1import{_ as H}from"./0XTsgG2J.js";import{e as v,m as W,c as u,o as s,a as e,d as S,t as f,f as b,x as T,B as _,D as I,S as P,T as k,n as q,g as x,M as E,aQ as z,bB as U,y as D,b as g,H as V,a1 as R,q as j,v as B,z as A,A as N}from"#entry";import{_ as C}from"./DlAUqK2U.js";import{C as w}from"./DBr935Js.js";import"./Ltqd2rAr.js";import"./BBoVSIOO.js";import"./Dmhids7v.js";import"./CvtDo0MO.js";import"./DC66rAUS.js";import"./DcGhxoNh.js";const M={class:"relative overflow-hidden -mt-20 pt-40 md:pt-60 pb-20 px-6 md:px-12 bg-primary"},O={class:"max-w-7xl mx-auto relative z-20"},$={class:"space-y-4"},F={class:"text-sm md:text-lg text-white/80 max-w-2xl leading-relaxed font-light mt-6"},L=v({__name:"PoliciesHero",setup(h){const n=W();return(y,t)=>(s(),u("section",M,[t[2]||(t[2]=e("div",{class:"absolute top-[-30%] right-[-10%] w-[500px] h-[500px] bg-white/5 rounded-full pointer-events-none z-10"},null,-1)),t[3]||(t[3]=e("div",{class:"absolute bottom-[-5%] left-[35%] w-[400px] h-[200px] bg-white/5 rounded-full pointer-events-none z-10"},null,-1)),e("div",O,[e("div",$,[t[0]||(t[0]=e("p",{class:"text-xs md:text-sm font-semibold tracking-[0.2em] text-white/90 uppercase"}," LEGAL & COMPLIANCE CENTRE ",-1)),t[1]||(t[1]=e("h1",{class:"text-4xl md:text-7xl font-semibold text-white leading-[1.1] max-w-4xl tracking-tight"},[S(" Your Data."),e("br"),S("our Responsibility. ")],-1)),e("p",F,f(b(n).label.pwa.shortName)+" is built on the principle that health data belongs to patients. Here you'll find everything governing how we collect, process, protect, and respect that data. ",1)])])]))}}),Y=C(L,[["__scopeId","data-v-e1f6b450"]]),Z={class:"max-w-7xl mx-auto px-6 md:px-0 py-12"},K={class:"flex flex-wrap gap-8 md:gap-16 mb-12 pb-8"},J={class:"space-y-1"},G={class:"text-sm md:text-base font-bold text-primary"},Q={class:"space-y-1"},X={class:"text-sm md:text-base font-bold text-primary"},ee={class:"space-y-1"},te={class:"text-sm md:text-base font-bold text-primary"},oe={class:"flex flex-col md:flex-row gap-12 relative"},ae={class:"md:w-80 shrink-0"},ie={class:"sticky top-42 space-y-4 pr-4"},re=["onClick"],se={class:"flex-1 space-y-16 min-w-0"},ne=["id"],le={class:"space-y-2"},ce={key:0,class:"text-[10px] font-bold text-gray-300 uppercase tracking-widest"},de={class:"text-sm md:text-xl font-bold text-gray-900"},ue=["innerHTML"],pe=v({__name:"PolicyContent",props:{policy:{}},setup(h){const n=h,y=T(n.policy.sections[0]?.id||""),t=c=>{const i=document.getElementById(c);i&&(i.scrollIntoView({behavior:"smooth"}),y.value=c)};let r=null;return _(()=>{r=new IntersectionObserver(c=>{c.forEach(i=>{i.isIntersecting&&(y.value=i.target.id)})},{rootMargin:"-20% 0px -70% 0px"}),n.policy.sections.forEach(c=>{const i=document.getElementById(c.id);i&&r?.observe(i)})}),I(()=>{r?.disconnect()}),(c,i)=>(s(),u("div",Z,[e("div",K,[e("div",J,[i[0]||(i[0]=e("p",{class:"text-xs text-primary font-medium uppercase tracking-wider"},"Effective Date",-1)),e("p",G,f(h.policy.effectiveDate),1)]),e("div",Q,[i[1]||(i[1]=e("p",{class:"text-xs text-primary font-medium uppercase tracking-wider"},"Version",-1)),e("p",X,f(h.policy.version),1)]),e("div",ee,[i[2]||(i[2]=e("p",{class:"text-xs text-primary font-medium uppercase tracking-wider"},"Jurisdiction",-1)),e("p",te,f(h.policy.jurisdiction),1)])]),e("div",oe,[e("aside",ae,[e("nav",ie,[(s(!0),u(P,null,k(h.policy.sections,o=>(s(),u("button",{key:o.id,class:q(["block w-full text-left text-sm transition-colors duration-200",y.value===o.id?"text-primary font-bold":"text-gray-500 hover:text-primary font-medium"]),onClick:m=>t(o.id)},f(o.title),11,re))),128))])]),e("article",se,[(s(!0),u(P,null,k(h.policy.sections,(o,m)=>(s(),u("section",{id:o.id,key:o.id,class:"scroll-mt-32 space-y-6"},[e("div",le,[o.id!=="contact-us"?(s(),u("p",ce," § 0"+f(m+1),1)):x("",!0),e("h2",de,f(o.title),1)]),o.content?(s(),u("div",{key:0,class:"prose prose-primary max-w-none text-gray-600 leading-relaxed",innerHTML:o.content},null,8,ue)):x("",!0),o.isComponent?(s(),E(U(o.component),z({key:1,ref_for:!0},o.props||{}),null,16)):x("",!0)],8,ne))),128))])])]))}}),he=C(pe,[["__scopeId","data-v-18c28d07"]]),me={class:"grid gap-6 lg:grid-cols-2"},ye=["onSubmit"],fe={class:"mb-6 text-base font-bold text-gray-900"},ge={class:"space-y-5"},be=v({__name:"DataProcessingSignatures",setup(h){const n=["controller","processor"],y={controller:"[Controller Name]",processor:"[Sevenz Health Care]"},t=D({controller:{representativeName:"",title:"",signature:"",signedDate:""},processor:{representativeName:"",title:"",signature:"",signedDate:""}}),r=D({controller:{representativeName:"",title:"",signature:"",signedDate:""},processor:{representativeName:"",title:"",signature:"",signedDate:""}}),c={representativeName:"Name of authorised representative",title:"Title/position",signature:"Signature",signedDate:"Date"},i=(d,p)=>{const a=t[d][p].trim();return a?p==="signedDate"&&Number.isNaN(new Date(a).getTime())?(r[d][p]="Enter a valid date.",!1):(r[d][p]="",!0):(r[d][p]=`${c[p]} is required.`,!1)},o=d=>["representativeName","title","signature","signedDate"].every(a=>i(d,a)),m=d=>{o(d)};return(d,p)=>(s(),u("div",me,[(s(),u(P,null,k(n,a=>e("form",{key:a,class:"rounded-2xl border border-gray-200 bg-white p-6 shadow-sm",novalidate:"",onSubmit:R(l=>m(a),["prevent"])},[e("h3",fe," Signed for and on behalf of "+f(y[a]),1),e("div",ge,[g(b(w),{modelValue:t[a].representativeName,"onUpdate:modelValue":l=>t[a].representativeName=l,label:"Name of Authorised Representative",required:"",placeholder:"Enter authorised representative name","error-message":r[a].representativeName,class:"w-full",onBlur:l=>i(a,"representativeName")},null,8,["modelValue","onUpdate:modelValue","error-message","onBlur"]),g(b(w),{modelValue:t[a].title,"onUpdate:modelValue":l=>t[a].title=l,label:"Title/Position",required:"",placeholder:"Enter authorised representative title/position","error-message":r[a].title,class:"w-full",onBlur:l=>i(a,"title")},null,8,["modelValue","onUpdate:modelValue","error-message","onBlur"]),g(b(w),{modelValue:t[a].signature,"onUpdate:modelValue":l=>t[a].signature=l,label:"Signature",required:"",placeholder:"Enter full name as signature","error-message":r[a].signature,class:"w-full",onBlur:l=>i(a,"signature")},null,8,["modelValue","onUpdate:modelValue","error-message","onBlur"]),g(b(w),{modelValue:t[a].signedDate,"onUpdate:modelValue":l=>t[a].signedDate=l,label:"Date",type:"date",required:"",placeholder:"dd-mm-yy","error-message":r[a].signedDate,class:"w-full",onBlur:l=>i(a,"signedDate")},null,8,["modelValue","onUpdate:modelValue","error-message","onBlur"]),g(b(V),{label:"Submit",type:"submit",variant:"outline",block:"",class:"!justify-center"})])],40,ye)),64))]))}}),we={class:"bg-white min-h-screen"},ve={class:"sticky top-25 z-40 bg-white mt-[-1px] border-b border-gray-100"},xe={class:"max-w-7xl mx-auto px-6 md:px-0"},Pe={class:"-ml-4"},ke=v({__name:"policies",setup(h){const n=j(),y=B(),t=T("terms");_(()=>{const o=n.query.tab;o&&["terms","privacy","cookie","data-processing"].includes(o)&&(t.value=o)}),A(t,o=>{if(n.query.tab!==o){const m=n.path.replace(/\/+/g,"/");y.replace({path:m,query:{...n.query,tab:o}})}}),A(()=>n.query.tab,o=>{o&&["terms","privacy","cookie","data-processing"].includes(o)&&t.value!==o&&(t.value=o)});const r=N(()=>[{value:"terms",label:"Acceptable Use Policy"},{value:"privacy",label:"Privacy Policy"},{value:"cookie",label:"Cookie Policy"},{value:"data-processing",label:"Data Processing Agreement"}]),c={terms:{title:"Acceptable Use Policy",effectiveDate:"1st June 2026",version:"1.0",jurisdiction:"Nigeria & West Africa",sections:[{id:"scope-and-application",title:"Scope and Application",content:` 2 <p>This Acceptable Use Policy applies to all users (patients, healthcare professionals, administrators, caregivers, insurance companies and third parties) of all digital health products of SEVENZ Healthcare, which includes websites, mobile application, patient portal, telemedicine platform, and related digital healthcare services.</p> 3 <p>
