Contents
- 1. Who We Are
- 2. Information We Collect
- 3. Why We Use Your Information and Our Lawful Bases
- 4. Who We Share Information With
- 5. Healthcare Providers and Facility Partners
- 6. Family, Proxy Bookings and Children
- 7. Patient Consent Framework
- 8. How Long We Keep Information
- 9. Your Data-Protection Rights
- 10. Security
- 11. Personal Data Breaches
- 12. International and Cross-Border Transfers
- 13. Cookies, Analytics and Similar Technologies
- 14. Automated Matching and Platform Decisions
- 15. Changes to This Policy
- 16. Contact and Complaints
This Privacy Policy applies to the StreetdocMD platform, including our website, mobile or web-based services, account and booking flows, and supported communications channels used to arrange home-based medical, nursing and physiotherapy care and related laboratory, pharmacy and hospital services in Nigeria.
1. Who We Are
STREETDOC MD LTD (Registration No. 9797929) operates the StreetdocMD healthcare technology platform (“StreetdocMD”, “we”, “us” or “our”). For personal data processing where we determine the purposes and means of processing, STREETDOC MD LTD acts as a data controller. In some workflows, we may instead act as a processor on behalf of another controller.
Website: www.streetdocmd.com
Privacy and data-protection contact: contact@streetdocmd.com
2. Information We Collect
Depending on how you use StreetdocMD, we may collect:
- Identity and contact information, including name, date of birth, gender, phone number and service address.
- Health and medical information, including medical history, conditions, medications, allergies, blood group, symptoms and information supplied for a booking.
- Emergency-contact and proxy-booking information.
- Booking, visit and care information, including provider notes, vitals, diagnoses, prescriptions, laboratory orders and results, referral information, care plans and check-in responses where applicable.
- Photos, documents or other files uploaded by you or an authorised healthcare professional as part of your care.
- Location or address information reasonably required to arrange home care or match a booking to an available provider.
- Payment and transaction information. Card details are processed by Paystack or the applicable payment processor; StreetdocMD does not intentionally store full payment-card numbers.
- Account, device, security and technical information needed to operate and secure the Platform.
- Communications with StreetdocMD support, including through WhatsApp, telephone, email or in-platform channels.
3. Why We Use Your Information and Our Lawful Bases
We process personal data only where there is an appropriate lawful basis under applicable Nigerian data-protection law. The basis depends on the purpose and the information involved.
| Purpose | Examples | Typical lawful basis |
|---|---|---|
| Provide and administer the Platform | Create accounts, receive bookings, dispatch/match providers, communicate about appointments and process transactions. | Contract; legitimate interests where appropriate. |
| Facilitate healthcare and related services | Make relevant information available to the assigned provider or a laboratory, pharmacy or hospital involved in the Patient’s requested care. | Medical-care processing of sensitive personal data; contract; consent where specifically required. |
| Safety and emergencies | Respond to urgent safety concerns or protect a person who cannot provide consent. | Vital interests and other lawful grounds available under applicable law. |
| Security, fraud prevention and service integrity | Authentication, audit logs, investigation of misuse, complaints and disputes. | Legitimate interests; legal obligation where applicable. |
| Comply with law | Respond to lawful regulatory, court, tax or law-enforcement requirements. | Legal obligation. |
| Optional processing | Optional communications, non-essential analytics or other uses that require a choice. | Consent, where consent is the appropriate basis. |
Health information is sensitive personal data. Where applicable, StreetdocMD and the healthcare professionals or service providers involved in your care may process such information for medical care under the responsibility of professionals or similar service providers who owe duties of confidentiality.
4. Who We Share Information With
We do not sell personal or health information. We may disclose relevant information to:
| Recipient | Why information may be shared | Data-protection role / basis |
|---|---|---|
| Assigned doctors, nurses and physiotherapists | To assess and provide the care you request and support continuity of care. | They may have independent professional/controller responsibilities for clinical care and records; StreetdocMD may also process Platform data for care coordination. |
| Laboratory, pharmacy and hospital Facility Partners | Only where relevant to a requested test, prescription, referral or related service. | Facility Partners may act as independent controllers for their own clinical, dispensing, testing and regulatory records; any processor activity is governed by the applicable arrangement. |
| Paystack or replacement payment processor | To process payments, reversals and related transaction functions. | Service provider/payment processor, subject to its applicable terms and privacy practices. |
| Communications and technology service providers | To provide authentication, notifications, hosting, security, support and other Platform infrastructure. | Processors or independent controllers depending on the service and applicable arrangement. |
| StreetdocMD authorised personnel | Limited administration, support, quality assurance, safety, complaints, fraud and dispute handling. | Access is limited according to role and legitimate need. |
| Regulators, courts and public authorities | Where disclosure is required or permitted by applicable law. | Legal obligation or another applicable lawful basis. |
Safeguarding and emergency access: relevant information may be reviewed or disclosed where reasonably necessary to address a genuine safeguarding concern, protect vital interests, investigate serious misconduct or comply with law. Access should be limited to information relevant to that purpose.
5. Healthcare Providers and Facility Partners
StreetdocMD provides technology and care-coordination functions. Independent healthcare professionals and Facility Partners may have their own legal and professional obligations concerning clinical records and patient information. Accordingly, they are not treated as StreetdocMD processors for every activity. Where a Provider or Facility Partner processes data solely on StreetdocMD’s documented instructions, the applicable data-processing terms govern that activity.
