Privacy Notice

Last updated 23 July 2026 · Version 2026-07

1. Who we are

The data controller is Genesys Health Information Systems Limited, 21a Fatai Idowu Arobieke Street, Off Admiralty Way, Lekki Phase 1, Lagos, Nigeria.

Questions about this notice, or about how we handle personal data, go to our data protection contact at cordor@genesys-health.com or +234 704 799 9337.

[Appointed Data Protection Officer name and NDPC registration number: to be confirmed and inserted here.]

2. What this notice covers

This notice covers personal data we collect through this website. It does not cover patient data held inside Genesys software at a client facility. In those deployments the health facility is the data controller and Genesys acts as a data processor under a written agreement with that facility. If you are a patient asking about your medical record, contact the facility that treated you.

3. What we collect, why, and on what lawful basis

What	Why	Lawful basis (NDPA s.25)	Kept for
Name, email, phone, facility name and type, bed count, product interest, message	To answer your demo request or enquiry	Consent, and steps toward a contract at your request	24 months from last contact
Chat messages and the page you sent them from	To answer questions asked through the chat window	Consent	12 months
Email address for updates	To send occasional news, only if you tick the optional box	Consent, withdrawable at any time	Until you unsubscribe
Your privacy choices and the time you made them	To prove we respected your choice	Legal obligation	3 years
Details in a data rights request	To identify you and act on the request	Legal obligation	3 years

We do not use this website to collect health data, and you should not send patient information through the demo form or the chat. Our chat assistant is automated, is not a clinician, and makes no decision that affects you legally or significantly, so section 37 of the NDPA on automated decision-making does not apply to it.

4. Storage on your device

We use a small amount of browser storage that is strictly necessary for the site to work and to record the privacy choice you make. Everything else — remembering your theme and language — happens only if you switch it on. We do not currently run analytics or advertising trackers of any kind. Full detail is in our Cookie Notice, and you can change your choice at any time from Privacy choices in the footer of every page.

5. Who we share it with

We do not sell personal data and we do not share it for anyone else’s marketing.

• Supabase — stores form, chat and consent records on our behalf as a data processor.
• Vercel — hosts this website and processes server logs.
• Professional advisers or regulators — only where the law requires it.

Each processor is engaged under a written agreement requiring them to act only on our instructions and to keep the data secure.

6. Transfers outside Nigeria

Our hosting and database providers operate data centres outside Nigeria. Where personal data is transferred abroad we rely on the conditions in sections 41 to 43 of the NDPA, including your consent and contractual safeguards with the recipient that carry an adequate level of protection.

[Confirm the exact Supabase and Vercel hosting regions and name them here.]

7. Your rights

Under the NDPA you have the right to:

• be told how your data is used, which is what this notice does;
• ask for a copy of the personal data we hold about you;
• have inaccurate or incomplete data corrected;
• ask us to delete your data where there is no longer a reason to keep it;
• receive your data in a structured, commonly used, machine-readable format, and have it sent to another controller where technically feasible;
• object to processing, including profiling, for direct marketing at any time;
• restrict how we use your data while a concern is being resolved;
• withdraw consent at any time, as easily as you gave it, without affecting anything done before you withdrew it;
• complain to the Nigeria Data Protection Commission.

Use our data rights request form or email cordor@genesys-health.com. We respond within 30 days and never charge for a first request.

8. How we protect it

Access is limited to staff who need it. Data is encrypted in transit and at rest by our processors, database access is governed by row-level security rules, and administrative access requires authentication. We review these measures periodically.

9. If something goes wrong

If a personal data breach occurs we will investigate immediately, notify the Nigeria Data Protection Commission within 72 hours of becoming aware where the breach is likely to result in a risk to your rights and freedoms, and tell affected people directly where the risk to them is high.

10. Children

This website is intended for healthcare professionals and organisations. We do not knowingly collect personal data from children through it. If you believe a child has sent us personal data, contact us and we will delete it.

11. Changes

If we change this notice we will update the version and date at the top. Material changes will be signposted on the site.

12. Complaints

Please raise concerns with us first at cordor@genesys-health.com. You also have the right to complain directly to the Nigeria Data Protection Commission (NDPC).