3By accessing or using the digital health products of SEVENZ Healthcare, you agree to comply with this Policy, applicable healthcare regulations, privacy laws, and all relevant local and international laws. Violations of this Policy may result in warnings, suspension or termination of access, reporting to relevant authorities, and legal action where necessary.</p> 4 `},{id:"permitted-use",title:"Permitted Use",content:` 5 <p>Users may access and use digital health products of SEVENZ Healthcare solely for lawful healthcare-related purposes. Permitted activities include:</p> 6 <ul class="legal-list"> 7 <li>booking and attending telemedicine consultations;</li> 8 <li>accessing healthcare information and medical records where authorized;</li> 9 <li>communicating with licensed healthcare professionals;</li> 10 <li>managing appointments, prescriptions, and payments;</li> 11 <li>purchasing health insurance, adjudicating claims;</li> 12 <li>using patient support and communication tools appropriately; and</li> 13 <li>accessing wellness, healthcare, and educational resources provided on the platform</li> 14 </ul> 15 <p>Users must use the platform in accordance with this Policy, SEVENZ Healthcare's Terms of Service, applicable healthcare regulations, and all conditions issued by SEVENZ Healthcare or regulatory authorities.</p> 16 `},{id:"prohibited-activities",title:"Prohibited Activities",content:` 17 <p>SEVENZ Healthcare strictly prohibits the misuse of its digital health products. The following activities are expressly forbidden:</p> 18 19 <h4 class="font-bold text-gray-900 mt-6 mb-2">3.1. Unlawful Activities</h4> 20 <p>Using the platform for any unlawful, fraudulent, or harmful purpose is prohibited. This includes:</p> 21 <ul class="legal-list"> 22 <li>identity theft or impersonation;</li> 23 <li>fraudulent healthcare claims or insurance fraud;</li> 24 <li>unlawful sale or distribution of medications;</li> 25 <li>sharing false medical information;</li> 26 <li>financing illegal activities or money laundering; and</li> 27 <li>any conduct that violates Nigerian law or international regulations</li> 28 </ul> 29 <p>Users must not use the platform to facilitate criminal activity, harassment, exploitation, trafficking, or the distribution of prohibited or illegal content.</p> 30 31 <h4 class="font-bold text-gray-900 mt-6 mb-2">3.2. Security Violations</h4> 32 <p>Users must not attempt unauthorized access to any SEVENZ Healthcare digital health product, account, database, or infrastru
32cture.</p> 33 <p>Prohibited activities include:</p> 34 <ul class="legal-list"> 35 <li>hacking or attempting to breach platform security;</li> 36 <li>probing, scanning, or testing system vulnerabilities without authorization;</li> 37 <li>distributing malware, viruses, trojans, or malicious code;</li> 38 <li>using stolen login credentials or unauthorized accounts;</li> 39 <li>disrupting telemedicine services or system operations; and</li> 40 <li>launching denial of service or similar attacks.</li> 41 <li>social engineering / phishing, impersonating staff or patients to gain access</li> 42 <li>man-in-the-middle attacks, intercepting communications between users and the platform</li> 43 <li>API abuse scraping, excessive automated requests, or exploiting undocumented endpoints</li> 44 <li>privilege escalation, using a legitimate account to access resources beyond your permission level</li> 45 <li>session hijacking, stealing or reusing another user's active session token</li> 46 <li>unauthorised data exfiltration, downloading or copying patient records beyond legitimate use isn't explicitly named</li> 47 <li>data manipulation, tampering with medical records, test results, or prescriptions (this is arguably the most dangerous threat in an EMR context)</li> 48 <li>re-identification of anonymised data, attempting to reverse anonymisation on any datasets</li> 49 </ul> 50 <p>Any action that compromises platform security or patient safety may result in immediate suspension and legal reporting.</p> 51 52 <h4 class="font-bold text-gray-900 mt-6 mb-2">3.3. Misuse of Healthcare Services</h4> 53 <p>Users must not misuse telemedicine or healthcare services provided by SEVENZ Healthcare.</p> 54 <p>These include:</p> 55 <ul class="legal-list"> 56 <li>falsifying medical information or health records;</li> 57 <li>impersonating licensed healthcare professionals;</li> 58 <li>obtaining prescriptions fraudulently;</li> 59 <li>using another patient's account or medical records without authorization;</li> 60 <li>recording consultations without consent where prohibited by law; and</li> 61 <li>interfering with healthcare delivery or emergency response services.</li> 62 </ul> 63 <p>Healthcare professionals using the platform comply with all applicable professional ethics and licensing obligations.</p> 64 65 <h4 class="font-bold text-gray-900 mt-6 mb-2">3.4. Content Submission and Communications</h4> 66 <p>When submitting or transmitting content through the platform, users must ensure such content is lawful, respectful, and appropriate.</p> 67 <p>Prohibited content includes content that is:</p> 68 <ul class="legal-list"> 69 <li>defamatory, abusive, hateful, or discriminatory;</li> 70 <li>obscene, pornographic, or sexually explicit;</li> 71 <li>misleading or fraudulent;</li> 72 <li>threatening or harassing;</li> 73 <li>infringing on intellectual property rights; or</li> 74 <li>harmful to patients, healthcare workers, or the public</li> 75 </ul> 76 <p>Users must not send spam, phishing messages, unsolicited advertisements, or deceptive communications. False identities or misleading contact information must not be used.</p> 77 <p>SEVENZ Healthcare reserves the right to remove or restrict any content that violates this Policy.</p> 78 79 <h4 class="font-bold text-gray-900 mt-6 mb-2">3.5. Intellectual Property Abuse</h4> 80 <p>Users must respect intellectual property rights related to SEVENZ Healthcare and third parties.</p> 81 <p>You may not:</p> 82 <ul class="legal-list"> 83 <li>copy or redistribute platform materials without authorization;</li> 84 <li>upload copyrighted content without permission;</li> 85 <li>misuse trademarks, branding, software, or medical resources; or</li> 86 <li>reverse-engineer or unlawfully reproduce any part of the platform.</li> 87 </ul> 88 89 <h4 class="font-bold text-gray-900 mt-6 mb-2">3.6. Privacy and Data Misuse</h4> 90 <p>Users must handle all personal, medical, and financial information in compliance with the Nigeria Data Protection Act (NDPA) 2023 and applicable healthcare privacy laws.</p> 91 <p>Users must not:</p> 92 <ul class="legal-list"> 93 <li>access another person's medical records without authorization;</li> 94 <li>harvest or scrape personal or patient data;</li> 95 <li>disclose confidential health information unlawfully;</li> 96 <li>use patient information for unauthorized marketing;
