Legal

Privacy Policy

Effective date: August 2026 · Last updated: September 2026

MedSought is committed to protecting your personal information in accordance with the Nigeria Data Protection Act (NDPA) 2023 and the NITDA Data Protection Guidelines. This Privacy Policy explains what data we collect, how we use it, and the rights available to you.

NDPA 2023 Compliant · NITDA Guidelines Followed

A — Data Collection & Use

1. What data we collect

We collect the minimum data necessary to provide the MedSought service. This includes:

Account data — name, email address, hashed password, and role (patient or pharmacist)
Location data — GPS coordinates, used only during an active pharmacy search session. We do not store your precise location.
Health management data — medication names, dosages, reminder schedules, and refill thresholds that you voluntarily add to the platform
Usage data — search queries, pages visited, features used, and session duration, used to improve the service
AI chat data — text messages sent to the MedSought AI assistant. These may be reviewed to improve AI accuracy and for pharmacist handoff.
Device data — browser type, operating system, and device identifiers used for security and bug diagnosis

2. Data retention schedule

Data Category	Purpose	Retention Period
Name & email	Account registration and authentication	Until account deletion
Location (GPS)	Pharmacy proximity search	Session only — not stored
Medication reminders	Dosage scheduling and refill alerts	Until deleted by user
Search history	Improving search relevance	90 days
Device & browser info	Security, bug diagnosis, and analytics	12 months
AI chat transcripts	Improving AI accuracy and pharmacist handoff	30 days

3. How we use your data

MedSought uses your data only for the following purposes:

To authenticate your account and keep it secure
To provide nearby pharmacy search results using your location
To display medicine availability, pricing, and drug information
To deliver medication reminders and refill alerts
To improve AI response quality and pharmacist triage workflows
To monitor platform performance and diagnose technical issues
To comply with legal obligations under Nigerian law

We do not sell, rent, or share your personal data with third parties for marketing purposes.

4. Legal basis for processing

Under the NDPA 2023, MedSought processes your personal data on the following lawful bases:

Consent — for location access and push notification delivery
Contract performance — to provide the services you have registered for
Legitimate interests — to improve platform security, diagnose bugs, and enhance service quality
Legal obligation — where required by Nigerian law or regulatory authority

B — Security Parameters

5. How we protect your data

MedSought applies industry-standard security controls to protect your personal information:

All passwords are hashed using bcrypt with a minimum salt factor of 10
Authentication tokens are signed with HS256 JWTs and expire after 7 days
All data in transit is encrypted using HTTPS / TLS 1.2 or higher
Database access is restricted by IP allowlist and authenticated credentials
Sensitive actions (login, password reset, pharmacy approval) are audit-logged
Access to production systems is limited to authorised personnel only

6. Data breach notification

In the event of a personal data breach that poses a risk to your rights and freedoms, MedSought will notify affected users and the relevant Nigerian supervisory authority (NITDA) within 72 hours of becoming aware of the breach, in accordance with the NDPA 2023.

C — Your Rights Under NDPA

7. Your data subject rights

Under the Nigeria Data Protection Act 2023, you have the following rights regarding your personal data held by MedSought:

Right to access — request a copy of the personal data we hold about you
Right to rectification — request correction of inaccurate or incomplete data
Right to erasure — request deletion of your account and associated personal data
Right to restrict processing — request that we limit how we use your data
Right to data portability — receive your data in a structured, machine-readable format
Right to withdraw consent — withdraw location or notification consent at any time via your browser or device settings
Right to lodge a complaint — file a complaint with NITDA if you believe your data rights have been violated

To exercise any of these rights, contact our Data Protection Officer at privacy@medsought.com.

8. Cookies & tracking

MedSought uses a single session cookie (`medsought_token`) for authentication. This cookie is HttpOnly, Secure (in production), and expires after 7 days. We do not use third-party advertising cookies.

We may use analytics cookies (e.g. Google Analytics or Firebase Analytics) to measure platform performance. You may opt out of analytics cookies via your browser settings or by contacting us.

9. Third-party services

MedSought integrates with the following third-party services that may process your data:

MongoDB Atlas — cloud database provider (data stored in-region where available)
Google Maps / Places API — for pharmacy location and directions (subject to Google's Privacy Policy)
Firebase Cloud Messaging — for push notifications (subject to Google's Privacy Policy)
AI API provider (TBD) — for AI assistant responses (data handling disclosed upon selection)

10. Contact & complaints

For privacy enquiries, data subject requests, or complaints, contact:
MedSought Data Protection Officer
Email: privacy@medsought.com

To file a complaint with the Nigerian data protection supervisory authority:
National Information Technology Development Agency (NITDA)
Website: nitda.gov.ng