Last Updated: 31st July 2023

MEDEXER LIMITED (‘Medexer’), a private company limited by shares (RC 6906691) registered with the Corporate Affairs Commission in Nigeria, is the controller and processor of the organisation and personal data of donation centres.

Our postal address is NO 10, SILK SUITES CLOSE, ZARMAGANDA-FAVWEI ROAD, JOS, PLATEAU, NIGERIA.

We have nominated a Data Protection Officer, and you can contact him at privacy@medexer.com.ng or via our above-stated postal address. Please mark the envelope ‘Data Protection Officer.’

The term “us” or “we” refers to the owner of the Medexer Desktop App, Medexer Limited (‘Medexer’), a private limited company in Nigeria. The term “you” or “your” refers to a donation centre that registers and opts in for the use of the Medexer platform and Medexer services primarily through the Medexer Desktop App.

1. Personal data we process

• Organisation’s name, official and contact e-mails, official and contact phone numbers, registered head office and address of all branches that will use Medexer’s services.
• Geolocation of the donation centre.
• Registration documents, relevant licences, approvals and accreditations.
• Disclosure of any past or ongoing legal proceedings of significant consequence. Legal proceedings of significant consequence shall include but not be limited to anything involving allegations of the breach or violation of medical or professional ethics, investigations and proceedings of allegations of the commission of a crime or an offence, allegations of financial misconduct involving dishonesty or fraud (or by any name it is called), and if the centre is in the process of declaring bankruptcy or filing for administration (Optional).
• Communication and correspondence records: such as when the donation centre engages with our customer service agents, the date and time of the communication, and its content.
  
  2. Purposes of the processing

We collect and process organisation and contact person’s personal data for the purpose of connecting blood donors with accessible donation centres and specific identifiable people at those centres.

Geolocation and specific location are processed to analyse the geographical area and give suggestions to the blood donors to help them move around and access the centre more efficiently. If you do not want to disclose your geolocation to blood donors, you must close the Medexer Desktop App or indicate in the Medexer Desktop App that you are offline and currently are not receiving donation requests or making any.

Registration documents, relevant licenses, approvals, accreditations, personnel personal information and disclosure of legal proceedings of significant consequence are processed to determine compliance with the legal requirements and the suitability of operating as a blood donation receiver.

Medexer Desktop App displays the donation centre’s name, registration number, contact phone number and name for the blood donors to identify the facility and who exactly to meet.

Customer support data and correspondence is collected for the purposes of feedback and resolving disputes and service quality issues.

We may collect and use information about a donation centre’s engagement and interaction on the marketplace, and their ratings (including Centre Score) to encourage user safety, ensure donation centres comply with the Donation Centres Terms, and make sure we’re providing a quality and enjoyable service to everyone. Where the Centre Score drops below a specified threshold, we may issue the donation centre with a notification or request to, for example, digest some further guidance. If your score continues to drop, you may be temporarily suspended from accessing the Medexer platform. You may appeal any decision to suspend your account. For further information on how to appeal a decision to suspend your account, please send an email to our support desk at info@medexer.com.ng.

            3. Legal basis

Personal data is processed for the performance of the contract concluded with the blood donor. The prerequisite for the use of the Medexer services is the processing of the donation centre’s identification and geolocation data.

Organisation and Personal data may be processed on the ground of legitimate interest, including things like investigating and detecting service or payment issues.

Data regarding the legal proceedings of significant consequence is processed for compliance with a legal obligation.

            4. Recipients

Your organisation data will be available on the Medexer Donor App for prospective donors seeking to make a donation.

Blood Donors will see the Donation Centre’s name, registration number, contact person’s name and phone number, and geolocation data. Blood Donors also see these details in the receipt where applicable.

Depending on the location of the donation centre, relevant organisation and personal data may be disclosed to Medexer Limited’s local subsidiaries, representatives, affiliates, agents etc. Processing of organisation and personal data will occur under the same conditions as established in this privacy notice.

We may disclose information under a court order or where we cooperate with a data protection supervisory authority in handling complaints or investigations. We may also share your personal data with law enforcement or other public authorities, including responding to requests when the information is required by law or furthers a public interest task. In any scenario, we’ll always satisfy ourselves that we have a lawful basis on which to share the information, and we’ll make sure that we document our decision.

            5. Security and Access

Any personal data collected while providing our services may be transferred to and stored on the Ethereum blockchain. Only authorised employees of Medexer Limited and partners have access to the organisation and personal data and they may access the data only for the purpose of resolving issues associated with the use of the services (including disputes regarding donation quantity, service quality, user information or payments processing).

Medexer Limited and partners can access personal data to the extent necessary to provide customer support.

            6. Processing Blood Donors Personal Data

You may not process the personal data of blood donors without our permission. You may not contact any blood donor or collect, record, store, grant access, use or cross-use the personal data provided by the blood donor, accessible to you via the Medexer Desktop App for any reason other than for the purposes of fulfilling a blood donation request.

You must comply with the rules and conditions for the processing of the personal data of blood donors as set forth in the Privacy Policy for Blood Donors. If you violate the requirements for the processing of the personal data of blood donors, we may terminate your donation centre’s account and claim damages from you.

            7. Access, correction, retention, deletion and data portability

Organisation and Personal data can be viewed and corrected in the Medexer Desktop App.

Your organisation and attendant personal data will be stored as long as you have an active donation centre account. If your account will be closed the organisation and personal data will be stored for an additional 7-year period.

Data necessary for accounting purposes shall be stored for 7 years.

In the event of suspicions of an administrative or criminal offence, fraud or false information, the data shall be stored for 10 years.

In the event of disputes, the data shall be retained until the claim is satisfied or the expiry date of such claims.

We respond to the request for deleting and transferring personal data submitted by email within a month and specify the period of data deletion and transfer.

Recorded calls shall be stored for a period of 1 year.

At the expiration of the above timelines, we may keep an anonymised copy of your information for research and historical information purposes.

            8. Dispute resolution

Disputes relating to the processing of organisational and personal data are resolved through customer support via (info@medexer.com.ng) or by contacting Medexer Limited’s Data Protection Officer via (privacy@medexer.com.ng).

The supervisory authority is the Nigeria Data Protection Commission.

Our privacy practices are subject to applicable laws in Nigeria where we operate. This means that we engage in the practices described in this notice in Nigeria only if permitted under the laws of the Federal Republic of Nigeria. The Nigeria Data Protection Act, 2023 is the law that permits and governs our operations as it relates to your data and it establishes our supervisory authority for the purpose of data protection.