96 or</li> 97 <li>engage in phishing, identity theft, or deceptive data collection practices.</li> 98 </ul> 99 <p>Patient confidentiality and data protection are critical obligations on all digital health products of SEVENZ Healthcare.</p> 100 101 <h4 class="font-bold text-gray-900 mt-6 mb-2">3.7. Automation and Unauthorized Access Tools</h4> 102 <p>Automated access to the platform is prohibited unless expressly authorized by SEVENZ Healthcare.</p> 103 <p>Users may not use:</p> 104 <ul class="legal-list"> 105 <li>bots, crawlers, scrapers, or automated scripts;</li> 106 <li>unauthorized API connections; or</li> 107 <li>automated systems that overload or disrupt platform operations.</li> 108 </ul> 109 <p>Bulk automated actions designed to imitate human activity or interfere with healthcare operations are prohibited.</p> 110 111 <h4 class="font-bold text-gray-900 mt-6 mb-2">3.8. Abuse of Infrastructure</h4> 112 <p>Users must not engage in activities that degrade platform performance or negatively affect other users.</p> 113 <p>This includes:</p> 114 <ul class="legal-list"> 115 <li>excessive system abuse or spam;</li> 116 <li>disrupting consultations or appointments;</li> 117 <li>interfering with platform operations;</li> 118 <li>harassment or threats toward staff, healthcare professionals, or users; and</li> 119 <li>attempts to bypass platform safeguards or restrictions.</li> 120 </ul> 121 122 <h4 class="font-bold text-gray-900 mt-6 mb-2">3.9. Compliance with Laws and Regulations</h4> 123 <p>Users must comply with all applicable laws, healthcare regulations, cybersecurity laws, and data protection requirements.</p> 124 <p>This includes compliance with:</p> 125 <ul class="legal-list"> 126 <li>the Nigeria Data Protection Act (NDPA) 2023;</li> 127 <li>Cybercrimes (Prohibition, Prevention, etc.) Act;</li> 128 <li>healthcare licensing and ethics regulations; and</li> 129 <li>any other applicable local or international healthcare standards.</li> 130 </ul> 131 <p>Users agree to cooperate with lawful investigations where required.</p> 132 `},{id:"enforcement-and-consequences",title:"Enforcement and Consequences",content:` 133 <p>SEVENZ Healthcare reserves the right to enforce this Policy at its sole discretion. Violations may result in:</p> 134 135 <h4 class="font-bold text-gray-900 mt-6 mb-2">4.1. Investigation</h4> 136 <p>SEVENZ Healthcare may monitor, review, log, and investigate suspicious activities, platform usage, and security incidents.</p> 137 138 <h4 class="font-bold text-gray-900 mt-6 mb-2">4.2. Account Restrictions or Suspension</h4> 139 <p>Depending on the severity of the violation, SEVENZ Healthcare may issue warnings, restrict access, suspend accounts, or permanently terminate access to the platform.</p> 140 141 <h4 class="font-bold text-gray-900 mt-6 mb-2">4.3. Content Removal</h4> 142 <p>Any content that violates this Policy may be removed without notice.</p> 143 144 <h4 class="font-bold text-gray-900 mt-6 mb-2">4.4. Compliance with Laws and Regulations</h4> 145 <p>SEVENZ Healthcare may cooperate with law enforcement agencies, healthcare regulators, and data protection authorities where necessary. Violations involving fraud, cybersecurity offenses, unauthorized access, or unlawful disclosure of patient information may result in civil or criminal liability. Users may also be held responsible for any damages, losses, or liabilities arising from their violation of this Policy.</p> 146 `},{id:"intellectual-property-service-availability",title:"Amendments and Updates",content:` 147 <p>SEVENZ Healthcare may update this Acceptable Use Policy from time to time to reflect operational, legal, technological, or regulatory changes.</p> 148 <p>Any updates become effective immediately upon publication on the platform. Continued use of the platform after updates constitutes acceptance of the revised Policy.</p> 149 <p>Users are encouraged to review this Policy periodically.</p> 150 `},{id:"acknowledgement",title:"Acknowledgement",content:` 151 <p>
151By accessing or using SEVENZ Healthcare's digital health products, you acknowledge that you have read, understood, and agreed to comply with this Acceptable Use Policy and all related terms and conditions.</p> 152 `}]},privacy:{title:"Privacy Policy",effectiveDate:"1st June 2026",version:"1.0",jurisdiction:"Nigeria & West Africa",sections:[{id:"introduction",title:"Introduction",content:` 153 <p>Sevenz Healthcare Services Ltd. operates the KompleteCare EMR platform, a cloud-based Electronic Medical Records system serving healthcare providers across Nigeria and the broader West African region. For data protection law purposes including the NDPA 2023 and NDPR 2019 KompleteCare acts as a data processor on behalf of healthcare facilities (data controllers) that subscribe to the product</p> 154 `},{id:"purpose-and-important-information",title:"Purpose and Important Information",content:` 155 <h4 class="font-bold text-gray-900 mt-6 mb-2">2.1. Purpose</h4> 156 <p>This privacy policy explains how Sevenz Healthcare collects and processes the personal information on the Platform and the security measures we have in place to ensure confidentiality of your personal information.</p> 157 158 <h4 class="font-bold text-gray-900 mt-6 mb-2">2.2. Consent</h4> 159 <p>By consenting to this Policy, you agree that you have read the contents of this Policy and they are acceptable to you, and you consent to Sevenz Healthcare processing your personal data as provided in this Policy.</p> 160 161 <h4 class="font-bold text-gray-900 mt-6 mb-2">2.3. Data Controller</h4> 162 <p>Sevenz Healthcare is the data controller and is responsible for your personal data. However, it is also possible for Sevenz Healthcare to act as a data processor, depending on the specific contractual relationship between you and Sevenz Healthcare.</p> 163 164 <h4 class="font-bold text-gray-900 mt-6 mb-2">2.4. Changes to the Notice and your Duty to Inform Sevenz Healthcare of Changes in your personal data</h4> 165 <p>We keep our Policy under regular review. We will notify you once we make any changes to our Policy. We will endeavour to notify you once we update the Policy. It is important that the personal data we hold about you is accurate and current. You are to keep us informed if your personal data changes during your relationship with us.</p> 166 167 <h4 class="font-bold text-gray-900 mt-6 mb-2">2.5. Third-Party Links</h4> 168 <p>The present document may include links to third-party websites, plug-ins and applications. Clicking on those links or enabling those connections may allow third parties to collect or share data about you. We do not control these third-party websites and are not responsible for their privacy statements. When you leave our platform, we encourage you to read the Privacy Policy or Notice of every website, plug-in or application you visit.</p> 169 170 <h4 class="font-bold text-gray-900 mt-6 mb-2">2.6. Our Data Protection Officer</h4> 171 <p>If you have any questions or concerns about this Policy or our data privacy practice, or if you believe we have breached any of your rights as a data subject under this Policy or under the law, please contact our Data Protection Office at <a href="mailto:[email protected]" class="text-primary underline">[email protected]</a>.</p> 172 `},{id:"information-we-collect",title:"Information we Collect",content:` 173 <h4 class="font-bold text-gray-900 mt-6 mb-2">3.1. Personal Information</h4> 174 <p>Personal data or personal information refers to any information about an individual from which that person can be identified. When you register for our services, we will need to collect, use, store, and transfer kinds of personal data about you which we have grouped together as follows:</p> 175 <ul class="legal-list"> 176 <li>Identity data: includes first name, maiden name, last name, username or similar identifier, marital status, title, date of birth and gender</li> 177 <li>Contact data: includes billing address, residential address, business address, email address and telephone numbers</li> 178 <li>Patient health data : entered by healthcare providers includes names, dates of birth, national IDs, medical history, diagnoses, clinical notes, prescriptions, lab results, vital signs, and insurance details.