Scope & Introduction
This Privacy Policy applies to HubPharm Pharmaceutical Limited ("HubPharm", "we", "us", or "our"), a company registered in Nigeria (RC 1812043) and licensed by the Pharmacy Council of Nigeria (PCN License: LAG20247B39C9), with its principal place of business at 17 Ademola Osinowo Street, Ikosi Ketu, Lagos, Nigeria.
This policy covers how we collect, use, store, protect, share, and dispose of personal data when you use any of the following:
- Our website at www.hubpharmafrica.com and any subdomains
- Afiya AI, our WhatsApp-based AI health companion (+234 816 053 3715)
- Our pharmacist consultation service via WhatsApp (+234 705 050 5001)
- Our medicine delivery, prescription management, and chronic care programs
- Any communications you have with our team by phone, email, or in person at our pharmacy
By accessing or using any of the above services, you confirm that you have read and understood this Privacy Policy. If you do not agree, please do not use our services.
This policy is governed by the Nigeria Data Protection Act 2023 (NDPA), administered by the Nigeria Data Protection Commission (NDPC), under which HubPharm is registered (NDPC/AUDIT/24430). We also apply relevant provisions of the NDPR 2019 where applicable, and align our practices with international standards including the EU General Data Protection Regulation (GDPR) for patients in the European Union and diaspora.
Definitions
The following terms are used throughout this policy:
Data We Collect
We collect different categories of data depending on how you interact with HubPharm. The table below describes what we collect, why, and how sensitive it is.
| Data Category | What This Includes | Sensitivity |
|---|---|---|
| Identity Data | Full name, date of birth, gender, nationality, government ID (where required for prescription medicines) | Standard |
| Contact Data | Phone number, email address, WhatsApp number, delivery address | Standard |
| Health & Medical Data | Diagnoses, conditions, prescriptions, medications, dosage history, test results, allergy information, medical history | Sensitive |
| Prescription Data | Prescription images or documents, prescribing doctor's details, dispensing records, medication quantities | Sensitive |
| Adherence Data | Medication refill patterns, missed doses (tracked via Afiya AI reminders), treatment response notes | Sensitive |
| Transaction Data | Order history, payment method type (not card numbers), delivery records, invoice history | Standard |
| Communication Data | WhatsApp message history with our pharmacist team or Afiya AI, email correspondence, call logs | Sensitive |
| Technical Data | IP address, browser type, device type, pages visited, session duration, cookies | Technical |
| Location Data | Delivery address (required), approximate location for logistics (optional). We do not track your real-time GPS location. | Standard |
Health & Medical Data - Special Category Protection
As a specialty pharmacy and coordinated care platform, health and medical data is central to the service we provide. We collect health data for the following specific purposes only:
- Dispensing and verifying prescriptions - to confirm that medicines dispensed are appropriate, safe, and correctly prescribed for your condition
- Medication safety review - to screen for drug-drug interactions, contraindications, allergies, and dosing errors before dispensing
- Chronic care monitoring - to track your treatment adherence, refill cycles, and treatment outcomes across time within our clinical programs
- Clinical consultations - to allow our pharmacists, doctors, nurses, lifestyle coaches, and mental health professionals to provide informed, personalised care
- Care coordination - to share relevant clinical information within your HubPharm care team (pharmacist, doctor, nurse) so your treatment is consistent
- Afiya AI health support - to enable Afiya to provide relevant medication reminders and health information based on your condition and medicines
- Regulatory compliance - PCN and NAFDAC require pharmacy dispensing records to be maintained
Your health data is never used for marketing, advertising targeting, third-party commercial purposes, or shared with any party outside your care team without your explicit prior consent.
Afiya AI & WhatsApp Interactions
Afiya is HubPharm's AI-powered health companion, operating via WhatsApp. When you interact with Afiya or with our pharmacist team on WhatsApp, the following applies:
WhatsApp conversations with our pharmacist team (+234 705 050 5001) are retained as part of your clinical record to enable continuity of care. These records allow your care team to review your previous consultations, track your medication history, and provide informed advice on future interactions.
- Message content shared with Afiya AI or our pharmacist WhatsApp line is treated as health data and receives sensitive data protection
- Conversation records are stored on secure servers for the duration of your care relationship with HubPharm and for up to 6 years thereafter in line with pharmacy regulatory requirements
- WhatsApp conversations are not shared with any third party except where required by law or for your clinical care (e.g. your prescribing doctor)
- Afiya AI conversations are processed by an AI system - responses are generated algorithmically but reviewed against clinical guidelines. Afiya is not a substitute for professional medical advice.
