Privacy Policy
This policy explains what personal data Mascot Healthcare Clinic Limited ("we", "us") collects through this website and at our clinic, why we use it, who we share it with, how long we keep it, and the rights you have under the Nigeria Data Protection Act 2023 (NDPA). We are the data controller for this data.
We run a primary-care clinic at 52 Sholanke Street, off Chemist Junction, Akoka, Lagos: doctor consultations and ultrasound scans by appointment, and walk-in lab tests. We do not provide online or video consultations.
In short
- We collect what you give us when you book, register, contact us or visit the clinic, including health information.
- We use it to provide your care, run bookings and keep our services safe. We never sell it or use it for advertising.
- Some of the services we use are based outside Nigeria (Section 7).
- Optional cookies are used only if you accept them (Section 8). We don't use Google Analytics.
- Our online forms are for adults aged 18 or older (Section 13).
- You can ask to see, correct or delete your data, and you can complain to the Nigeria Data Protection Commission (Section 12).
- Who we are and how to contact us
- What we collect
- Health information
- Why we use your data and our legal basis
- Who we share it with
- The online assistant
- Data processed outside Nigeria
- Cookies
- How long we keep it
- How we protect it
- If something goes wrong
- Your rights
- Children
- Newsletter and marketing
- Automated decisions
- Changes to this policy
1. Who we are and how to contact us
Mascot Healthcare Clinic Limited, 52 Sholanke Street, off Chemist Junction, Akoka, Lagos.
Data Protection Officer: Dr Kehinde Lawal. Phone 0816 586 6252, WhatsApp 0903 185 8761, or ask for the Data Protection Officer at the clinic. For a request about your data, say it is a "data request".
2. What we collect
| When | What we collect |
|---|---|
| You book an appointment or lab test (booking pages or the booking card in our chat) | Your name, phone number, email address (optional on most forms), the service or tests you choose, your preferred date and time, and any note you add. The service or tests you book can reveal health information. |
| You register as a new patient online | Your name, date of birth, sex, contact details, address and next of kin. The full registration form also asks for things such as your title, marital status, occupation, state and LGA, allergies, long-term conditions, health insurance details and how you heard about us. |
| You create or use a patient account | Username, email, password (stored only in scrambled, hashed form), name, date of birth, sex, state and LGA, any medical history you choose to add (for example allergies, medicines, smoking and alcohol, family history, past illnesses, last menstrual period), and any story you choose to submit. |
| You visit the clinic | Your clinical record: consultation notes, test results, scan reports, prescriptions, referrals and payments. |
| You use the online assistant or the "Help me choose" test guide | The messages or symptoms you type (see Section 6). |
| You send us feedback | Your rating, your comment and, if you give it, your phone number. |
| You sign up for our newsletter | Your name and email address. |
| You apply for a job | Your name, contact details, area of residence, the role, your qualifications, experience, salary expectations, your CV and your other answers. |
| You add your name on our culture page or send a suggestion | Your name and email address (optional for suggestions) and what you write. |
| You call or WhatsApp us | Your phone number and what you tell us. |
| You visit the website | Technical data our web host and Cloudflare record to run and protect the site, such as your IP address, browser type and the pages requested. If you accept optional cookies, we also count your visits (Section 8). |
We may also receive information about you from a health professional who refers you to us, or from a parent or guardian who books for a child by phone.
3. Health information
Information about your health is sensitive personal data under the NDPA. We use it to provide and manage your care. It is handled by health professionals and staff who are bound by a duty of confidentiality, including under the National Health Act 2014. Where we ask for your consent, for example when you register as a patient online, we rely on that explicit consent.
4. Why we use your data and our legal basis
| Purpose | Legal basis under the NDPA |
|---|---|
| Taking your booking and providing consultations, scans and lab tests | To provide the service you ask for (contract); for health information, the provision of health care |
| Keeping your medical records | Legal obligation; provision of health care |
| Sending booking confirmations and messages about your care | To provide the service you ask for |
| Answering questions through the online assistant | Your request; our legitimate interest in helping visitors |
| Keeping the website and our systems secure and preventing abuse | Legitimate interests |
| Counting website visits | Consent (optional cookies) |
| Sending our newsletter | Consent |
| Handling feedback, suggestions and complaints | Legitimate interests |
| Considering job applications | Steps you ask us to take before a possible contract |
| Meeting legal duties, such as reporting certain conditions to public health authorities, and dealing with legal claims | Legal obligation; legitimate interests |
5. Who we share it with
We do not sell your data and we do not share it with advertisers. We share it only as follows:
- Health professionals and laboratories we refer you to, when you agree to the referral.
- Public authorities, such as public health authorities, regulators, the police or courts, when the law requires it.
