Privacy Policy

Excellent Diagnostic and Cardiology Clinic Limited ("the Clinic", "we", "us") is committed to protecting your privacy. This policy explains what personal data we collect through this website and in the course of providing our services, how we use and protect it, and the rights you have over it.

We process personal data in accordance with the Nigeria Data Protection Act 2023 (NDPA) and other applicable Nigerian laws and professional obligations of medical confidentiality.

Through this website:

In the course of providing clinical services at the Clinic:

We do not collect payment card details through this website.

Our lawful bases under the NDPA are: performance of a contract or steps taken at your request (bookings and enquiries), your consent (optional contact details and service notifications), compliance with legal obligations (medical record-keeping), and the provision of healthcare under appropriate professional secrecy obligations.

We send transactional service messages - booking acknowledgements, appointment confirmations and results-ready notifications - using reputable third-party providers: Termii (SMS) and Resend (email). Only the minimum data needed to deliver each message (your name, phone number or email, and the message content) is shared with these providers for transmission.

Notification messages never include your clinical findings. A results notification tells you a report is ready and how to collect or verify it; the report itself is released through the Clinic's controlled channels.

We do not send marketing messages without your separate, explicit consent.

Website and clinical workflow data is stored in a managed, access-controlled cloud database (Supabase) protected by encryption in transit and at rest, row-level security policies and role-based staff access. Patient records are accessible only to authenticated Clinic staff whose role requires access.

Anonymous website visitors cannot read, list or browse bookings, messages or patient records. The public verification page returns only the limited summary of a single document when its exact reference is presented.

We apply reasonable technical and organisational measures appropriate to the sensitivity of health data. No system is perfectly secure; if a breach affecting your rights occurs, we will notify the Nigeria Data Protection Commission (NDPC) and affected individuals as required by the NDPA.

We do not sell or rent your personal data. We share it only:

Medical records are retained for the periods required by Nigerian law and applicable professional guidelines. Booking and contact-form data is retained for as long as needed for the purposes described above and for our legitimate record-keeping, after which it is deleted or anonymised.

Subject to the NDPA and to legal and professional record-keeping obligations, you have the right to:

To exercise any of these rights, contact us using the details below. We may need to verify your identity before acting on a request - this protects your records from disclosure to the wrong person.

The public website does not use advertising or cross-site tracking cookies. The staff portal uses strictly necessary session storage to keep authorised staff signed in. Embedded third-party content (such as the location map) may set its own cookies governed by that provider's policy.

Bookings and enquiries for persons under 18 should be made by a parent or legal guardian. Clinical services for minors are provided with appropriate parental or guardian consent in line with applicable law.

We may update this policy from time to time. The effective date at the top of this page shows when it was last revised. Significant changes will be highlighted on the website.