- You may request a copy of your WhatsApp consultation history at any time by emailing care@hubpharmafrica.com
Please note that WhatsApp itself (Meta Platforms, Inc.) is a third-party service with its own privacy policy. HubPharm is responsible only for what we do with the content of your messages once received - we are not responsible for WhatsApp's own data practices. We encourage you to review WhatsApp's privacy policy at whatsapp.com/legal/privacy-policy.
How We Use Your Data
We use personal data only for the purposes for which it was collected or for compatible purposes. The table below sets out our specific uses:
| Purpose | Data Used | Legal Basis |
|---|---|---|
| Dispensing medicines and verifying prescriptions | Identity, health, prescription data | Contract + Legal obligation |
| Medication safety review and interaction screening | Health data, medication history | Explicit consent + Vital interests |
| Chronic care management and adherence support | Health data, adherence data | Explicit consent |
| Afiya AI and WhatsApp pharmacist consultations | Communication data, health data | Explicit consent + Contract |
| Medicine delivery logistics | Contact data, location/address | Contract |
| Billing and payment processing | Transaction data, contact data | Contract + Legal obligation |
| Sending medication reminders and refill alerts | Contact data, adherence data | Consent (opt-in) |
| Sending health education and programme newsletters | Contact data | Consent (opt-in, separately) |
| PCN, NAFDAC, and NDPC regulatory compliance | Identity, prescription, transaction data | Legal obligation |
| Service improvement and anonymised outcomes research | Anonymised/aggregated health data only | Legitimate interest (anonymised) |
| Fraud prevention and security | Technical data, identity data | Legitimate interest |
Legal Basis for Processing
Under NDPA 2023, every processing activity must have a lawful basis. HubPharm relies on the following:
- Explicit Consent - for processing your health and medical data, for sending marketing communications, and for any processing of sensitive personal data. You can withdraw consent at any time.
- Performance of Contract - to fulfil orders, deliver medicines, process payments, and provide services you have requested.
- Legal Obligation - to comply with PCN pharmacy regulations, NAFDAC requirements, NDPC obligations, and any lawful orders from courts or authorities.
- Vital Interests - in emergency situations where processing is necessary to protect your life or that of another person.
- Legitimate Interests - for fraud prevention, service security, and anonymised service improvement - where these do not override your fundamental rights.
Data Retention
We keep your data only for as long as necessary for the purpose it was collected, or as required by law. The following retention periods apply:
| Data Type | Retention Period | Reason |
|---|---|---|
| Prescription and dispensing records | Minimum 6 years | PCN regulatory requirement |
| Clinical care records and consultation history | 6 years from last interaction | Healthcare standard of care |
| WhatsApp consultation records (pharmacist + Afiya AI) | 6 years from last interaction | Clinical record, regulatory |
| Financial and transaction records | 7 years | Tax and accounting regulations |
| Account and identity data | Duration of account + 2 years | Contractual relationship |
| Marketing communications consent | Until consent is withdrawn | NDPA consent management |
| Website cookies and technical data | Up to 12 months | Analytics and security |
When data is no longer required, we securely delete or anonymise it so that it can no longer identify you. Physical documents are shredded and electronic data is securely wiped in accordance with Nigerian data protection standards.
How We Protect Your Data
HubPharm implements technical and organisational security measures appropriate to the sensitivity of the data we hold. As a healthcare organisation handling sensitive health data, we take security seriously.
- Encryption in transit - all data transmitted between your device and our servers is encrypted using TLS (Transport Layer Security). Our website is served over HTTPS only.
- Encryption at rest - health records and sensitive personal data stored on our systems are encrypted at rest.
- Access controls - access to patient data is restricted to team members who need it to perform their role. Each team member has a unique login and access is logged.
- Confidentiality obligations - all HubPharm staff, contractors, and Data Processors are bound by confidentiality agreements that cover patient data.
- Secure payment processing - we use PCI-DSS compliant payment gateways. HubPharm does not store payment card numbers on its systems.
- Incident response - we have a data breach response procedure. In the event of a breach affecting your rights and freedoms, we will notify you and the NDPC within 72 hours of becoming aware.
- Regular review - our security practices are reviewed regularly and updated in line with emerging threats and regulatory guidance.
Your Data Rights
Under the Nigeria Data Protection Act 2023 (NDPA), you have the following rights in relation to your personal data. You may exercise any of these rights by contacting us at care@hubpharmafrica.com. We will respond within 30 days.
You have the right to request a copy of all personal data we hold about you, including your health records, prescription history, and consultation records.
If any data we hold about you is inaccurate or incomplete, you have the right to request that we correct it. This is especially important for health data.
