in transit (HTTPS/TLS) and at rest;
• access controls so that only staff who need your data to do their job can see it, with stricter controls around medical notes and other health data;
• secure authentication, including OTP verification for phone-based login;
• logging and monitoring to detect unusual activity;
• regular security reviews of our systems and our vendors; and
• staff training on data protection and confidentiality.

No system is perfectly secure, but if a breach ever affects your data we will notify the Nigeria Data Protection Commission and affected users within the timelines the law requires.

Under the NDPR and NDPA, you have the right to:

• Access the personal data we hold about you and get a copy;
• Export your data in a structured, commonly used format (data portability);
• Correct data that is inaccurate or incomplete — you can edit most of your profile yourself;
• Delete your account and personal data, subject to records we must keep by law (for example, payment records);
• Withdraw consent at any time, including for medical notes and marketing messages, without affecting processing done before withdrawal;
• Object to or restrict certain processing; and
• Complain to the Nigeria Data Protection Commission if you are not satisfied with our response.

To exercise any of these rights, email privacy@nafara.ng. We will respond within the period required by law, and we will not charge you for a reasonable request.

We keep your data only as long as we need it: account and profile data for as long as your account is active; booking and payment records for the period required by Nigerian financial and tax law; and support correspondence for up to 24 months after resolution. When you delete your account, we erase or anonymise your personal data except where the law requires us to keep it.

We use strictly necessary cookies to keep you signed in and keep the platform secure, and limited analytics cookies to understand how the platform is used so we can improve it. You can control cookies through your browser settings; blocking essential cookies may stop parts of the platform from working.

Nafara accounts are for adults (18+). A parent or guardian may book sessions for a child and share the child’s relevant health information for that purpose; the parent or guardian provides consent on the child’s behalf, as the NDPA requires.

We may update this policy as our services or the law change. If a change meaningfully affects how we handle your data, we will notify you by email, SMS, or an in-app notice before it takes effect. The “last updated” date at the top shows the current version.

For any privacy question or request, contact our Data Protection Officer at privacy@nafara.ng, or write to Nafara Health Technologies Limited, Lagos, Nigeria. You may also contact the Nigeria Data Protection Commission if you believe your rights have been infringed.