</li> 179 <li>Healthcare provider & staff data : includes names, professional registration numbers, and system activity logs.</li> 180 <li>Technical data: includes internet protocol (IP) address, your login data, browser type and version, time zone setting and location, browser plug-in types and versions, operating system and platform, and other technology on the devices you use to access our Platform</li> 181 <li>Profile data: includes your username and password, purchases or orders made by you, your interests, preferences, feedback and survey responses</li> 182 <li>Usage data: includes information on how you use our Platform</li> 183 <li>Marketing and Communication Data: includes your preferences in receiving marketing from us and our third parties and your communication preferences.</li> 184 </ul> 185 186 <h4 class="font-bold text-gray-900 mt-6 mb-2">3.2.</h4> 187 <p>
187In addition to the above, your personal data may also be collected when you voluntarily provide such information, such as when you contact us with inquiries or respond to one of our surveys.</p> 188 189 <h4 class="font-bold text-gray-900 mt-6 mb-2">3.3. Other information</h4> 190 <p>Some personally non-identifiable data may be collected when you make use of the Platform. Such information, which is collected passively using various technologies, cannot presently be used to specifically identify you. Sevenz Healthcare may store such information itself or such information may be included in databases owned and maintained by Sevenz Healthcare affiliates, agents or service providers. We may use such information and pool it with other information to perform certain tasks such as grant you access to some parts of the Platform or improve our services.</p> 191 <p>Where we need to collect personal data pursuant to Applicable Laws, or under the terms of a contract we have with you, and you fail to provide that data when requested or fail to update your details with us, we may not be able to perform the contract we have or are trying to enter into with you (for example, to provide you with our services). In this case, we may have to cancel a product or service you have with the Company but we will notify you if this is the case at the time.</p> 192 `},{id:"how-is-your-personal-data-collected",title:"How is your Personal Data Collected",content:` 193 <h4 class="font-bold text-gray-900 mt-6 mb-2">4.1. Direct interactions</h4> 194 <p>You may give us your information by filling in forms or by corresponding with us by post, phone, email or otherwise. This includes personal data you provide when you:</p> 195 <ul class="legal-list"> 196 <li>create an account on any digital health product that we own;</li> 197 <li>subscribe to our service or publications;</li> 198 <li>request marketing to be sent to you;</li> 199 <li>enter a competition, promotion or survey; or</li> 200 <li>give us feedback or contact us.</li> 201 </ul> 202 203 <h4 class="font-bold text-gray-900 mt-6 mb-2">4.2. Automated technologies or interactions.</h4> 204 <p>As you interact with our Platform, we will automatically collect Technical Data about your equipment, browsing actions and patterns. We collect this personal data by using cookies, server logs and other similar technologies. We may also receive Technical Data about you if you visit other websites employing our cookies. Please see our <a href="/policies?tab=cookie" class="text-primary underline">cookie policy</a> for further details.</p> 205 206 <h4 class="font-bold text-gray-900 mt-6 mb-2">4.3. Third parties or publicly available sources</h4> 207 <p>We will receive personal data about you from various third parties.</p> 208 `},{id:"how-we-use-your-personal-data",title:"How We Use Your Personal Data",content:` 209 <p>We will only use your personal data when the law allows us to. Most commonly, we will use your personal data in the following circumstances:</p> 210 <ul class="legal-list"> 211 <li>Where we need to perform the contract between you and Sevenz Healthcare</li> 212 <li>Where you provide consent. You have the right to withdraw consent to marketing at any time by contacting us.</li> 213 <li>Where it is necessary for our legitimate interests (or those of a third party) and your interests and fundamental rights do not override those interests.</li> 214 <li>Where we need to comply with a legal obligation.</li> 215 </ul> 216 `},{id:"purpose-for-which-we-use-your-personal-data",title:"Purpose for Which We Use Your Personal Data",content:` 217 <p>We may process your personal data for any of the purposes below:</p> 218 <ul class="legal-list"> 219 <li>To process your registration on the Platform.</li> 220 <li>To allow us to better serve you in responding to your customer service requests.</li> 221 <li>To quickly process your transactions.</li> 222 <li>To follow up with you after correspondence (email or phone inquiries).</li> 223 <li>To help us to develop the Platform and our services.</li> 224 <li>To provide your information to our customer service agents for research and analysis purposes so that we can monitor and improve the services we provide. We or our agents and sub-contractors may contact you by post, e-mail or telephone to ask you for your feedback and comments on our services.</li> 225 <li>To provide you with information about special features of our App or any other service or products we think may be of interest to you.</li> 226 <li>To provide you with related information from third parties we think may be of interest to you.</li> 227 <li>To provide your information to carefully selected third parties whose products or services we believe may be of interest to you. These third-party sites have separate and independent privacy policies. We therefore have no responsibility or liability for the content and activities of these linked sites. We seek to protect the integrity of our site and welcome any feedback about these sites.</li> 228 </ul> 229 <p class="font-bold text-gray-900 mt-6 mb-2">Other information</p> 230 <p>We will only use your personal data for the purposes for which we have collected it unless we reasonably consider that we need to use it for another reason and that reason is compatible with the original purpose. If you wish to get an explanation as to how the processing for the new purpose is compatible with the original purpose, please <a href="#contact-us" class="text-primary underline">contact us</a>.</p> 231 <p>If we need to use your personal data for an unrelated purpose, we will notify you and we will explain the legal basis which allows us to do so.</p> 232 <p>Please note that we may process your personal data without your knowledge or consent, in compliance with the above rules, where this is required or permitted by Applicable Law.</p> 233 `},{id:"our-disclosure-of-personal-and-other-information",title:"Our Disclosure of Personal and Other Information",content:` 234 <p>We may share your personal data with certain third parties without further notice to you, in certain instances. We have set out some of the instances below:</p> 235 236 <p class="font-bold text-gray-900 mt-6 mb-2">Related Companies</p> 237 <p>We may share your personal data with our related companies for purposes consistent with this Policy.