Privacy Notice
This notice explains what Adeva Health collects when you use Adeva or our website, why, who sees it, and what you can ask of us. It is written to meet the Nigeria Data Protection Act, 2023 (NDPA) and the regulations of the Nigeria Data Protection Commission (NDPC).
1. Who this notice covers
- Laboratory owners and administrators who create and run a lab on Adeva.
- Laboratory staff given an account by their lab.
- Visitors to adevahealth.com, including people who book a demo.
- Patients whose details a laboratory enters. For patients the laboratory, not Adeva, is the organisation responsible — see sections 2 and 5.
2. Controller or processor
For account holders, staff and visitors, Adeva Health is the data controller: we decide what to collect and why.
For patient data, the laboratory is the data controller and Adeva is its data processor. We store and display patient records only as the laboratory instructs, under the Data Processing Agreement. We never use patient data for our own purposes.
3. What we collect
From laboratory owners, administrators and staff
- Name, work email address, phone number, role, permissions and the branches you are assigned to.
- Your password, stored only as a salted bcrypt hash; we cannot read it.
- Professional registration number, if your lab records it for report authorisation.
- The laboratory’s name, address, licence number, logo and report settings.
- Sign-in and activity records: time, a hash of your IP address for rate-limiting, and an audit trail of the actions you take in the product (who did what, to which record, when).
From visitors
- What you type into the demo or contact forms: name, organisation, email, phone, message.
- Standard server logs: IP address, browser type, pages requested, timestamps.
Patient data, on behalf of laboratories
- Identity and contact details, demographics, and the consent the laboratory records.
- Requests, specimens, results, reports, comments, critical-value notifications and their acknowledgements.
- Payments, receipts and refunds for laboratory services.
- Uploaded documents and images attached to results.
4. Why, and on what basis
| Purpose | Data | Lawful basis |
|---|---|---|
| Providing the service to your laboratory | Account, staff and configuration data | Performance of the contract with the laboratory |
| Keeping accounts secure and preventing abuse | Sign-in records, hashed IP, rate-limit counters | Legitimate interest in security; legal duty to protect data |
| Audit trail of actions in the product | Who did what, when | Legitimate interest of the laboratory and its regulators; legal duty |
| Transactional email (verification, resets, invitations, result delivery) | Email address, message content | Performance of the contract |
| Responding to enquiries and demo requests | Form contents | Your request; legitimate interest |
| Error monitoring | Stack traces and request metadata | Legitimate interest in a working service |
| Processing patient data for the laboratory | Patient records | Laboratory’s instructions under the DPA; the laboratory’s own lawful basis |
We do not sell personal data, and we do not use it for advertising or profiling.
5. If you are a patient
Your laboratory entered your details so it could test your specimen and report the result. The laboratory decides what is recorded, who may see it, and how long it is kept, under its own professional and legal duties. To see, correct or delete your record, or to withdraw consent, contact the laboratory that tested you. If you write to us instead, we will pass your request to the laboratory and help it respond.
Adeva staff cannot see your record in the ordinary course of operating the service. Access for support is granted only by your laboratory’s administrator, is time-limited, and is recorded in the laboratory’s audit trail.
7. How long we keep it
- Account and laboratory data: for as long as the laboratory holds an account, then ninety days for export, then deleted.
- Patient data: for as long as the laboratory instructs; deleted with the laboratory’s account or on its instruction, subject to the laboratory’s own retention duties.
- Audit trail: for the life of the laboratory’s account; it is part of the laboratory’s record.
- Sign-in attempt counters and hashed IPs: rolling windows of hours, then discarded.
- Enquiry and demo forms: up to twelve months after the last contact.
- Backups: deleted data leaves backups within the backup retention cycle of our hosting provider.
8. Your rights
Under the NDPA you may ask us to:
- confirm whether we hold personal data about you, and give you a copy;
- correct data that is inaccurate or incomplete;
- delete data we no longer have a reason to keep;
- restrict or object to processing based on legitimate interest;
- give you your data in a portable form;
- withdraw consent where consent is the basis.
Write to [email protected]. We answer within thirty days. Where the laboratory is the controller, we forward the request to it and support its answer.
10. Security
Every laboratory’s data is isolated by row-level security in the database, passwords are hashed, transport is encrypted, access is by role, permission and branch assignment, and every action is audited. The detail is on the Security page. If we learn of a breach affecting your data we will notify the affected laboratory without undue delay and the NDPC within the period the law sets.
11. Contact and complaints
Privacy questions and requests: [email protected]. If you are not satisfied with our answer you may complain to the Nigeria Data Protection Commission.