- Service providers who run parts of our services for us. They process data under their own service terms:
| Provider | What they do | Data involved |
|---|---|---|
| Namecheap | Hosts our website, booking system and website email | Everything you submit on the website |
| Cloudflare | Security and fast delivery of the website | All website traffic, including IP addresses |
| Email inbox where the clinic receives booking notifications; reCAPTCHA spam protection; fonts; maps (only if you accept optional cookies or tap "Show map") | Booking details; IP address and browser data | |
| Groq and Anthropic | Generate the online assistant's replies | What you type into the assistant or test guide |
| Meta (WhatsApp) | Messaging, if you contact us on WhatsApp | Your number and messages |
6. The online assistant
The chat assistant and the "Help me choose" test guide send what you type to an AI provider (Groq or Anthropic) so it can write a reply. We do not keep a copy of your conversation. The provider may keep it for a short time under its own terms. Please don't type your name, contact details or detailed medical history into the assistant. If you book through the assistant, your booking details go straight to the clinic, not to the AI provider.
7. Data processed outside Nigeria
The providers in Section 5 store or process data outside Nigeria, including in the United States and Europe. Those countries may not protect personal data in the same way Nigerian law does. We transfer data only on the grounds the NDPA allows (sections 41 to 43), for example where the transfer is needed to provide a service you have asked for, and we rely on the providers' own data protection commitments. You can ask our Data Protection Officer for more details.
8. Cookies
We use essential cookies to run and secure the website; these don't need your consent. Optional cookies are used only if you choose "Accept all" in our cookie banner. "Essential only" is just as easy to choose, nothing is pre-ticked, and you can change your choice at any time with the "Cookie settings" link at the bottom of every page.
| Cookie | Type | What it does | Kept for |
|---|---|---|---|
| mhs_consent | Essential | Remembers your cookie choice. | 180 days |
| PHPSESSID | Essential | Keeps you signed in on account and staff pages. Not set on our public pages. | Until you close your browser |
| Google reCAPTCHA | Essential | Stops automated sign-ups on the account sign-up and newsletter pages. Set by Google. | Set by Google |
| tracking_session | Optional (statistics) | Counts visits on our own server: the pages you view, when, your IP address and browser type. Not shared with anyone. Removed if you choose "Essential only". | 30 days |
| Google Maps | Optional | Shows the clinic map on some pages. Google sets its own cookies. Without consent we show a link to Google Maps instead. | Set by Google |
Some pages load fonts and icons from Google Fonts and the Cloudflare CDN. These don't set cookies but receive your IP address so they can deliver the files. You can also block or delete cookies in your browser settings.
9. How long we keep it
- Medical records: for as long as medical record-keeping rules require and your ongoing care needs.
- Bookings: in our booking system for as long as we need them to manage your appointments and keep proper records.
- Patient accounts: until you ask us to delete your account. Deactivating your account switches it off but does not delete it.
- Online assistant conversations: not kept by us.
- Visit statistics: only while they are useful for understanding how the website is used.
- Feedback and suggestions: while they help us improve our services.
- Newsletter: until you unsubscribe.
- Job applications: for the recruitment process and a reasonable time afterwards, unless you ask us to delete yours sooner.
- Security logs: kept by our web host and Cloudflare under their own retention periods.
When we no longer need data, we delete it or make it anonymous.
10. How we protect it
The website uses an encrypted connection (HTTPS). Account passwords are stored only in hashed form. Access to patient records is limited to staff who need it for their role, and our staff are bound by professional confidentiality. Data files on the website are blocked from public access. No system is completely secure, so please tell us at once if you think your data or account has been misused.
11. If something goes wrong
If a personal data breach is likely to put your rights at risk, we will report it to the Nigeria Data Protection Commission within 72 hours of becoming aware of it. If the risk to you is high, we will also tell you without undue delay and explain what you can do.
12. Your rights
Under the NDPA you have the right to:
- be told how your data is used (this policy);
- get a copy of the personal data we hold about you;
- have inaccurate or incomplete data corrected;
- have your data deleted when we have no lawful reason to keep it (we may still need to keep medical records);
- ask us to limit how we use your data;
- receive data you gave us in a commonly used electronic format;
- object to our use of your data, including for marketing;
- withdraw your consent at any time, without affecting what we did before;
- not be subject to decisions made solely by automated means that significantly affect you.
To use any of these rights, contact our Data Protection Officer (Section 1). We may ask a few questions to confirm it is you before we act, and we will reply within the time the law allows. You can update your account details yourself under "Account Options".
If you are not happy with how we handle your data or your request, you can complain to the Nigeria Data Protection Commission at ndpc.gov.ng.
13. Children
Our online forms (booking, registration, account sign-up, feedback, newsletter and job applications) are for adults: each asks you to confirm you are 18 or older, and where a form asks for your date of birth we check it. If you are under 18, a parent or guardian can book for you by phone on 0816 586 6252. If we learn that a child has given us personal data online without a parent's or guardian's consent, we will delete it, unless we need it for the child's care, in which case we will contact a parent or guardian.
14. Newsletter and marketing
We send our newsletter only to people who sign up for it, and nothing is pre-ticked. You can unsubscribe at any time with the link in the email or by contacting us. Messages about your own bookings and care are not marketing.
15. Automated decisions
We don't make decisions about you that have legal or similarly significant effects by automated means alone. The online assistant and the "Help me choose" guide only make suggestions; our staff handle bookings and our doctors decide on your care.
16. Changes to this policy
We will update this policy when the way we handle personal data changes. The date at the top shows the latest version. For important changes we will also put a notice on our website.
Last updated 27 October 2026.