Privacy Policy

This Privacy Policy applies to:

• Healthcare professionals, administrators, and staff authorised to use NeoEHR
• Operational and support users accessing NeoEHR on behalf of a healthcare facility

This policy does not replace patient privacy notices issued by hospitals or clinics.

Patient personal data processed through NeoEHR is subject to a separate Patient Privacy Notice.

For the purposes of applicable data protection laws, the relevant hospital or clinic acts as the Data Controller and is responsible for providing patients with appropriate privacy information. Plural processes patient personal data as a Data Processor and makes available a Patient Privacy Notice describing its role, obligations, and data processing activities in support of healthcare delivery.

For the purposes of applicable data protection laws, including the Nigeria Data Protection Act 2023:

• Hospitals, clinics, and healthcare facilities using NeoEHR act as Data Controllers, determining the purposes and means of processing patient personal data.
• Plural Health Limited acts as a Data Processor, processing personal data solely on documented instructions from the Data Controller.

Plural does not independently determine how patient data is used and does not use patient data for its own purposes beyond providing and supporting the NeoEHR platform.

3.1 User (staff) information

To enable secure and accountable access to NeoEHR, we process information relating to authorised users, including:

• Name
• Email address
• Phone number
• Job title and role
• User credentials and access permissions
• Activity and access logs

This information is used to manage user accounts, system security, and auditability.

3.2 Patient health and administrative information

On behalf of hospitals and clinics, NeoEHR processes patient information entered and managed by authorised healthcare professionals, including but not limited to:

• Patient demographic details
• Clinical notes, symptoms, and diagnoses
• Vital signs and observations
• Laboratory and diagnostic test requests and results
• Prescriptions and medication records
• Visit records, referrals, and care documentation

Plural processes this information strictly as a data processor and does not create, alter or independently interpret patient health records.

3.3 Technical and usage information

We may collect technical and usage data associated with NeoEHR access, including:

• IP address
• Device type and browser information
• Operating system version
• Date, time, and duration of system access
• Error logs and performance metrics

This data is used to maintain platform reliability, security and performance.

Information processed through NeoEHR is used solely to:

• Provide, operate and maintain the NeoEHR platform
• Enable secure access to patient records by authorised users
• Support clinical, administrative and operational workflows
• Provide customer support and respond to service requests
• Monitor usage, performance and system integrity
• Detect, prevent and address technical or security issues
• Comply with legal and regulatory obligations

Plural does not use data processed through NeoEHR for advertising, profiling, or unrelated commercial activities.

Personal data processed through NeoEHR is handled in accordance with the Nigeria Data Protection Act 2023 on the following lawful bases:

• Performance of a contract with healthcare facilities
• Provision of healthcare services by licensed providers
• Compliance with legal and regulatory obligations
• Protection of vital interests, where applicable

Information processed through NeoEHR may be disclosed only:

• To authorised personnel within the relevant healthcare facility
• To approved third-party service providers acting under written data processing agreements
• Where required by law, regulation, or lawful request by public authorities

All third-party processors are subject to confidentiality, data protection and security obligations consistent with this policy.

Plural implements appropriate technical and organisational measures to safeguard information processed through NeoEHR, including:

• Role-based access controls
• Authentication and authorisation mechanisms
• Audit logs and access monitoring
• Secure hosting and infrastructure environments
• Data encryption where appropriate
• Staff training and confidentiality obligations

While we take reasonable steps to protect information, no system of electronic storage or transmission can be guaranteed to be completely secure.

Personal data processed through NeoEHR is retained:

• In accordance with instructions from the healthcare facility
• In line with applicable healthcare, regulatory and legal requirements
• For the duration necessary to support healthcare delivery and system integrity

Deletion or return of data is handled in line with contractual obligations and applicable laws.

NeoEHR is designed to support hospitals and clinics in meeting their patient privacy obligations.

Patient rights, consent management and data access requests are governed by the policies and procedures of the relevant healthcare provider.

Plural supports Data Controllers in responding to patient requests where required by law.

Where data is hosted or processed outside Nigeria, Plural ensures that appropriate safeguards are in place to protect personal data in accordance with applicable data protection laws.

This Privacy Policy may be updated periodically to reflect changes in law, technology, or our data processing practices.

The most recent version will always be made available through NeoEHR or on our website.

If you have questions or concerns about this Privacy Policy, please contact:

Visit the NeoEHR webpage