Privacy Policy

Last updated: March 2026

1. Introduction

Mezo Health Ltd ("Mezo", "we", "our") is committed to protecting the privacy of all users of our platform. This Privacy Policy explains how we collect, use, disclose, and safeguard your information in compliance with the Nigerian Data Protection Act 2023 (NDPA) and applicable regulations.

2. Data We Collect

Patient data: Name, email, phone number, date of birth, gender, HMO details, health records created during consultations.

Doctor data: Name, email, phone number, MDCN folio number, specialty, bank account details, professional qualifications.

Facility data: Facility name, address, equipment, room details.

Technical data: IP address, browser type, device information, session data for security purposes.

3. How We Protect Your Data

All personal health information (PHI) is encrypted at rest using AES-256-GCM field-level encryption. Passwords are hashed with Argon2id. All data in transit is protected by TLS 1.3. Access to data is controlled by role-based access control (RBAC) and logged in an immutable audit trail.

4. Your Rights Under NDPA

Under the Nigerian Data Protection Act 2023, you have the right to:

  • Access: Request a copy of all data we hold about you (FHIR R4 portable format).
  • Rectification: Correct inaccurate personal data.
  • Erasure: Request deletion of your personal data (soft-delete with anonymisation).
  • Data portability: Export your health records in standard FHIR R4 format.
  • Withdraw consent: Opt out of data processing at any time.

5. Data Residency

All primary databases are hosted in secure facilities. Document storage uses encrypted cloud storage with strict access controls. We are committed to data residency in or near Nigeria as infrastructure permits.

6. Breach Notification

In the event of a data breach, we will notify all affected users within 72 hours of detection, as required by NDPA. We will also notify the Nigeria Data Protection Commission (NDPC).

7. Contact

For privacy enquiries or to exercise your data rights, contact our Data Protection Officer at privacy@mezohealth.com.