Last Updated: 31st July 2023

This privacy notice lets you know how we promise to look after your personal data. This notice tells you things like what information we use to provide you with our services, how we use your information to keep you safe, and the choices and controls available to you. This notice also tells you about your privacy rights and how data protection rules work to protect everyone.

MEDEXER LIMITED is the Controller of your personal data unless otherwise stated below.

Our postal address is NO 10, SILK SUITES CLOSE, ZARMAGANDA-FAVWEI ROAD, JOS, PLATEAU, NIGERIA.

We have nominated a Data Protection Officer, and you can contact him at privacy@medexer.com.ng or via our above-stated postal address. Please mark the envelope ‘Data Protection Officer.’

The term “us” or “we” refers to the owner of the Medexer Donor App, Medexer Limited, a private company limited by shares (RC 6906691) incorporated with the Corporate Affairs Commission in Nigeria. The term “you” or “your” refers to the donor who registers and opts in for requests of donation to be made to him or her through their Medexer Donor App.

1. Personal data we process

We only process information that we need, so we can provide our donation centres with information on how to contact you when they need to and how you will be able to reach them to fulfil a donation request.

• Contact details: Things like name, phone number, e-mail address, and your contact or home address.
• Profile information: Things like your bank details, profile picture, saved addresses, language, and communication preferences.
• Biometric information: Things like your blood type, blood group and medical history.
• Geolocation: such as your route(s) to the donation centre and the time.
• Communication and correspondence records such as when you engage with our in-app chat or speak with our customer service agents.
• Limited identification data of the device, like the IP address, on which the Medexer Donor App has been installed.
• Data about the usage of our services: Things like data about donation status, times and data about your conduct as assessed by donation centres.

2. Purpose of the processing

We process your personal data so we can provide you with one or more of our blood donation services:

• We connect you with a donation centre and help find you a donation centre open to receiving your appointment request: We collect and process personal data for the purpose of connecting blood donors with donation centres so you can be able to make blood donations; or show you where the nearest donation centre open to accepting donations are located.
• We show you how to get to our donation centres: We display geolocation data and the phone number of blood donors to donation centres when seeking appointments for donations to enable effective communication and coordination for a successful donation and route transparency. This data is collected only when the Medexer Donor App is activated. The collection of geolocation data stops after closing the Medexer Donor App. 
• We make sure the app is optimal: We use contact details to notify blood donors and donation centres of updates to the Medexer Donor App so you can keep using our services and also keep your account safe through authentication and verification checks.
• We maintain and promote standards: We collect data about donation statuses, and time from the donation centre’s feedback to promote compliance with our terms and conditions and ensure we provide a quality and enjoyable service to everyone. Customer support data and correspondence is collected for the purposes of feedback and resolving disputes and service quality issues.
• We keep you informed: Your name, phone number and email address will be used to communicate with you for things like letting you know that your donation has been received, sending you donation request confirmation slips and payment receipts, and letting you know about important service updates.

3. Legal Basis

We are allowed to use personal information in the ways described above if we have a proper reason to do so. We always make sure we have a good reason for doing anything with your data.

• Personal data is generally processed to provide the services contracted through the Medexer Donor App. This means that to give you the service we promised you, and to meet our terms and conditions, we’ll process your personal data to meet those obligations.
• We generally in other circumstances process your personal data relying on legitimate interest grounds. Legitimate interests include our commercial interests in providing an innovative, personalised, safe, and profitable service to our donors and partners unless those interests are overridden by other interests. Our legitimate interests also include things like investigating and detecting fraudulent representations or any kinds of misrepresentations and other malicious activities, maintaining the security of our network and systems, and responding to suspected or actual criminal acts.

We may from time to time rely on alternative legal bases when:

• it is necessary to comply with a legal obligation such as for processing data when the law requires it, including, for example, if there is a valid legal request to disclose personal information to a third party such as a Court or regulatory authority;
• to protect your vital interests or those of others, for example in the event of an emergency or an imminent threat to life; or
• you have given us clear consent to do so for another specific purpose for which you have been fully informed.

If you choose not to give us personal information it may prevent us from fulfilling the contract with you, or stop us from doing something expected of us in law. It may also mean that we cannot operate your account. For example, we collect and process the personal data submitted by you in the course of installing and using the Medexer Donor App; refusing to share geolocation data via the App means we cannot direct you to the closest donation centre or show our partners which donor is close to them and can be booked for an appointment. We will not be able to fulfill our obligations to you in other circumstances, for example, should you refuse to undertake an identity verification check to ensure the integrity of your account, then the account may be suspended or blocked to prevent fraud.

4. Recipients

We only work with trusted partners and legal authorities which we refer to as donation centres and they include but are not limited to hospitals, blood banks, etc. We only share when there is a proper reason to do so. We limit sharing to only that which is required. We do not sell your personal information.

