Vigor Medical Services Limited ("Vigor Medical", "we", "us", or "our") operates a telehealth mobile application and website (the "Platform").
This Privacy Policy explains how we collect, use, disclose, store, and protect your personal data.
This Policy applies to users in Nigeria, the United Kingdom, the European Economic Area (EEA), and other applicable jurisdictions.
1. Data We Collect
We collect only data that is necessary, proportionate, and lawful.
1.1 Personal Information
- Full name
- Email address
- Phone number
- Date of birth
- Gender
- Country of residence
1.2 Health & Medical Information (Sensitive Data)
- Medical history
- Consultation notes
- Prescriptions
- Diagnostic information
- Teleconsultation records
Health data is treated as Sensitive Personal Data and receives enhanced protection.
1.3 Sponsor Information (If Applicable)
Where a third-party sponsor pays for your care:
- Sponsor identity
- Relationship to you
- Consent scope for sponsor access
Sponsors can only access information you explicitly authorise.
1.4 Payment Information
- Transaction ID
- Payment confirmation
- Billing reference
We do NOT store raw debit/credit card numbers. Payments are processed via secure, PCI-DSS compliant payment providers.
1.5 Technical & Device Information
- IP address
- Device type
- Operating system
- App usage logs
- Session timestamps
We do not collect unrelated background data.
2. How We Use Your Data
We use your data strictly for:
- Providing telemedicine consultations
- Delivering medical support services
- Managing sponsorship arrangements
- Processing payments
- Meeting legal and regulatory obligations
- Preventing fraud and securing our systems
We DO NOT:
- Sell your personal data
- Sell your health data
- Use your health data for advertising
- Share medical records with advertisers
- Monetise medical information
3. Legal Basis for Processing
We process data under lawful bases including:
- Your explicit consent
- Contractual necessity
- Compliance with legal obligations
- Protection of vital interests
- Legitimate interests (where balanced against your rights)
For UK and EU users, processing complies with UK GDPR (as amended by DUAA 2025) and EU GDPR.
4. Data Retention
We retain personal and medical data for ten (10) years after:
- You stop using the Platform; or
- Confirmation of demise,
whichever occurs later, unless a longer or shorter period is required by law.
After this period, data is:
- Securely deleted, or
- Anonymised, or
- Archived in compliance with regulatory standards.
5. Data Sharing
We share data only:
- With licensed healthcare professionals involved in your care
- With sponsors (only within your consent scope)
- With payment processors
- With regulatory authorities when legally required
- With vetted service providers under strict Data Processing Agreements
We require all third parties to maintain confidentiality and security standards.
6. Cross-Border Data Transfers
If your data is transferred outside Nigeria, the UK, or the EEA, we ensure:
- Adequacy decisions; or
- Standard Contractual Clauses (SCCs); or
- UK International Data Transfer Agreements (IDTA); or
- Other legally approved safeguards.
7. Data Security
We implement:
- Encryption in transit and at rest
- Role-based access control
- Multi-factor authentication
- Secure cloud infrastructure
- Audit logging
- Incident response procedures
If a data breach occurs, we will notify regulators and affected users in accordance with applicable law.
8. Your Rights
Depending on your jurisdiction, you may have the right to:
- Access your data
- Correct inaccurate data
- Request deletion (subject to legal retention limits)
- Restrict processing
- Object to processing
- Request data portability
- Withdraw consent at any time
You may lodge a complaint with:
- Nigeria Data Protection Commission (NDPC)
- UK Information Commissioner's Office (ICO)
- Relevant EU Data Protection Authority
- USA Health Insurance Portability and Accountability Act (HIPAA)
9. Data Deletion Requests
You may request deletion of your account and personal data by:
- Using the in-app "Delete My Account" feature; OR
- Emailing: support@vigorcare.health
We will process deletion requests in accordance with legal retention obligations.
10. Children's Privacy
The Platform is not intended for children under 18 without lawful parental or guardian representation.
We do not knowingly collect data from minors without proper authorisation.
11. Third-Party Services
We may use third-party services such as:
- Payment processors
- Secure cloud hosting
- Analytics tools (non-medical data only)
Any third-party integration is assessed for data protection compliance.
12. Policy Updates
We may update this Privacy Policy to reflect changes in law or service delivery.
Material changes will be notified via the app or website.
13. Contact Us
Data Protection Officer Vigor Medical Services Limited
Email: support@vigorcare.health
Phone: +2348140715865