Effective date: 29 September 2025
Controller: Z-APT Consult  (“ZAPT”, “we”, “us”, “our”)
Website: https://zaptclinic.com/

Support: support@zaptclinic.com
• Phone: +234 707 603 8250
Address: 10, Onikolobo Road, Ibara, Abeokuta, Ogun State, 110252, Nigeria

1) Scope

This Policy explains how we collect, use, share, and protect personal data processed via the ZAPT Virtual Clinics platform and facility-anchored telemedicine hubs in Ogun State and elsewhere in Nigeria. It covers patients, facility staff, and consulting clinicians.

2) Key Definitions

Personal Data: Information that identifies or can identify an individual.

Health Data: Special category data about health status, care, or diagnostics.

Facility: A participating PHC/private clinic using a ZAPT virtual clinic hub.

Clinician: Licensed doctors/specialists consulting via ZAPT.

Platform: ZAPT apps, web portal, APIs, and connected diagnostic devices.

3) Data We Collect

Identity & Contact: name, gender, DOB/age, phone, email, address, next-of-kin.

Facility/Program: facility ID, enrolment/insurance identifiers (where applicable).

Clinical & Encounter: vitals, symptoms, history, medications, allergies, diagnoses, orders, prescriptions, referrals, images/files; device readings (e.g., digital stethoscope, BP monitor, otoscope).

Operational: appointments, triage notes, care plans, follow-up outcomes.

Technical: device/browser info, IP, app logs, call quality metrics, cookies (see §12).

Payments (if used): payer name, amounts, references. We do not store card PANs; payments are handled by licensed processors.

4) How We Collect It

From patients during registration, triage, and consultations at facilities.

From authorized facility staff (data entry/support).

From connected diagnostics and integrated services.

Automatically from your device/app usage (telemetry and quality metrics).

From third parties (e.g., HMOs/state schemes) where permitted by law.

5) Legal Bases

We process data under the Nigeria Data Protection Act (NDPA) 2023, NDPR 2019, and applicable health regulations based on: consent, contract, legal obligation/public interest, vital interests, and legitimate interests (balanced against your rights).

6) How We Use Data

Provide virtual consultations anchored at facilities; documentation, prescriptions, referrals.

Continuity of care, follow-ups, and clinical decision support.

Quality assurance, supervision, training, and monitoring & evaluation (using de-identified/aggregated data where possible).

Security, fraud prevention, and incident response.

Service analytics and platform improvement (prefer de-identified data).

Legal/regulatory reporting to authorized health authorities.

7) Sharing & Disclosure

We share data only as necessary and with safeguards:

Facilities & Clinicians involved in your care.

Diagnostics/Pharmacy/Referral partners to fulfill orders and referrals.

HMOs/State schemes for eligibility, claims, and audits (where applicable).

Service providers (processors) for hosting, support, messaging, analytics—bound by data processing agreements.

Regulators/Law enforcement when legally required.

De-identified data for public health, research, or service planning with proper approvals.
We do not sell personal data.

8) Cross-Border Transfers

If hosting/support involves locations outside Nigeria, we use adequate safeguards (e.g., contractual clauses, vetted providers) and, where required, data localization. We ensure protections equivalent to NDPA/NDPR standards.

9) Retention

Clinical records are retained per Nigerian health record rules (typically 7–10+ years or as mandated). Operational logs/telemetry are kept only as needed for security and quality. When retention ends, we securely delete or anonymize data.

10) Security

We apply administrative, technical, and physical measures: role-based access, least privilege, encryption in transit/at rest, audit logs, secure device onboarding, vulnerability management, and backups. While no system is 100% secure, we operate an incident response plan and will notify where required by law.

11) Your Rights

Subject to legal limits, you may access, rectify, erase, restrict, object, and port your data; and withdraw consent where processing relies on consent. To exercise rights, email support@zaptclinic.com
. We may verify identity and coordinate with your facility.

12) Cookies & Similar Technologies

We use strictly necessary cookies and, with consent where required, performance/functional cookies (e.g., to improve call quality). You can manage preferences in your browser or app settings. Disabling some cookies may affect functionality.

13) Children & Vulnerable Persons

We process children’s data only with parent/guardian consent or as permitted for public interest/vital interests, in line with safeguarding protocols.

14) Third-Party Links

External sites/services linked from our Platform have their own policies. We are not responsible for their practices.

15) Changes to this Policy

We may update this Policy periodically. Material changes will be communicated in-app and/or at facilities with a new effective date.

16) Contact & Complaints

Z-APT Consult (Zapt Consulting Nigeria Limited)
10, Onikolobo Road, Ibara, Abeokuta, Ogun State, 110252, Nigeria
Support: support@zaptclinic.com
• Phone: +234 707 603 8250
You may also escalate complaints to the Nigeria Data Protection Commission (NDPC).