Privacy Policy

1. Who We Are

EQ Medical Laboratory and Diagnostics is responsible for determining how and why your personal information is processed in connection with our services.

• Organisation: EQ Medical Laboratory and Diagnostics
• Address: Suite D29, 3rd Floor, Iyemi Plaza, Abuja, FCT, Nigeria.
• RC Number: 9553410
• PHERMC Registration Number: HSES-P-26-T-1931
• Privacy Contact / DPO: dpo@eqmedlab.com
• General Enquiries: info@eqmedlab.com
• Telephone: 08074863091

2. Personal Information We Collect

The information we collect depends on the services you request and how you interact with us. It may include the following:

2.1 Patient and Laboratory Information

• Identity and contact details: Name, date of birth, sex or gender where clinically or administratively relevant, address, telephone number, email address and patient identification number.
• Clinical and laboratory information: Test requests, referring clinician or facility, relevant clinical history supplied to us, specimen type and collection details, laboratory findings, test reports and linked quality-control or repeat-test records.
• Sensitive health information: Information relating to health conditions and tests, including HIV, hepatitis, genetic, reproductive or sexual-health information where relevant to the requested service.
• Billing and payment information: Invoices, HMO or insurer details, payment status, transaction references and related correspondence. Full card numbers, PINs and CVVs are handled by the relevant payment provider and are not collected or stored by EQ-MLD.
• Communications and account information: Messages, attachments, patient portal account details, access logs, consent records, complaints and service enquiries.

2.2 Website, Messaging and Premises Information

• Technical information such as IP address, browser and device information, pages visited, timestamps, security events and cookie identifiers, depending on the technologies enabled.
• Website analytics or advertising data, where such tools are enabled and the required consent has been obtained.
• Contact details, messages and attachments received through WhatsApp, Instagram, Facebook, email, telephone or other communication channels.
• CCTV footage for premises security where CCTV is deployed and appropriate notices are provided.

3. How and Why We Use Your Information

We may process your personal information to:

• Register patients and administer requested laboratory services.
• Confirm test requests and facilitate specimen collection and handling.
• Perform tests, validate results and issue laboratory reports.
• Communicate about appointments, specimen issues, critical or amended results, billing and service-related follow-up.
• Maintain accurate records, traceability, internal quality control, audits and laboratory quality-management processes.
• Process payments, reconcile invoices and administer HMO or insurance claims.
• Protect our website, patient portal, laboratory systems and other IT infrastructure.
• Investigate suspected misuse, manage complaints and resolve disputes.
• Meet applicable legal, professional, regulatory and public-health obligations.
• Send optional health education or promotional communications where appropriate and where the necessary consent has been obtained.

4. Lawful Bases for Processing

We process personal information on a lawful basis appropriate to the purpose and circumstances. These bases may include:

• Healthcare services: Processing necessary to provide the laboratory services you request, administer the service and communicate about your care.
• Legal obligations and public interest: Processing or disclosures required or permitted by applicable law, including relevant public-health reporting obligations.
• Consent: Processing for which consent is the appropriate legal basis, including optional marketing and non-essential cookies. Where consent is the appropriate basis for sensitive health information, we will seek specific, informed consent.
• Legitimate interests: Proportionate activities such as system security, fraud prevention, service improvement and quality management, where permitted by law and balanced against your rights.

Consent is not a blanket substitute for every lawful basis. Refusing optional marketing or non-essential cookies will not affect your access to routine laboratory services. Withdrawal of consent does not necessarily require us to stop processing information where another lawful basis or mandatory retention obligation applies.

5. Patient Confidentiality and Results Delivery

Patient information and laboratory results are treated as confidential and are accessed or disclosed only as appropriate for the requested service and under applicable law.

Before releasing results, we will take reasonable steps to verify the identity of the recipient and, where applicable, the authority of a representative.

Depending on availability and the patient's preference, approved delivery methods may include:

• Secure patient portal, where available and operational.
• Sealed hard-copy reports collected by the patient or a verified authorised representative.
• Email to a verified address.
• WhatsApp or another agreed electronic channel, subject to applicable procedures and consent requirements.

Email, SMS and messaging platforms may carry privacy and security risks outside our control. We will explain relevant risks and obtain a separate, recorded choice before sending results through a non-portal electronic channel where required by our procedures.

Providing a telephone number during registration does not, by itself, constitute blanket consent to receive sensitive laboratory results through WhatsApp.

Where password-protected PDF reports are used, the password should be communicated through a separate channel and must not rely solely on easily guessed information such as a date of birth or patient identification number.

We will not publish identifiable patient results in public social-media posts or comments.

6. Cookies and Similar Technologies

Our website may use strictly necessary cookies to support security, session management and patient portal functionality.

Where analytics or other non-essential cookies are enabled, they will remain disabled until valid consent has been obtained through the cookie preference tool. These technologies may help us understand website usage and improve our services.

You should be able to accept all cookies, reject optional cookies or manage your preferences. You may change your preferences later through Cookie Settings, where available.