</p> 238 239 <p class="font-bold text-gray-900 mt-6 mb-2">Agents, Consultants and Related Third Parties</p> 240 <p>Sevenz Healthcare may engage other companies and professionals within and outside Nigeria to perform certain business-related functions. Examples of such functions include mailing information, maintaining databases. When we employ another entity to perform a function of this nature, we will only provide them with the information that they need to perform their specific function.</p> 241 242 <p class="font-bold text-gray-900 mt-6 mb-2">Legal Requirements</p> 243 <p>Sevenz Healthcare may disclose your personal data if required to do so by law or in the good faith belief that such action is necessary to (i) comply with a legal obligation, (ii) protect and defend the rights or property of Sevenz Healthcare, (iii) act in urgent circumstances to protect the personal safety of users of the services or the public, or (iv) protect against legal liability.</p> 244 245 <p class="font-bold text-gray-900 mt-6 mb-2">Business Transfers</p> 246 <p>As we develop our business, we might sell or buy businesses or assets. In the event of a corporate sale, merger, reorganization, dissolution or similar event, personal data may be part of the transferred assets.</p> 247 <p>We require all third parties to respect the security of your personal data and to treat it in accordance with the law. We do not allow our third-party service providers to use your personal data for their own purposes and only permit them to process your personal data for specified purposes and in accordance with our instructions.
247</p> 248 `},{id:"our-use-of-cookies-and-other-information-gathering-technologies",title:"Our Use of Cookies and Other Information Gathering Technologies",content:` 249 <p>In operating the Platform, we may use a technology called "cookies". A cookie is a piece of information that the computer that hosts our Website gives to your browser when you access the Website. Our cookies help provide additional functionality to the Website and help us analyze Website usage more accurately. For instance, our Site may set a cookie on your browser that allows you to access the Services without needing to remember and then enter a password more once during a visit to the Site. In all cases in which we use cookies, we will not collect Personal Data except with your permission or use information gathered for tracking purposes.</p> 250 `},{id:"how-we-protect-your-information",title:"How We Protect Your Information",content:` 251 <p>We have put in place various appropriate security procedures as set out in this policy, to prevent your personal data from being lost, used or accessed without authorisation.</p> 252 <ul class="legal-list"> 253 <li>Our Platform is scanned on a regular basis for security holes and known vulnerabilities in order to make your visit to our Platform as safe as possible.</li> 254 <li>We use regular malware scanning.</li> 255 <li>Your personal information is contained behind secured networks and is only accessible by a limited number of persons who need to know. They have special access rights to such systems and are required to only process your personal data on our instruction and to keep the information confidential. In addition, all sensitive/credit information you supply is encrypted via Secure Socket Layer (SSL) technology.</li> 256 <li>We have put in place procedures to deal with any suspected personal data breach and will notify you and any applicable regulator of a breach where we are legally required to do so.</li> 257 </ul> 258 `},{id:"how-long-we-keep-your-personal-data",title:"How Long We Keep Your Personal Data?",content:` 259 <h4 class="font-bold text-gray-900 mt-6 mb-2">10.1. Data Retention</h4> 260 <p>We keep your personal and health information only as long as needed to provide your care and comply with the law. In a telemedicine setting, this means keeping consultation notes, prescriptions, diagnostics and related billing records for the duration of your treatment and any required follow-up. We consider factors like the type and sensitivity of the data, the purpose of processing, and the risk of misuse when deciding how long to retain records. For example, we retain data as long as we have a lawful basis to do so â only while it is needed for your care or as required by regulations. If a dispute, audit or legal issue arises (e.g. a complaint or litigation), we may retain the relevant data longer to resolve it. Once the data is no longer needed for your care or any legal requirement, we will securely delete it or irreversibly anonymise it so it can't be linked back to you.</p> 261 <ul class="legal-list"> 262 <li><strong>Retention criteria:</strong> We use only the minimum retention period necessary. Our team reviews records and deletes any data that are no longer needed or where we no longer have a lawful basis to keep them. We follow legal and professional guidelines â for example, UK health guidance generally requires keeping adult medical records about 8â10 years after treatment, and Nigeria's NDPA explicitly mandates deleting data once its lawful basis ends.</li> 263 <li><strong>Legal and regulatory requirements:</strong> Certain laws or regulations may obligate us to keep data longer (for tax, accounting, or safety reasons). We keep some information for these purposes only as long as required. Backup copies may exist briefly for disaster recovery, but they are automatically purged or rendered unusable after a short time.</li> 264 <li><strong>Your rights:</strong> You have the right to request access to, correction of, or deleti
264on of your personal and health data. For example, you can ask us to erase your data (the "right to be forgotten"), except where the law requires us to retain certain records. We will honour such requests promptly unless a legal obligation prevents us from doing so. (You can find more detail on your rights in the "Your legal rights" section below.)</li> 265 <li><strong>Anonymisation:</strong> When we delete data, we remove all identifiers so it can no longer identify you. In some cases we may use anonymised (de-identified) data for research, training or statistics. Since anonymised information can't be traced back to an individual, we may keep and use it indefinitely.</li> 266 </ul> 267 <p class="mt-4">In summary, we retain your telemedicine records only for as long as necessary for your care or to meet legal requirements. After that, we delete or de-identify the data. This helps ensure your privacy and complies with healthcare data laws. For exact retention periods (which can vary by record type and jurisdiction), you can request our data retention policy.</p> 268 `},{id:"what-rights-do-you-have",title:"What Rights Do You Have?",content:` 269 <p>Under certain circumstances, you have rights under the Applicable Laws in relation to your personal data.</p> 270 <p>You have the right to:</p> 271 <h4 class="font-bold text-gray-900 mt-6 mb-2">11.1. Request access to your personal data (commonly known as a "data subject access request").</h4> 272 <p>This enables you to receive a copy of the personal data we hold about you and to check that we are lawfully processing it.</p> 273 274 <h4 class="font-bold text-gray-900 mt-6 mb-2">11.2. Request correction of the personal data that we hold about you</h4> 275 <p>This enables you to have any incomplete or inaccurate data we hold about you corrected, though we may need to verify the accuracy of the new data you provide to us.