Your Privacy Matters
at QwikCare

This Data Privacy Policy (“Policy”) governs how QwikCare (“QwikCare”, “we”, “us” or “our”) processes the personal data, including health data, of patients, caregivers, healthcare providers, website and app visitors, and other data subjects who interact with our digital healthcare platform, mobile application, and related services (“Platform”).

In line with the provisions of the Nigeria Data Protection Act (NDPA), 2023, the Nigeria Data Protection General Application and Implementation Directive (NDPGAID) 2025, and other applicable data privacy and health sector laws and regulations, QwikCare maintains the privacy principles set out below, which govern how we collect, use, record, organise, structure, store, adapt, retrieve, disclose, disseminate, combine, restrict, erase or otherwise process your personal data.

Because QwikCare processes health data, which the NDPA classifies as a sensitive category of personal data, we apply heightened safeguards throughout this Policy, including a requirement for explicit consent, restricted access on a need-to-know basis, and additional security controls described in Article 8.

In processing your personal data, QwikCare adheres to the following principles. We ensure that personal data is:

1. Processed in a fair, lawful and transparent manner;
2. Collected for specified, explicit and legitimate purposes, and not further processed in a manner incompatible with those purposes
3. Adequate, relevant and limited to what is necessary for the purposes for which it is collected or processed
4. Retained for no longer than is necessary to fulfil the purposes for which it was collected, or as required by applicable health-records retention rules
5. Accurate, complete and, where necessary, kept up to date, in view of the clinical significance of your health data; and
6. Processed in a manner that ensures appropriate security, including protection against unauthorised or unlawful processing, loss, destruction or damage.

We are committed to accountability and to upholding the confidentiality, integrity and availability of your personal and health data at all times, consistent with applicable medical confidentiality and ethical obligations.

Except as otherwise required by law or necessary to protect your vital interests in an emergency, your explicit consent is required before we process your health data. You have the right to give, withhold or withdraw your consent at any time, including by adjusting your app/cookie preferences, declining a consultation feature, or unsubscribing from communications. Withdrawal of consent does not affect the lawfulness of processing carried out before withdrawal, and does not affect medical records we are required by law to retain.

Depending on your engagement with the QwikCare Platform, we process your personal and health data as set out below:

QwikCare respects your privacy rights. Subject to applicable exceptions under the NDPA and clinical record-keeping obligations, you have the following rights in relation to your personal and health data:

• Right to be Informed
• Right of Access to your health and personal data
• Right to Rectification of inaccurate or incomplete data
• Right to Object to Processing
• Right to Data Portability, including transfer of medical records to another healthcare provider on request
• Right to Erasure (“Right to be Forgotten”), subject to our obligation to retain certain medical records under applicable law
• Right in Relation to Automated Decision-Making, which entitles you to request human review of any automated clinical triage or risk-scoring outcome
• Right to Withdraw Consent at any time, without affecting the lawfulness of processing carried out before withdrawal
• Right to Lodge a Complaint with the Nigeria Data Protection Commission (NDPC)

Certain personal and health data is required for QwikCare to provide safe and accurate healthcare services, including consultations, diagnosis, prescriptions and referrals. Where you withhold such data, it may not be possible for a healthcare provider on our Platform to safely assess or treat you, and QwikCare will not be liable for any consequence arising from incomplete information you have chosen to withhold. For further clarification, please contact our Data Protection Officer as provided in Article 12 below.

QwikCare shares your personal and health data with healthcare providers, laboratories, pharmacies and HMOs/insurers strictly as necessary to deliver the service you have requested, and with other service providers who support our Platform's operation. Access to health data is restricted to those who need it to provide or support your care. Where sharing depends on your consent, you may decline or withdraw consent at any time, though this may limit our ability to provide certain services.

Our website and app are designed to collect certain technical information from users, including your IP address, device identifiers, and other information your browser or device typically shares. This helps us secure the Platform, detect fraud, and improve your experience.

“Cookies” and similar technologies are used to remember your preferences and session information. We have implemented appropriate security safeguards to ensure that cookies and similar technologies used on our Platform do not compromise your privacy rights under the NDPA. You may manage cookie preferences through your browser or device settings; disabling certain cookies may limit Platform functionality, including session continuity during a consultation.

Given the sensitivity of health data, QwikCare applies enhanced technical and organisational safeguards, including encryption of health data in transit and at rest, role-based access controls limiting staff and provider access on a need-to-know basis, audit logging of access to medical records, periodic data protection impact assessments, staff and provider training on confidentiality obligations, and contractual safeguards with all third parties who process data on our behalf.

The purpose for which personal and health data is collected determines how long it is retained. We retain medical records for the period required under applicable Nigerian health sector regulations and professional practice standards, and other personal data only for as long as reasonably necessary to fulfil the purpose for which it was collected or as required by law, after which it is securely deleted or anonymised.

Our website or app may contain links to third-party websites or services, including partner laboratories, pharmacies or HMOs. Except as expressly stated, this Policy does not extend to those third-party platforms, and we encourage you to review their privacy policies independently.

In the course of operating the Platform, QwikCare will engage service providers within or outside Nigeria for services including:

• Licensed physicians, specialists and allied health professionals on the QwikCare network
• Partner laboratories, diagnostic centres and imaging facilities
• Partner and affiliate pharmacies for prescription fulfilment and delivery
• Health Maintenance Organisations (HMOs) and insurance providers, where you use an HMO/insurance plan
• Cloud hosting and data storage providers
• Payment processors and financial institutions
• IT security, data protection and analytics service providers
• Regulators and statutory bodies, including in response to a lawful request

Any cross-border transfer of your personal or health data will be carried out in accordance with the requirements of the NDPA, including verification that the recipient jurisdiction, entity or sector maintains an adequate level of data protection, or that appropriate safeguards, such as contractual clauses, are in place.

QwikCare has designated a Data Protection Officer (DPO) responsible for overseeing compliance with this Policy and applicable data protection law, including the specific safeguards required for health data. You may direct any request, question or concern regarding your personal or health data to:

Email: dpo@qwikcare.com

Post: The Data Protection Officer, QwikCare, 9a Bankole Street, Magodo Phase 1.

Data subjects are encouraged to report any complaint or concern regarding their personal or health data to our Data Protection Officer. We will take action to address any grievance within a reasonable time, and in any event within the timelines prescribed under the NDPA. Where resolution requires additional time, you will be notified accordingly. You also retain the right to lodge a complaint directly with the Nigeria Data Protection Commission (NDPC).

QwikCare reserves the right to update this Policy from time to time to reflect changes in our practices, medical or legal or regulatory requirements, or to advance data privacy rights. Any material changes will be communicated through the Platform, together with the updated effective date.

QwikCare processes personal and health data in furtherance of delivering safe, accurate digital healthcare services, relying on recognised lawful bases such as explicit consent, contract, legal obligation and, in emergencies, vital interest. Depending on the nature of your engagement with us, embedded applications or cookies on our Platform may process your pattern of engagement to provide a more relevant experience. You can manage your cookie settings on our Platform at any time. We encourage you to review this Policy periodically.