HeartAfrika is an African health platform for Africa. Our policies, technical controls, and operations follow the Nigeria Data Protection Regulation (NDPR), guidance from the Nigeria Data Protection Commission (NDPC), and other applicable Nigerian laws when handling personal and health-related information for users in Nigeria and across Africa.
Nigeria Data Protection Regulation (NDPR)
HeartAfrika is headquartered in Nigeria and built for Africans. We comply with the NDPR (2019) and NDPC guidance as our primary data protection framework. Our NDPR commitments include:
- Lawful processing: We collect and use personal data only with a valid legal basis—primarily your consent and our legitimate interest in delivering cardiac risk assessment services
- Transparency: Clear notice of what we collect, why we use it, and who we share it with (see sections below)
- Data subject rights: Access, correction, deletion, restriction, objection, and portability as described in Your Rights
- Data minimization & purpose limitation: We collect only what is needed for assessments, support, and service improvement
- Security & breach response: Appropriate technical and organizational measures, with procedures to assess and report notifiable breaches to the NDPC and affected individuals where required
- Cross-border transfers: When data leaves Nigeria, we use safeguards such as contracts and encryption consistent with NDPR requirements
- Data Protection Officer: Our DPO handles NDPR-related requests at privacy@heartafrika.com
Health & Sensitive Personal Data
Under the NDPR, health information you provide—such as vitals, medical history, and assessment results—is treated as sensitive personal data. We apply strict safeguards, including:
- Purpose limitation: Health data is used only for assessments, care support, and related services you request
- Access controls: Staff and systems access only the data required for their role, with audit logging where appropriate
- Encryption: Sensitive data encrypted in transit (TLS) and at rest (AES-256), as detailed in Data Security
- Processors & partners: Third parties that process data on our behalf are bound by NDPR-compliant data processing agreements
- Confidentiality: Personnel with access to health data follow confidentiality and security policies
- Your rights: You may request access, correction, or deletion of your health-related data as set out in Your Rights
HeartAfrika provides wellness and risk-assessment tools for users across Africa. We are not a substitute for emergency care or a licensed healthcare provider. Where you use our service from another African country, we still apply NDPR standards and respect local requirements where they apply.