</p> 276 277 <h4 class="font-bold text-gray-900 mt-6 mb-2">11.3. Request erasure of your personal data</h4> 278 <p>This enables you to ask us to delete or remove personal data where there is no good reason for us continuing to process it. You also have the right to ask us to delete or remove your personal data where you have successfully exercised your right to object to processing (see below), where we may have processed your information unlawfully or where we are required to erase your personal data to comply with local law. Note, however, that we may not always be able to comply with your request of erasure for specific legal reasons which will be notified to you, if applicable, at the time of your request.</p> 279 280 <h4 class="font-bold text-gray-900 mt-6 mb-2">11.4. Objecting to Process your personal data</h4> 281 <p>Object to processing of your personal data where we are relying on a legitimate interest (or those of a third party) and there is something about your particular situation which makes you want to object to processing on this ground as you feel it impacts on your fundamental rights and freedoms. You also have the right to object where we are processing your personal data for direct marketing purposes. In some cases, we may demonstrate that we have a compelling legitimate basis to process your information which overrides your rights and freedoms.</p> 282 283 <h4 class="font-bold text-gray-900 mt-6 mb-2">11.5. Request restriction of processing of your personal data.</h4> 284 <p>This enables you to ask us to suspend the processing of your personal data in the following scenarios:</p> 285 <ul class="legal-list"> 286 <li>If you want us to establish the data's accuracy.</li> 287 <li>Where our use of the data is unlawful but you do not want us to erase it.</li> 288 <li>Where you need us to hold the data even if we no longer require it as you need it to establish, exercise or defend legal claims</li> 289 <li>You have objected to our use of your data, but we need to verify whether we have an overriding legitimate basis to use it.</li> 290 </ul> 291 292 <h4 class="font-bold text-gray-900 mt-6 mb-2">11.6. Request the transfer of your personal data to you or to a third party</h4> 293 <p>We will provide to you, or a third party you have chosen, your personal data in a structured, commonly used, machine-readable format. Note that this right only applies to automated information which you initially provided consent for us to use or where we used the information to perform a contract with you.</p> 294 295 <h4 class="font-bold text-gray-900 mt-6 mb-2">11.7. Withdraw consent at any time where we are relying on consent to process your personal data</h4> 296 <p>However, this will not affect the lawfulness of any processing carried out before you withdraw your consent. If you withdraw your consent, we may
296not be able to provide certain products or services to you. We will advise you if this is the case at the time you withdraw your consent.</p> 297 <p>If you wish to exercise any of the rights set out above, please <a href="#contact-us" class="text-primary underline font-medium">contact us</a>.</p> 298 `},{id:"available-remedies-in-the-case-of-breach",title:"Available Remedies in the Case of Breach",content:` 299 <p>In the case of a breach of any of the obligations with respect to your personal data, a data breach procedure is established and maintained in order to deal with incidents concerning personal data or privacy practices leading to the accidental or unlawful destruction, loss, alteration, unauthorized disclosure of, or access to, personal data transmitted, stored or otherwise processed. On notification of such breach, Sevenz Healthcare will investigate to determine if an actual breach has occurred and Sevenz Healthcare will take such actions required to manage such breach.</p> 300 <p>In the event you believe we have breached any applicable law or this Policy, you have the right to file a complaint with the Nigeria Data Protection Commission. You may however contact our Data Protection Office to enable us to rectify such breach as soon as possible.</p> 301 `},{id:"contact-us",title:"Contact Us",content:` 302 <p>You can contact us at our office at 1st Floor, UAC Building, Central Business District, Garki, Abuja, FCT, Nigeria.</p> 303 <p>Email address: <strong>[email protected]</strong></p> 304 <p>You may contact our Data Protection Office via <strong>[email protected]</strong></p> 305 <p>Phone number: <strong>+234 (0) 817 4290 703, +234 (0) 817 4290 702</strong></p> 306 307 <div class="flex flex-wrap gap-3 mt-6"> 308 <div class="inline-flex items-center gap-2 px-4 py-2 bg-[#FAF8F3] border border-gray-100 rounded-full text-sm text-gray-600"> 309 <span class="w-1.5 h-1.5 rounded-full bg-primary/60"></span> 310 www.emr.kompletecare.com/privacy 311 </div> 312 <div class="inline-flex items-center gap-2 px-4 py-2 bg-[#FAF8F3] border border-gray-100 rounded-full text-sm text-gray-600"> 313 <span class="w-1.5 h-1.5 rounded-full bg-primary/60"></span> 314 Sevenz Healthcare Services Limited., Abuja, Nigeria 315 </div> 316 </div> 317 318 <div class="mt-12 mb-0 p-4 bg-primary/10 rounded-sm"> 319 <p class="text-gray-500 !mb-0 text-sm"> 320 This Privacy Policy should be read together with the <span class="font-bold text-gray-700">KompleteCare EMR Acceptable Use Policy.</span> 321 </p> 322 </div> 323 `}]},cookie:{title:"Cookie Policy",effectiveDate:"10th June 2026",version:"1.0",jurisdiction:"Nigeria & West Africa",sections:[{id:"what-are-cookies",title:"What Are Cookies",content:` 324 <p>Cookies are small data files stored on your browser or the hard drive of your phone, tablet, or computer when you visit a website or use a mobile application.</p> 325 `},{id:"how-we-use-cookies",title:"How We Use Cookies",content:` 326 <p>We use Cookies to identify users on all SEVENZ Healthcare digital health products, including our website (âthe Siteâ). Cookies may also be used by third-party services where you access third-party links through the Site.</p> 327 <p>Cookies helps us to:</p> 328 <ul class="legal-list"> 329 <li>improve your user experience;</li> 330 <li>customize healthcare services, features, and content;</li> 331 <li>maintain secure access to your patient account and telemedicine sessions;</li> 332 <li>remember your login details and preferences;</li> 333 <li>support appointment scheduling and virtual consultations;</li> 334 <li>monitor system performance and traffic;</li> 335 <li>prevent fraud, unauthorized access, and misuse of the platform; and</li> 336 <li>promote trust, safety, and platform reliability.</li> 337 </ul> 338 <p>Cookies may also allow our servers to remember your account log-in information, IP address, date and time of visits, device information, and activity on the platform to supp