Third-party technologies, where enabled, may be subject to the privacy terms of their respective providers.

7. When We Share Information

We may disclose personal information to the following categories of recipients where appropriate, necessary and lawful:

• Referring clinicians, hospitals and other healthcare professionals involved in your care.
• Competent regulators, public-health authorities, law-enforcement bodies, tax authorities and other public bodies where legally required or otherwise permitted.
• Service providers supporting our website, laboratory information system, hosting, secure communications, payment processing, backups and IT security.
• The patient or a representative whose identity and authority have been reasonably verified.

We limit disclosures to what is necessary for the relevant purpose and use appropriate confidentiality and data-processing arrangements with service providers.

We do not sell patient personal information.

Where a service provider processes personal data outside Nigeria, we will assess and document the applicable cross-border transfer basis and safeguards in accordance with sections 41–43 of the NDPA, as applicable.

8. Data Security and Personal Data Breaches

We implement technical and organisational safeguards proportionate to the sensitivity of the information we hold and the risks associated with its processing.

Safeguards may include:

• Access controls and appropriate staff authorisation.
• Staff confidentiality obligations and privacy training.
• Secure data transmission and appropriate system protections.
• Backups, audit trails and security monitoring.
• Incident response procedures and periodic risk reviews.

No method of electronic transmission or storage is completely risk-free. We take reasonable steps to protect personal information and respond appropriately to suspected security incidents.

If a personal data breach occurs, we will assess, document and respond to it in accordance with the NDPA. Where required by section 40, we will notify the Nigeria Data Protection Commission within the applicable statutory timeframe, including within 72 hours where the breach is likely to create a risk to individuals' rights and freedoms. Affected individuals will be informed where the applicable high-risk notification threshold is met.

9. How Long We Keep Information

We retain personal information only for as long as reasonably necessary for the purpose for which it was collected, applicable legal and professional obligations, patient safety, dispute resolution and legitimate quality-management needs.

The following are proposed retention periods that must be validated against EQ-MLD's approved retention schedule and applicable requirements before adoption:

These periods are not a substitute for an approved retention schedule. Different records may require different periods under applicable law, professional requirements or legitimate operational needs.

At the end of the approved retention period, records will be securely destroyed or irreversibly anonymised unless a legal hold or another lawful reason requires continued retention.

10. Walk-in Patients and Specimen Handling

For in-person services, we collect information necessary to identify the patient, confirm requested tests, safely collect and handle specimens, issue reports and meet applicable recordkeeping obligations.

We explain relevant procedures and obtain required patient consent before collection or testing.

Specimen acceptance, rejection, storage conditions and turnaround times depend on the test, specimen type, manufacturer instructions and approved laboratory procedures. Requirements may therefore differ between tests.

11. Your Data Protection Rights

Subject to applicable legal conditions and exemptions, you may have the right to:

• Request access to your personal information.
• Request correction of inaccurate or incomplete information.
• Request erasure of personal information where applicable.
• Request restriction of processing in qualifying circumstances.
• Object to certain types of processing.
• Request data portability where applicable.
• Receive information about how your data is processed.
• Withdraw consent where consent is the lawful basis for processing.
• Lodge a complaint with the Nigeria Data Protection Commission (NDPC).

To exercise your rights, email dpo@eqmedlab.com with the subject line Data Protection Request.

We may request proportionate information to verify your identity and protect patient confidentiality. We will respond within the applicable statutory timeframe, taking into account the NDPA's provisions and any lawful extensions or exceptions.

Withdrawing consent does not make earlier lawful processing unlawful and does not override mandatory retention requirements or other applicable lawful bases.

Nigeria Data Protection Commission: https://ndpc.gov.ng/

12. Children and Authorised Representatives

We process children's personal information only as appropriate for the requested healthcare service and in accordance with applicable law.

Where required, we obtain consent or authorisation from a parent, guardian or legally authorised representative and take reasonable steps to verify their authority.

Where an online booking form is designed for adult self-booking, appropriate arrangements must be made for children and other patients who require a representative. A minor's access to appropriate clinical care should not be refused solely because an online form is intended for adults.

13. Third-Party Websites and Services

Our website and communications may contain links to third-party websites or services. Those providers may process information under their own privacy policies and terms.

We encourage you to review their privacy terms before sharing personal information. EQ-MLD remains responsible for its own decisions and obligations concerning personal information it processes or discloses to service providers.

14. Changes to This Privacy Policy

We may update this policy when our services, information processing practices, systems or legal requirements change.

The current version and its effective date will be published on our website at www.eqmedlab.com/privacy-policy . Where required, we will notify affected individuals of material changes.

15. Contact Us About Privacy

For questions about this policy, requests concerning your personal information or privacy complaints, please contact:

---

This policy describes EQ-MLD's intended privacy practices. Operational procedures, actual system configurations and approved retention schedules should be reviewed regularly to ensure that this notice accurately reflects practice and applicable law.