Privacy Policy
We are committed to protecting your personal health data with the highest standard of care. This policy explains exactly what we collect, how we use it, and the controls you have over your information.
Your health data belongs to you. ITHS — Integrated Telehealth Services — processes personal and health information solely to deliver and improve the healthcare services you use. We do not sell your data, we do not use it for advertising, and we do not share it with any party without a lawful basis to do so. This policy is our full, transparent account of how we handle your information.
Overview & Scope
This Privacy Policy applies to all services operated by Integrated Telehealth Services Limited ("ITHS", "we", "us", or "our"), including our patient mobile application, provider portal, sponsor application, partner portal, and this website (collectively, the "Platform").
By creating an account or using any part of the ITHS Platform, you acknowledge that you have read and understood this Privacy Policy. If you do not agree with any part of this policy, please do not use our services.
Who this policy covers
Patients — individuals who access healthcare services through the ITHS patient app or website.
Providers — doctors, nurses, pharmacists, physiotherapists, phlebotomists, and other healthcare professionals registered on the platform.
Sponsors — individuals who fund and manage healthcare access for beneficiaries through the ITHS Sponsor App.
Partners — organisations (HMOs, hospitals, labs, pharmacies, employers) that access the ITHS platform through a commercial partnership agreement.
Website visitors — anyone who browses our public website without creating an account.
Legal basis & applicable law
ITHS is incorporated and operates in Nigeria. We process personal data in accordance with the Nigeria Data Protection Regulation (NDPR) 2019 and the Nigeria Data Protection Act (NDPA) 2023. Where our services extend to users in other jurisdictions, we apply equivalent protections consistent with applicable local law.
Our lawful bases for processing your data are: performance of a contract (to deliver the services you signed up for); your explicit consent (for sensitive health data); vital interests (emergency care situations); and legal obligation (regulatory and compliance requirements).
Information We Collect
We only collect information that is necessary to provide, operate, and improve the ITHS Platform. The categories of information we collect depend on how you use the platform.
2.1 Information you provide directly
| Category | Examples | Who it applies to |
|---|---|---|
| Identity data | Full name, date of birth, gender, profile photo, government ID | PatientsProvidersSponsors |
| Contact data | Phone number, email address, home/work address | All users |
| Health data | Medical history, diagnoses, prescriptions, lab results, vital signs, allergies, symptoms | Patients |
| Professional credentials | Medical licence, specialty certificates, professional registration numbers, work history | Providers |
| Financial data | Bank account details, card information (tokenised), wallet transaction history | PatientsProvidersSponsors |
| Beneficiary data | Names, contact details, and health service usage of individuals sponsored by a Sponsor user | Sponsors |
| Communications data | Messages sent via in-app chat, feedback submitted, support tickets, complaints | All users |
2.2 Information collected automatically
Device data — device type, operating system, unique device identifier, app version.
Usage data — pages viewed, features used, buttons tapped, session duration, search queries within the app.
Location data — approximate location (city/region level) to match patients with nearby providers; precise GPS location only when you request ambulance dispatch or home-visit services, and only during that session.
Log data — IP address, browser type, access timestamps, error logs, and API call records for security and audit purposes.
2.3 Information from third parties
Professional verification bodies — we verify provider credentials against the Medical and Dental Council of Nigeria (MDCN), Nursing and Midwifery Council of Nigeria (NMCN), and other relevant regulatory bodies.
Payment processors — transaction confirmation and fraud signals from our licensed payment processing partners.
Partner organisations — where you access ITHS through a corporate employer, HMO, or sponsor arrangement, basic enrollment data may be shared by that organisation to set up your account.
Health data is special category data. Under Nigerian data protection law, health and medical information requires explicit consent to process. We request this consent separately during account registration and before any health data is collected. You may withdraw this consent at any time through your account settings, though doing so will limit your ability to receive clinical services on the platform.
How We Use Your Information
We use your personal data only for the purposes described below. We do not use your data for advertising, and we do not build advertising profiles from your health information.
Core service delivery
Matching patients with available, qualified healthcare providers based on service type, location, and specialty.
Facilitating virtual and in-person consultations, including video calls, in-app messaging, and clinical documentation.
Processing and routing lab test requests, sample collection coordination, and result delivery.
Transmitting digital prescriptions to partner pharmacies and tracking medication fulfilment and delivery.
Dispatching emergency ambulance services and sharing necessary location data with the responding crew.
Managing sponsor wallet funding, beneficiary enrollment, and spend visibility for Sponsor users.
Account management & communications
Creating, maintaining, and securing your account, including identity verification and multi-factor authentication.
Sending service notifications — appointment confirmations, lab result alerts, prescription status updates, and payment receipts.
Responding to your support requests, complaints, and feedback.
Safety, compliance & legal obligations
Maintaining clinical audit trails as required by Nigerian healthcare regulations.
Detecting and preventing fraud, unauthorised access, and platform misuse.
Responding to lawful requests from regulatory authorities, courts, or law enforcement agencies.