6. Family, Proxy Bookings and Children
A family member, caregiver or other person may book for another Patient only where they have appropriate authority to do so. StreetdocMD may request reasonable evidence of that authority and, where appropriate, the Patient’s own confirmation.
For a Patient who cannot legally provide the relevant consent or instruction, StreetdocMD will seek authorisation from a parent, guardian or other person lawfully entitled to act for the Patient, subject to applicable law and any medical-care, vital-interest or other lawful exception. For children, StreetdocMD will apply age-appropriate safeguards and any required parental or guardian authorisation rather than relying on a blanket age rule.
7. Patient Consent Framework
The Privacy Policy is primarily a notice explaining how information is handled. Reading or acknowledging this Policy is not treated as consent to every processing activity. StreetdocMD will request separate affirmative consent where consent is the appropriate lawful basis.
- Required acknowledgement at account registration: “I acknowledge that I have read the StreetdocMD Privacy Policy.”
- Consent controls must not be pre-selected. Silence, inactivity or a default-ON setting is not used as consent where affirmative consent is required.
- A consent request should identify the purpose in clear language and allow the Patient to accept or decline where the processing is optional.
- Consent records should capture the Patient/account, purpose, action, policy or consent version, and date/time.
- A Patient may withdraw an optional consent through the available Platform control or by contacting StreetdocMD. Withdrawal does not invalidate processing that was lawful before withdrawal.
- Refusing or withdrawing optional consent will not prevent access to unrelated Platform functions, although a requested service may be unavailable where the relevant information is genuinely necessary to provide it.
- Consent to data processing is separate from informed consent to medical examination, treatment, procedures or clinical decisions, which remains the responsibility of the appropriate healthcare professional or Facility.
8. How Long We Keep Information
We retain personal data only for as long as reasonably necessary for the purpose for which it was collected or for another lawful purpose. Retention periods may differ for account records, transactions, support records, security logs and health or clinical records. Clinical records may also be subject to retention duties of the healthcare professional or Facility Partner that created or maintains them. We may retain information for longer where reasonably necessary to comply with law, resolve disputes, establish or defend legal claims, prevent fraud or satisfy professional or regulatory obligations.
Where information is no longer required, it will be deleted, anonymised or otherwise handled in accordance with our applicable retention and disposal procedures.
9. Your Data-Protection Rights
Subject to applicable law and relevant exemptions, you may have rights to:
- obtain information about and access personal data we hold about you;
- request correction of inaccurate or incomplete personal data;
- request deletion where the applicable legal conditions are met;
- object to or request restriction of certain processing;
- withdraw consent where processing relies on consent;
- request portability of personal data where applicable;
- raise concerns about qualifying automated decision-making where applicable; and
- lodge a complaint with the Nigeria Data Protection Commission (NDPC).
To exercise a right, contact contact@streetdocmd.com. We may need to verify your identity or authority before acting on a request. A request concerning a Provider’s or Facility Partner’s independent clinical record may need to be addressed by that Provider or Facility Partner.
10. Security
StreetdocMD uses appropriate technical and organisational measures designed to protect personal data against accidental or unlawful destruction, loss, alteration, unauthorised disclosure or access. Measures may include access controls, authentication, encryption where appropriate, audit logging, role-based access, vendor controls, backups, staff controls and periodic security reviews. No electronic system can be guaranteed to be completely secure.
Healthcare-provider access is subject to onboarding and professional-verification processes appropriate to the Provider’s profession and role before access to Patient information is enabled.
11. Personal Data Breaches
StreetdocMD maintains procedures for identifying, assessing, containing and responding to personal-data breaches. Where a breach triggers a legal notification requirement, we will notify the NDPC and/or affected data subjects in the manner and within the period required by applicable law. We may also coordinate with affected Providers, Facility Partners and service providers where necessary.
12. International and Cross-Border Transfers
Some technology or service providers may process or store information outside Nigeria. Where personal data is transferred across borders, StreetdocMD will use a transfer mechanism or other lawful basis recognised under applicable Nigerian data-protection law and apply appropriate safeguards. Information about material service-provider or transfer arrangements may be made available through this Policy or other Platform privacy notices.
14. Automated Matching and Platform Decisions
StreetdocMD may use automated rules, including availability and location or proximity information, to identify or route bookings to potentially available Providers. This is a Platform matching function and does not replace a healthcare professional’s clinical judgment. Where applicable law grants rights in relation to a qualifying solely automated decision that produces legal or similarly significant effects, StreetdocMD will provide the protections required by law.
15. Changes to This Policy
We may update this Policy as our services, technology or legal obligations change. We will publish the current version through the Platform. Where a change is material, we will provide appropriate notice before or when the change takes effect. Where new processing requires consent, we will request that consent separately rather than treating continued use alone as consent.
16. Contact and Complaints
Privacy and data-protection enquiries: contact@streetdocmd.com
Website: www.streetdocmd.com
If you believe your personal data has been handled improperly, you may contact StreetdocMD first so we can investigate. You also have the right to lodge a complaint with the Nigeria Data Protection Commission where applicable.