Privacy Policy

Carebrij is the data controller for the information described here. Doctors, other healthcare professionals and facilities on the platform are separate controllers for the clinical records they create about you, and are bound by their own professional confidentiality duties.

For any privacy question or request, write to our data protection contact at [email protected].

• Account details: your name, email address, phone number, date of birth, sex and profile photo, and the password you set (stored only as a cryptographic hash). If you sign in with Google, we receive your name, email address and profile picture from Google.
• Health information: the services you book, appointment times and status, the notes you add when booking, messages and files you exchange with a professional, and consultation notes a professional writes after your session. Health data is sensitive personal data under the NDPA.
• Payment information:your wallet balance and transaction history, and the reference for each payment. Card and bank details are entered on our payment processor's page and are never stored by us.
• Professional credentials (for doctors and facilities): licence numbers, verification documents, qualifications, practice address and payout account details.
• Technical information: log data such as your IP address, device and browser type, and the pages or actions you perform, which we use to keep the service running and secure.

• To provide the service you asked for — creating your account, showing available professionals, taking bookings, running consultations and processing payments. Basis: performance of a contract with you.
• To handle your health information so a professional can care for you, and to keep a record of that care. Basis: your explicit consent, given when you book and when you share information in a consultation, and the provision of healthcare.
• To keep the platform safe: verifying professionals, preventing fraud and abuse, and investigating security incidents. Basis: our legitimate interest in a safe service, and legal obligations.
• To contact you about your appointments and payments. Basis: performance of a contract. You control push and in-app alerts in your profile settings; essential messages about a booking are always sent.
• To meet legal, tax, accounting and regulatory obligations, and to respond to lawful requests. Basis: legal obligation.

We do not sell your personal data. We share it only as follows.

• The professional you book: your name, profile details, the reason for the visit, and anything you send in the consultation.
• Paystack (payments) to take payments and process payouts.
• LiveKit (video) to run video consultations. Calls are transmitted over encrypted connections and are not recorded by us.
• Cloudflare (R2 file storage) for profile photos, verification documents and files you attach to a consultation. Documents and attachments are private and only reachable through short-lived links.
• Hosting and infrastructure providers that run our servers, database and error logging.
• Authorities or third partieswhere the law requires it, or where it is necessary to protect someone's life or safety.

These providers act on our instructions under written terms, and may only use your data to provide their service to us.

Our infrastructure and the providers above may process data outside Nigeria. Where that happens, we rely on the transfer conditions in the NDPA, including adequacy or contractual safeguards with the recipient, and we only use providers that commit to a comparable level of protection.

• Clinical records (appointments, consultation notes, consultation messages) are kept for as long as medical record-keeping rules and professional guidance in Nigeria require, even if you close your account.
• Payment and transaction records are kept for the period required by tax and financial regulations.
• Account and profile data is deleted or anonymised after your account is closed, except where we must keep it for the reasons above.
• Technical logs are kept for a short period for security and troubleshooting.

Data is encrypted in transit. Passwords are hashed, access to production data is restricted to staff who need it, and consultation content is stored encrypted at rest. Consultation messages are not end-to-end encrypted: our systems can technically access message content, which is what allows us to deliver, back up and restore it, and to act on a lawful request or a safety concern.

No service can promise perfect security. If a breach affects your rights, we will notify you and the Nigeria Data Protection Commission as the NDPA requires.

Under the NDPA you may:

• Ask for a copy of the personal data we hold about you.
• Ask us to correct information that is wrong or incomplete.
• Ask us to delete data we no longer have a lawful reason to keep.
• Ask us to restrict or object to certain uses of your data.
• Ask for your data in a portable format, or to be sent to another provider.
• Withdraw consent at any time, without affecting what we did before you withdrew it.
• Complain to the Nigeria Data Protection Commission if you believe we have not handled your data properly.

To exercise any of these, email [email protected]. We may ask you to confirm your identity first, and we respond within the time the NDPA allows.

Accounts are for adults aged 18 and over. A parent or legal guardian may use their own account to book care for a child and is responsible for the information they share about them.

We store your session token and a small number of preferences, such as your theme, on your device. These are needed to keep you signed in and to remember your choices; we do not use advertising cookies or sell tracking data.

If we change this policy we update the date above, and we tell you in the app when the change is significant. Continuing to use Carebrij after a change means you accept the updated policy.

See also our Terms of Service.