338ort secure and efficient healthcare delivery.</p> 339 `},{id:"the-types-of-cookies-we-use",title:"The Types of Cookies We Use",content:` 340 <p>We use the following categories of cookies:</p> 341 <h4 class="font-bold text-gray-900 mt-6 mb-2">Strictly Necessary Cookies</h4> 342 <p>These cookies are essential for the operation of the Site. They enable users to securely log in, book appointments, access telemedicine consultations, manage patient records, process payments where applicable, and use core healthcare services available on the platform.</p> 343 <h4 class="font-bold text-gray-900 mt-6 mb-2">Analytical or Performance Cookies</h4> 344 <p>These cookies allow us to recognize and count the number of users and understand how visitors interact with the Site. This helps us improve the performance, accessibility, and usability of our healthcare services and digital experience.</p> 345 <h4 class="font-bold text-gray-900 mt-6 mb-2">Functionality Cookies</h4> 346 <p>These cookies recognize you when you return to the Site and help us personalize your experience by remembering your preferences, such as language settings, saved information, or accessibility preferences.</p> 347 <h4 class="font-bold text-gray-900 mt-6 mb-2">Targeting Cookies</h4> 348 <p>These cookies record your visits to the Site, including pages visited and links followed. We may use this information to improve the relevance of healthcare information, wellness resources, and service recommendations provided to users.</p> 349 `},{id:"how-to-disable-cookies",title:"How to Disable Cookies",content:` 350 <p>Some browsers automatically accept cookies, while others can be modified to decline cookies or notify you when a website attempts to place a cookie on your device.</p> 351 <p>You can block cookies by activating the appropriate settings on your browser. However, if you disable essential cookies, some parts of the SEVENZ Healthcareâs digital health products or Site may not function properly, including access to telemedicine consultations, patient dashboards, or appointment booking features.</p> 352 `},{id:"updates-to-this-policy",title:"Updates to this Policy",content:` 353 <p>SEVENZ Healthcare may update this Cookie Policy from time to time to reflect changes in legal requirements, healthcare regulations, te
353chnology, or our services.</p> 354 <p>Where updates are made, the âLast Updatedâ date of this Cookie Policy will be revised accordingly. Any modifications shall become effective immediately upon posting the updated Cookie Policy on the Site. Users are encouraged to review this page periodically to stay informed about any changes.</p> 355 `},{id:"consent",title:"Consent",content:` 356 <div class="flex items-start gap-3 mt-4"> 357 <input type="checkbox" id="cookie-consent-checkbox" class="mt-1 rounded border-gray-300 text-primary focus:ring-primary" /> 358 <label for="cookie-consent-checkbox" class="text-gray-600 text-sm leading-relaxed"> 359 By continuing to use the SEVENZ Health Care App or Site, you acknowledge that you have read and understood this Cookie Policy and agree to the use of cookies as described herein. 360 </label> 361 </div> 362 <div class="mt-12 mb-0 p-4 bg-primary/10 rounded-sm"> 363 <p class="text-gray-500 !mb-0 text-sm"> 364 This Cookie Policy should be read together with the KompleteCare EMR <a href="/policies?tab=privacy" class="text-primary underline">Privacy Policy</a> and <a href="/policies?tab=terms" class="text-primary underline font-medium">Acceptable Use Policy</a>. 365 </p> 366 </div> 367 `}]},"data-processing":{title:"Data Processing Agreement",effectiveDate:"25 May 2026",version:"1.0",jurisdiction:"Nigeria",sections:[{id:"parties-of-agreement",title:"Parties of Agreement",content:` 368 <p><strong>The Controller:</strong> [Name, registered address and company number (if applicable) of the entity acting as the controller]</p> 369 <p><strong>The Processor:</strong> [Sevenz HealthCare, 1st Floor, UAC Building, Central Business District, Garki, Abuja, FCT, Nigeria.</p> 370 <p>+234 (0) 817 4290 703, +234 (0) 817 4290 702</p> 371 `},{id:"scope-and-roles",title:"Scope and Roles",content:` 372 <p><strong>2.1</strong> This agreement applies to the processing of Personal Data, within the scope of the NDPR, by the Processor on behalf of the Controller.</p> 373 <p><strong>2.2</strong> For purposes of this agreement, [Controller Name] and [Sevenz Health Care] agree that [Controller Name] is the Controller of the Personal Data and [Sevenz Health Care] is the Processor of such data. In the case where [Controller Name] acts as a Processor of Personal Data on behalf of a third party, [Sevenz Health Care] shall be deemed to be a Sub-Processor.</p> 374 <p><strong>2.3</strong> These Terms do not apply where [Sevenz Health Care] is a Controller of Personal Data.</p> 375 `},{id:"definitions",title:"Definitions",content:` 376 <p><strong>3.1</strong> For the purposes of this Agreement, the following definitions shall apply:</p> 377 <div class="overflow-x-auto"> 378 <table class="w-full border border-gray-200 text-left text-sm"> 379 <thead> 380 <tr class="bg-primary text-white"> 381 <th class="w-1/5 border border-gray-200 px-4 py-5 font-bold">Term</th> 382 <th class="border border-gray-200 px-4 py-5 font-bold">Definition</th> 383 </tr> 384 </thead> 385 <tbody> 386 <tr class="bg-gray-50"> 387 <td class="border border-gray-200 px-4 py-5 font-bold text-gray-900">Agreement</td> 388 <td class="border border-gray-200 px-4 py-5">This data processing agreement</td> 389 </tr> 390 <tr> 391 <td class="border border-gray-200 px-4 py-5 font-bold text-gray-900">NDPR</td> 392 <td class="border border-gray-200 px-4 py-5">Regulation by NITDA in January 2019 on the protection of natural persons with regard to the processing of Personal Data and on the free movement of such data and implementation framework.</td> 393 </tr> 394 <tr class="bg-gray-50"> 395 <td class="border border-gray-200 px-4 py-5 font-bold text-gray-900">Personal data</td> 396 <td class="border border-gray-200 px-4 py-5">Data meeting the definition of âpersonal dataâ as defined in Article 1.3 of the NDPR, that is provided by [Controller Name] to [Sevenz Health Care] in order to perform the processing as defined in Schedule 1 of this Agreement.</td> 397 </tr> 398 <tr> 399 <td class="border border-gray-200 px-4 py-5 font-bold text-gray-900">Sub-processor</td> 400 <td class="border border-gray-200 px-4 py-5">A natural or legal person, public authority, agency or body other than the data subject, Controller and Processor who, under the direct authority of the Processor, are authorised to process Personal Data for which [Controller Name] is the Controller.</td> 401 </tr> 402 </tbody> 403 </table> 404 </div> 405 <p>Terms used but not defined in this Agreement (e.g., âprocessingâ, âcontrollerâ, âprocessorâ, âdata subjectâ) shall have the same meaning as in Article 1.3 of the NDPR.</p> 406 `},{id:"the-processing",title:"The Processing",content:` 407 <p><strong>4.1</strong> The subject matter, duration, nature and purpose of the Processing, and the types of Personal Data and categories of data subjects shall be as defined in Schedule 1 of this Agreement.</p> 408 `},{id:"controller-obligations",title:"Obligation and Rights of the Controller",content:` 409 <p><strong>5.1</strong> Considering the nature, scope, context and purposes of processing as well as the risks of varying likelihood and severity for the rights and freedoms of natural persons, the Controller shall implement appropriate technical and organisational measures to ensure and to be able to demonstrate that Processing is performed in accordance with the NDPR. Those measures shall be reviewed and updated where necessary.</p> 410 <p><strong>5.2</strong> Where proportionate in relation to Processing activities, the measures referred to in paragraph 5.1 shall include the implementation of appropriate data protection policies by the C