Managing clinical incidents, patient complaints, and professional conduct investigations.
Platform improvement (anonymised)
Analysing aggregated, de-identified usage patterns to improve the design and performance of the platform.
Generating de-identified population health insights to improve service quality for our provider and partner network. No individual is identifiable in this analysis.
We do not sell your data. ITHS does not sell, rent, or trade any personal information — including health data — to any third party for commercial, advertising, or marketing purposes. This commitment is unconditional and applies to all categories of users.
Your Rights
Under the Nigeria Data Protection Act 2023, you have a number of rights regarding your personal data. We are committed to honouring these rights promptly and without charge in the vast majority of cases.
Right of access
You can request a copy of all personal data we hold about you at any time, including your health records and transaction history.
Right to rectification
If any of your personal data is inaccurate or incomplete, you can request that we correct it — or correct it yourself via account settings.
Right to erasure
You can request deletion of your personal data where it is no longer necessary for the purposes it was collected, subject to legal retention obligations.
Right to data portability
You can request your data in a structured, machine-readable format to transfer to another service — including your full health record history.
Right to restrict processing
You can ask us to pause the processing of your data in certain circumstances — for example, while you contest its accuracy.
Right to withdraw consent
Where processing is based on your consent (including for health data), you can withdraw that consent at any time through your account settings.
Right to object
You can object to processing carried out on the basis of legitimate interests, including any use of your data for platform analytics.
Right to lodge a complaint
If you are unsatisfied with how we have handled your data, you have the right to lodge a complaint with the Nigeria Data Protection Commission (NDPC).
To exercise any of these rights, submit a request to info@iths-afri.com or through the Privacy section of your account settings. We will respond within 30 days. For complex requests, we may extend this to 60 days and will notify you of the extension within the initial 30-day period.
Children's Privacy
The ITHS platform is not directed at children under the age of 18. We do not knowingly collect personal data directly from children. Children may be enrolled as beneficiaries by a parent or legal guardian acting as a Sponsor user — in this case, the parent or guardian is the account holder and is responsible for managing the child's healthcare access.
If a child is enrolled as a beneficiary, we collect only the minimum information necessary to facilitate their care (name, date of birth, and relevant medical history shared by the sponsoring adult). Clinical records for minors are treated with the same security protections as adult records and are accessible only to the sponsoring parent or guardian and the treating provider.
If you believe a child under 18 has created an ITHS account independently, or that we have inadvertently collected a child's data without parental consent, please contact us immediately at info@iths-afri.com. We will investigate and delete any such data promptly.
Data Retention
We retain personal data only for as long as necessary to fulfil the purposes for which it was collected, and to comply with our legal and regulatory obligations.
| Data category | Retention period | Reason |
|---|---|---|
| Health & clinical records | 10 years from last interaction | Nigerian healthcare regulations require medical records to be kept for a minimum of 10 years |
| Account & identity data | Duration of account + 3 years post-closure | Legal obligation, fraud prevention, and dispute resolution |
| Financial & transaction records | 7 years from transaction date | Compliance with FIRS and CAMA financial record requirements |
| Provider credentials | Duration of provider registration + 5 years | Regulatory compliance and clinical liability records |
| Audit & security logs | 3 years | Security incident investigation and regulatory audit requirements |
| Marketing communications | Until opt-out or account deletion | Consent-based — removed immediately on withdrawal of consent |
After the applicable retention period, data is securely deleted or anonymised so that it can no longer identify you. Anonymised data may be retained for aggregate statistical analysis.
Changes to This Policy
We may update this Privacy Policy from time to time to reflect changes in our services, technology, legal requirements, or our data processing practices. When we make material changes, we will:
- 1
Post the updated policy on this page with a revised "last updated" date.
- 2
Send you an in-app notification and email if the changes materially affect how we use your health data or your rights.
- 3
Where required by law, seek fresh consent before applying material changes to the processing of your sensitive health data.
We encourage you to review this policy periodically. Continued use of the ITHS platform after changes take effect constitutes acceptance of the revised policy for non-material changes. For material changes affecting your rights, we will require affirmative acknowledgement.
Version history
| Version | Date | Summary of changes |
|---|---|---|
| v2.1 | 1 June 2025 | Added NDPA 2023 compliance section; updated data retention table; clarified sponsor data sharing rules. |
| v2.0 | 1 January 2025 | Major revision to align with Nigeria Data Protection Act 2023; added children's privacy section; introduced cookie table. |
| v1.0 | 1 March 2022 | Initial policy published at platform launch. |
Contact Us
If you have any questions about this Privacy Policy, how we handle your personal data, or wish to exercise any of your rights, please reach out to us through any of the channels below. We aim to respond to all privacy enquiries within 5 working days.
Registered Address
Integrated Telehealth Services Ltd
Lagos, Nigeria
If you are unsatisfied with our response to a privacy enquiry or complaint, you have the right to escalate your concern to the Nigeria Data Protection Commission (NDPC) at ndpc.gov.ng. The NDPC is the national supervisory authority for data protection in Nigeria.