• The personal data of the blood donor is only disclosed to a donation centre when they engage with a request for donation on the Medexer Desktop App; in such a case, the donation centre will see the name, phone number, relevant blood-related and geolocation data of the blood donor.
• After providing a donation, the name and telephone number of the blood donor will not remain visible to the donation centre. 
• A donation centre may keep an anonymized copy of your information which will be referenced and retrieved should there be a need to contact you to make another donation. 
• Feedback given by blood donors regarding the quality of the services at a donation centre is anonymous. Your rating is private between you and Medexer.
• Depending on the location of the blood donor, personal data may be disclosed to Medexer Limited. Processing of personal data by Medexer Limited and partners will occur under the same strict conditions as established in this privacy notice.
• In some circumstances, we are legally obliged to share information with external recipients. For example, under a Court Order or where we cooperate with a data protection supervisory authority in handling complaints or investigations. We can also respond to requests, such as those from law enforcement agencies when we have a good-faith belief that the response is required by law in Nigeria or furthers a public interest task, affects users, and is consistent with internationally recognised standards. In any scenario, we’ll always satisfy ourselves that we have a lawful basis on which to share the information, and we’ll make sure that we document our decision.
• Copies of  your information and data would be anonymised and stored using blockchain technology.

5. Security and access

• Only authorised employees of Medexer Limited and partners have access to the personal data and they may access the data only for the purpose of resolving issues associated with the use of the services (including disputes regarding donation quantity or user information or payments processing).
• Medexer Limited and partners can access personal data to the extent necessary to provide customer support, where necessary.
• For our research and scientific purposes, all data, like bulk geolocation or blood-related data, is anonymised so you can never be identified from it.

6. Your rights and controls

We want you to stay in control of your personal data. Medexer provides you with controls through the app where you can view your personal information including your profile data and donation history. We also offer in-app settings like health tips, marketing opt-ins, and transparent cookie consent controls on our website.

Your right of access

• You can access your personal data via the Medexer Donor App. You have the right to ask us for copies of your personal information. There are exemptions, such as when we have to balance the rights of others, which means you may not always receive all the information we process.

Your right to rectification

• You can access and update your personal data via the Medexer Donor App. You have the right to ask us to rectify information you think is otherwise inaccurate. You also have the right to ask us to complete information you think is incomplete.

Your right to erasure

• You have the right to ask us to erase your personal information in certain circumstances.

Your right to restriction of processing

• You have the right to ask us to restrict the processing of your information in certain circumstances. This means that your data can only be used for certain things, such as legal claims or to exercise legal rights.

Your right to object to processing

• You may have the right to object to processing if we are processing your information on the basis of legitimate interests. You may submit an objection to any automated decision we have made, and ask that a person review it.

Your right to data portability

• You have the right to ask that we transfer the information you gave us from one organisation to another, or give it to you, in certain circumstances. This only applies to the information you have given us.

7. Retention

Medexer retains user data for only as long as necessary for the purposes described above. This means that we retain different categories of data for different periods of time depending on the type of data, the donation it relates to, and the purposes for which we collected the data.

• Your personal data will be stored as long as you have an active donor account. If your account is closed, personal data will be deleted (according to our retention schedule and rules), unless such data is still required to meet any legal obligation, or for accounting, dispute resolution or fraud prevention purposes.
• In the event of a suspected criminal offence, fraudulent activity or false information having been provided, the data will be stored for up to or more than 10 years, but not more than necessary.
• In case of payment disputes, data will be retained until the claim is satisfied or the expiry date of such claims.

Please note that the de-installation of the Medexer Donor App in your device does not cause the deletion of your personal data. If the Medexer Donor App has not been used for three years, we’ll get in touch and ask you to confirm whether you wish to keep your account active for future use. If no reply is received in a reasonable time, the account will be closed and personal data will not be held for longer than necessary.

8. Direct marketing

• We may send direct marketing messages to your e-mail address and/or phone number when you have given us permission to do so, or on a soft opt-in basis. We may personalise direct marketing messages using information on how you use Medexer’s services, such as how frequently you make donations and centre preferences.
• If you no longer wish to receive direct marketing messages, please click the “Unsubscribe” link in the footer of one of our emails, or opt-out in the profile section of the Medexer Donor App.

9. Automated decision making

We use automated decision-making in case of issuing warnings and implementing service suspensions. Using automated decision-making is less error-prone, more efficient and safer than using our employees. Data about your usage of our services (data about donation status, including cancellations and no-shows and data about your conduct as assessed by donation centres) is considered when assessing the need for a warning or suspension. Donor suspension will stay in force for as long as Medexer deems fit within the confines of the Constitution governing the jurisdiction, within which a review will be done by Medexer to determine if your services would be restored.

You will always have the right to human review of the decision and to contest the decision, express your point of view and obtain an explanation by contacting our customer support in our app.

10. Dispute resolution

• Disputes relating to the processing of personal data are resolved through customer support (info@medexer.com.ng) in the first instance. You have the right to contact Medexer’s Data Protection Officer (privacy@medexer.com.ng).
• Our supervisory authority is the Nigeria Data Protection Commission.
• Our privacy practices are subject to applicable laws in Nigeria where we operate. This means that we engage in the practices described in this notice in Nigeria only if permitted under the laws of the Federal Republic of Nigeria. The Nigeria Data Protection Act, 2023 is the law that permits and governs our operations as it relates to your data and it establishes our supervisory authority for the purpose of data protection.

11. Making this notice great

We hope you have found this privacy notice easy to understand.

Data protection laws are important. They strengthen the rules and enhance your information rights. Many of these rules may appear complicated, but most are grounded in common sense. We take our responsibilities with your data seriously. Medexer will continue to make changes to this privacy notice as part of our commitment to protecting your privacy and affording you even more transparency.