410ontroller.</p> 411 <p><strong>5.3</strong> The Controller shall implement appropriate technical and organisational measures for ensuring that, by default, only Personal Data which are necessary for each specific purpose of the Processing are processed. That obligation applies to the amount of Personal Data collected, the extent of their Processing, the period of their storage and their accessibility. Such measures shall ensure that by default Personal Data are not made accessible without the individual's intervention to an indefinite number of natural persons.</p> 412 `},{id:"processor-obligations",title:"Obligations of the Processor",content:` 413 <p><strong>6.1</strong> The processor shall;</p> 414 <ul class="legal-list"> 415 <li>Process the Personal Data only on documented instructions from the Controller;</li> 416 <li>Ensure that persons authorised to process the Personal Data have committed themselves to confidentiality or are under an appropriate statutory obligation of confidentiality;</li> 417 <li>Take all measures required pursuant to Article 4 of the NDPR, namely to implement appropriate technical and organisational measures to ensure a level of security appropriate to the risk to the rights and freedoms of natural persons including, as a minimum, the measures set out in Schedule 2 of this Agreement;</li> 418 <li>Respect the conditions referred to in paragraphs 2 and 4 of Article 4 of the NDPR for engaging another Processor, namely that the Processor may not engage another Processor (Sub-Processor) without the prior authorisation of the Controller. Those Sub-Processors that are authorised by the Controller at the date of this agreement are listed in Schedule 3. In cases where another Processor is engaged, the Sub-Processor must be subject to the same contractual terms as described in this Agreement;</li> 419 <li>Assist the Controller by appropriate technical and organisational measures, insofar as this is possible, for the fulfilment of the Controller's obligation to respond to requests for exercising the data subject's rights laid down in Chapter III of the NDPR;</li> 420 <li>Assist the Controller in ensuring compliance with the obligations pursuant to Articles 4 the NDPR, relating to security of Processing, Personal Data Breaches and data protection impact assessments;</li> 421 <li>At the choice of the Controller, delete or return all the Personal Data to the Controller after the end of the provision of services relating to Processing, and delete existing copies unless applicable law requires storage of the Personal Data;</li> 422 <li>Make available to the Controller all information necessary to demonstrate compliance with the obligations laid down in Article 4 of the NDPR and allow for and contribute to audits, including inspections, conducted by the Controller or another auditor mandated by the Controller;</li> 423 <li>Indemnify the Controller against any reasonable losses, liabilities and costs which the Controller suffers or incurs as a result of the processor causing or allowing a breach of data protection laws or breaching any part of this agreement.</li> 424 </ul> 425 `},{id:"duration-and-law",title:"Duration and Applicable Law",content:` 426 <p><strong>7.1</strong> This Agreement shall continue in effect for so long as the Processor is processing Personal Data on behalf of the Controller [or define a fixed term].</p> 427 <p><strong>7.2</strong> This Agreement shall be governed by the laws of [Nigeria] and subject to the exclusive jurisdiction of the courts of [Nigeria].</p> 428 `},{id:"schedule-one",title:"Schedule 1: Description of the Processing",content:` 429 <div class="overflow-x-auto"> 430 <table class="w-full border border-gray-200 text-left text-sm"> 431 <thead> 432 <tr class="bg-primary text-white"> 433 <th class="w-1/4 border border-gray-200 px-4 py-5 font-bold">Term</th> 434 <th class="border border-gray-200 px-4 py-5 font-bold">Definition</th> 435 </tr> 436 </thead> 437 <tbody> 438 <tr class="bg-gray-50 align-top"> 439 <td class="border border-gray-200 px-4 py-8 font-bold text-gray-900">Subject matter and duration of the processing</td> 440 <td class="border border-gray-200 px-4 py-8">The scope of Processing involves medical and organizational records provided, ar
440chived, and handled by the Controller ([Hospital/HMO Name]) via the KompleteCare Electronic Medical Records (EMR) system, encompassing data shared through the Digital Health Exchange (DHX) or managed by InsuraCore/Insura360 [if relevant]. Processing shall persist throughout the term of the Master Services Agreement and for the duration of the Controller's account validity, with information being restored or erased within [30/60] days post-cancellation, in compliance with legal mandates for health documentation preservation.</td> 441 </tr> 442 <tr class="align-top"> 443 <td class="border border-gray-200 px-4 py-8 font-bold text-gray-900">Nature and purpose of the processing</td> 444 <td class="border border-gray-200 px-4 py-8">The scope of Processing involves medical and organizational records provided, archived, and handled by the Controller via the KompleteCare Electronic Medical Records (EMR) system, encompassing data shared through the Digital Health Exchange (DHX) or managed by InsuraCore/Insura360. Processing shall persist throughout the term of the Master Services Agreement and for the duration of the Controller's account validity, with information being restored or erased within [30/60] days post-cancellation, in compliance with legal mandates for health documentation preservation.</td> 445 </tr> 446 <tr class="bg-gray-50 align-top"> 447 <td class="border border-gray-200 px-4 py-8 font-bold text-gray-900">Type of personal data and categories of data subject</td> 448 <td class="border border-gray-200 px-4 py-8"> 449 <p class="!mb-2">Type of personal data:</p> 450 <p class="!mb-4">Patient demographic data (name, date of birth, sex, address, contact details, next of kin); clinical data (diagnoses, treatment history, prescriptions, lab/test results, allergies, immunisation records); billing and insurance/claims data; identifiers (hospital/patient ID, National Health Insurance/HMO enrollee number); staff/user data of the Controller's personnel who access the system.</p> 451 <p class="!mb-2">Categories of data subjects:</p> 452 <p class="!mb-0">Patients/enrollees of the Controller; dependents of enrollees (where applicable); the Controller's healthcare and administrative staff who use the platform.</p> 453 </td> 454 </tr> 455 </tbody> 456 </table> 457 </div> 458 `},{id:"schedule-two",title:"Schedule 2: Technical and Organisational Measures",content:` 459 <p>The following security measures shall be implemented by the Processor, as a minimum:</p> 460 <ul class="legal-list"> 461 <li>Encryption in transit</li> 462 <li>Encryption at rest</li> 463 <li>Role-based access control</li> 464 <li>Multi-factor authentication</li> 465 <li>Regular backups</li> 466 <li>Vulnerability scanning</li> 467 <li>Intrusion detection system</li> 468 <li>Intrusion prevention system</li> 469 <li>Firewall</li> 470 <li>Anti-virus</li> 471 <li>Business continuity plan</li> 472 </ul> 473 `},{id:"schedule-three",title:"Schedule 3: Sub-processors",content:` 474 <p>As at the date of this agreement, the following additional Sub-Processors have been notified by the Processor to the Controller with respect to the Processing:</p> 475 <ul class="legal-list"> 476 <li>Amazon Web Services</li> 477 <li>Deepgram</li> 478 <li>JIRA</li> 479 </ul> 480 `},{id:"signatures",title:"Signatures",content:"",isComponent:!0,component:be}]}},i=N(()=>c[t.value]);return(o,m)=>{const d=H;return s(),u("div",we,[g(Y),e("div",ve,[e("div",xe,[e("div",Pe,[g(d,{modelValue:t.value,"onUpdate:modelValue":m[0]||(m[0]=p=>t.value=p),size:"lg",variant:"link",items:r.value,class:"w-full",ui:{content:"py-0 px-0",root:"overflow-auto",list:{marker:{base:"hidden"},tab:{base:"px-4"}}}},null,8,["modelValue","items"])])])]),e("div",null,[(s(),E(he,{key:t.value,policy:i.value},null,8,["policy"]))])])}}}),Ie=C(ke,[["__scopeId","data-v-9754e729"]]);export{Ie as default};
Line numbers count LF bytes from the start of the resource, as the search results do. Vendor segments are library code the classifier recognised; they are stored but not indexed. Bytes are shown as Latin1 characters, one per byte.