You may request deletion of your personal data. Note that we may be required to retain some data (e.g. prescription records) for regulatory reasons even after such a request.
You may object to processing based on legitimate interests, including for direct marketing. Objecting to marketing will be actioned immediately and without question.
You may request that we restrict processing of your data - for example while you contest the accuracy of data we hold, or while an objection is being considered.
You have the right to receive your personal data in a structured, machine-readable format so you can transfer it to another healthcare provider if you choose.
Where we process your data on the basis of consent (including health data), you may withdraw that consent at any time. Withdrawal does not affect prior lawful processing.
You have the right to complain to the Nigeria Data Protection Commission (NDPC) if you believe we have not handled your data lawfully. Visit ndpc.gov.ng.
To exercise any of these rights, email care@hubpharmafrica.com with the subject line "Data Rights Request" and your full name. We may ask you to verify your identity before actioning the request to protect against unauthorised access to your records.
Cookies & Tracking Technologies
Our website uses cookies - small text files placed on your device by your browser - to make the site function correctly and to help us understand how it is used. We do not use cookies to collect health data.
| Cookie Type | Purpose | Can Be Disabled? |
|---|---|---|
| Essential Cookies | Required for the website to function - login sessions, shopping cart, form security tokens | No - disabling these breaks the site |
| Analytics Cookies | Help us understand page views, traffic sources, and user behaviour in anonymised/aggregated form (e.g. Google Analytics) | Yes - opt out any time |
| Functional Cookies | Remember your preferences such as language, location, and previously viewed pages | Yes - without these, preferences reset each visit |
| Marketing Cookies | HubPharm does not use behavioural advertising cookies based on health data. We may use anonymous remarketing on platforms like Google and Meta for general brand awareness only. | Yes - opt out via your browser or platform settings |
You can control cookies through your browser settings. Most browsers allow you to block, delete, or manage cookies. Disabling non-essential cookies does not prevent you from accessing HubPharm's services. For more information on managing cookies, visit allaboutcookies.org.
Children's Privacy
HubPharm's services are not directed to children under the age of 18. We do not knowingly collect personal data from minors without parental or guardian consent.
Where a parent or guardian registers on behalf of a child (for example, to manage a child's chronic disease medications such as Sickle Cell Disease or paediatric oncology), the parent or guardian is the account holder and data subject for consent purposes. In such cases, the parent or guardian takes full responsibility for the accuracy of information provided and consent given.
If you believe we have inadvertently collected data from a child without appropriate consent, please contact us immediately at care@hubpharmafrica.com and we will take steps to delete that information promptly.
International Data Transfers
HubPharm is headquartered in Nigeria and primarily processes data within Nigeria. However, some of our technology providers - including cloud hosting, AI infrastructure, and communication tools - may be based outside Nigeria. Where this occurs, we take the following steps to ensure your data remains protected:
- We only transfer data to countries or organisations that offer adequate data protection under Nigerian law, or where appropriate safeguards are in place
- All third-party processors outside Nigeria are bound by Data Processing Agreements (DPAs) that impose NDPA-equivalent protections
- For patients in the European Union or United Kingdom (including diaspora patients), we apply GDPR-equivalent standards and rely on appropriate transfer mechanisms
- We do not transfer health data to countries with inadequate data protection frameworks without your explicit consent
HubPharm serves patients in 31 countries worldwide. If you are outside Nigeria and have questions about the protections applicable to your data, contact our Data Protection Officer at care@hubpharmafrica.com.
Changes to This Policy
We review this Privacy Policy periodically and update it when our practices change, new regulations come into force, or we introduce new services that affect data processing. The "Last Updated" date at the top of this page reflects the most recent revision.
If we make material changes - particularly changes that affect how we process your health data or your rights - we will notify you by email (if you have provided one) and/or by a prominent notice on our website at least 30 days before the change takes effect. Your continued use of HubPharm's services after that date constitutes acceptance of the updated policy.
Previous versions of this policy are available on request by emailing care@hubpharmafrica.com.
Contact & Data Protection Officer
HubPharm has appointed a Data Protection Officer (DPO) responsible for overseeing compliance with this Privacy Policy and with Nigeria's data protection laws. If you have any questions, concerns, or requests relating to your personal data or this policy, please contact us through any of the channels below.
We aim to respond to all privacy enquiries within 72 hours and to formally action all data rights requests within 30 days.
HubPharm Pharmaceutical Limited
Data Protection Officer
17 Ademola Osinowo Street, Ikosi Ketu, Lagos, Nigeria
NDPC Registration: NDPC/AUDIT/24430 | PCN License: LAG20247B39C9 | CAC: RC 1812043