Privacy Policy

Interpretation and Definitions

Interpretation

The words of which the initial letter is capitalized have meanings defined under the following conditions. The following definitions shall have the same meaning regardless of whether they appear in singular or in plural.

Definitions

For the purposes of this Privacy Policy:

• Account: means a unique account created for You to access our Service or parts of our Service.
• Affiliate: means an entity that controls, is controlled by or is under common control with a party, where "control" means ownership of 50% or more of the shares, equity interest or other securities entitled to vote for election of directors or other managing authority.
• Application: refers to Rex Health, the software program provided by the Company.
• Company: (referred to as either "the Company", "We", "Us" or "Our" in this Agreement) refers to Rex Health Nigeria Limited, Lagos, Nigeria.
• Country: refers to Nigeria.
• Device: means any device that can access the Service such as a computer, a cellphone or a digital tablet.
• Personal Data: is any information that relates to an identified or identifiable individual.
• Service: refers to the Application and website.
• Service Provider: means any natural or legal person who processes the data on behalf of the Company.
• Usage Data: refers to data collected automatically, either generated by the use of the Service or from the Service infrastructure itself (for example, the duration of a page visit).

Collecting and Using Your Personal Data

Types of Data Collected

Use of Your Personal Data

The Company may use Personal Data for the following purposes:

• To provide and maintain our Service: including to monitor the usage of our Service and facilitate healthcare appointments.
• To manage Your Account: to manage Your registration as a user of the Service and grant access to health records, consultation notes, and health wallet functionalities.
• To contact You: by email, telephone calls, SMS, or mobile push notifications regarding appointment updates, lab results, security notices, or system alerts.
• To manage Your requests: to attend and manage Your support and service inquiries.
• For business transfers: to evaluate or conduct a merger, restructuring, reorganization, or sale of assets.
• For compliance and security: to prevent fraud, protect patients, and enforce applicable legal agreements.

Retention of Your Personal Data

The Company will retain Your Personal Data only for as long as is necessary for the purposes set out in this Privacy Policy:

• Account Information: We retain your profile data, email, and authentication credentials for as long as your account remains active. If you submit an account deletion request, your authentication credentials and identifying account profile will be permanently deleted from our active databases within 30 days.
• Clinical and Medical Records: In accordance with statutory healthcare regulations, professional medical council guidelines, and the National Health Act, clinical consultation notes, prescription histories, and laboratory records may be retained for mandatory statutory retention periods (typically up to 5 to 7 years) for medical-legal liability and regulatory compliance.
• Financial & Transaction Data: Health savings transactions and consultation payments are retained for the duration required by financial and tax reporting laws.
• Usage Data: Usage Data is generally retained for internal analysis purposes for a shorter duration (typically 90 to 180 days), except when this data is used to strengthen system security, prevent fraud, or improve service functionality, or when We are legally obligated to retain it for longer periods.

Delete Your Personal Data (Account Deletion)

You have the right to delete or request that We assist in deleting the Personal Data that We have collected about You.

You may update, amend, or request deletion of Your information at any time:

• Online Account Deletion Request: You can submit a deletion request directly via our web portal at rexhealth.com/delete-account.
• In-App Deletion: You may request account deletion within the Rex Health Mobile Application through your Profile & Account Settings.
• Email Request: You can contact our Data Protection Officer directly at privacy@myrexhealth.com with the subject line "Account Deletion Request".

Upon receiving a verified deletion request, We will purge or anonymize your personal account data within thirty (30) days, except where retention is strictly required to comply with our statutory medical, legal, dispute resolution, or fraud prevention obligations.

Transfer of Your Personal Data

Your information, including Personal Data, is processed at the Company's operating offices and in secure cloud server environments where the parties involved in the processing are located. It means that this information may be transferred to — and maintained on — computers located outside of Your state, province, country, or other governmental jurisdiction where data protection laws may differ.

The Company will take all steps reasonably necessary to ensure that Your data is treated securely and in accordance with this Privacy Policy and applicable data protection standards.

Disclosure of Your Personal Data

Business Transactions

If the Company is involved in a merger, acquisition or asset sale, Your Personal Data may be transferred. We will provide notice before Your Personal Data is transferred and becomes subject to a different Privacy Policy.

Law Enforcement

Under certain circumstances, the Company may be required to disclose Your Personal Data if required to do so by law or in response to valid requests by public authorities (e.g. a court or a government agency).

Other Legal Requirements

The Company may disclose Your Personal Data in the good faith belief that such action is necessary to comply with a legal obligation, protect and defend the rights or property of the Company, prevent or investigate possible wrongdoing in connection with the Service, protect the personal safety of Users of the Service or the public, or protect against legal liability.

Security & Data Protection

The security of Your Personal Data is paramount to Us. We implement industry-standard AES-256 encryption in transit (TLS 1.3) and at rest, role-based access control, and strict compliance measures aligned with the Nigeria Data Protection Act (NDPA) and global healthcare confidentiality standards. However, no method of transmission over the Internet or electronic storage is 100% secure, and We continuously monitor and improve our safeguards.

Children's Privacy

Our Service does not directly address or collect information from individuals under the age of 13 without verified parental or legal guardian consent. If You are a parent or guardian and You are aware that Your child has provided Us with Personal Data without parental authorization, please contact Us immediately. If We become aware that We have collected Personal Data from children without verification of parental consent, We take prompt steps to remove that information from Our servers.

Links to Other Websites

Our Service may contain links to third-party websites or services that are not owned or controlled by Rex Health. We strongly advise You to review the privacy policies of any third-party sites you visit, as we assume no responsibility for their practices.

Changes to this Privacy Policy

We may update Our Privacy Policy from time to time. We will notify You of any material changes by posting the new Privacy Policy on this page and updating the "Last updated" date at the top of this document. You are advised to review this Privacy Policy periodically for any changes.

Contact Us & Data Protection Officer

If you have any questions about this Privacy Policy, your rights, or data retention practices, please reach out to our Data Protection Officer at: