1. Introduction

RedCare Health Services Limited ("RedCareHMO" or "the Company") collects and processes certain specific information, such as names, telephone numbers, addresses, biodata and other details, that may uniquely identify individuals as part of its operations. These individuals include current, past and prospective employees, vendors, customers, clients, their representatives, next-of-kin and other individuals with whom RedCareHMO communicates or deals, jointly and/or severally ("Data Subjects").

Maintaining Data Subjects' trust and confidence requires that Data Subjects do not suffer negative consequences or effects as a result of providing RedCareHMO with their Personal Data for processing. RedCareHMO is therefore firmly committed to complying with applicable data protection laws, regulations, rules and principles to ensure the security of Personal Data handled by the Company.

This Data Privacy & Protection Policy ("Policy") describes the minimum standards that must be strictly adhered to regarding the collection, storage, use and disclosure of Personal Data. It also confirms that RedCareHMO is dedicated to processing Personal Data it receives or processes with absolute confidentiality and security.

This Policy applies to all systems, operations and processes within the RedCareHMO environment that involve the collection, storage, use, transmission and disposal of Personal Data.

Failure to comply with the data protection rules and guiding principles set out in the Nigeria Data Protection Act 2023 (NDPA), as well as those set out in this Policy, is a material violation of RedCareHMO's policies and may result in disciplinary action as required, including suspension or termination of employment or business relationship.

2. Scope

This Policy applies to all employees of RedCareHMO and to external business partners, including suppliers, contractors, vendors and service providers, who receive, send, collect, access or process Personal Data in any way on behalf of RedCareHMO, including processing wholly or partly by automated means.

This Policy also applies to third-party Data Processors who process Personal Data received from RedCareHMO by automation or otherwise.

3. General Principles for Processing Personal Data

RedCareHMO is committed to maintaining the principles set by the NDPA regarding the processing of Personal Data and to creating a positive privacy culture within RedCareHMO.

3.1 Lawfulness, Fairness and Transparency

Personal Data must always be processed lawfully, fairly and transparently. Personal Data collected and processed by or on behalf of RedCareHMO must be processed in accordance with the specific, legitimate and lawful purpose consented to by the Data Subject, except where processing is otherwise allowed by law or another legal ground recognized by the NDPA 2023.

3.2 Data Accuracy

Personal Data must be accurate and kept up to date. RedCareHMO shall:

1. ensure that data it collects and/or processes is accurate and not misleading in a way that could be harmful to the Data Subject;
2. make reasonable efforts to keep Personal Data updated where applicable; and
3. make timely efforts to correct or erase Personal Data when inaccuracies are discovered.

3.3 Purpose Limitation

RedCareHMO collects Personal Data only for the purposes identified in the appropriate RedCareHMO Privacy Notice, relevant document or other communication provided to the Data Subject and for which Consent has been obtained. Personal Data cannot be reused for a purpose that is incompatible with the original purpose, except where new Consent is obtained.

3.4 Data Minimization

1. RedCareHMO limits Personal Data collection and usage to data that is relevant, adequate and necessary for carrying out the purpose for which the data is processed.
2. RedCareHMO will evaluate whether and to what extent processing Personal Data is necessary and, where the purpose allows, anonymized data will be used.

3.5 Integrity and Confidentiality

1. RedCareHMO shall establish adequate controls to protect the integrity and confidentiality of Personal Data, both in digital and physical format, and to prevent Personal Data from being accidentally or deliberately compromised.
2. Personal Data of Data Subjects will be protected from unauthorized viewing, access and changes to ensure that it is reliable and correct.
3. Any Personal Data processing undertaken by an employee who has not been authorized to carry it out as part of their legitimate duties is unauthorized.
4. Employees may access Personal Data only as appropriate for the type and scope of the task in question. Employees are forbidden to use Personal Data for private or commercial purposes, disclose it to unauthorized persons, or make it available in any other way.
5. The Human Resources Department will institutionalize maintenance of Personal Data privacy as part of onboarding for new recruits and continuous sensitization for existing staff. This obligation remains in force even after employment has ended.

3.6 Personal Data Retention

1. All personal information shall be retained, stored and destroyed by RedCareHMO in line with relevant legislative and regulatory guidelines. RedCareHMO shall periodically review retained data to confirm its accuracy, purpose, validity and retention requirement.
2. The length of storage of Personal Data shall be determined by factors including contract terms, statutory retention requirements, an express request for deletion by the Data Subject, and any other lawful basis for retaining the information beyond the original purpose.
3. RedCareHMO may retain and process Personal Data for archiving, scientific research, historical research or statistical purposes in the public interest, as permitted by the NDPA.
4. RedCareHMO will delete Personal Data where it is no longer required, in line with RedCareHMO's Retention Policy and Data Subject Access Request Policy, provided no law or regulation requires RedCareHMO to retain it.

3.7 Accountability

1. RedCareHMO demonstrates accountability in line with NDPA obligations by monitoring and continuously improving data privacy practices within RedCareHMO and its operations.
2. Any individual or employee who breaches this Policy will be subjected to internal disciplinary action, up to and including termination of employment, and may also face civil or criminal liability if their action violates the law.

4. Data Privacy Notice

RedCareHMO considers Personal Data confidential and will protect it from unauthorized use and/or disclosure. RedCareHMO will ensure that Data Subjects are provided with adequate information regarding the use of their Personal Data and will obtain their Consent, digitally or in print, where necessary.

RedCareHMO shall display a simple and conspicuous Privacy Notice on as many media as possible through which Personal Data is collected or processed. Such notice may include:

1. a description of collectible Personal Data;
2. the purposes for which Personal Data is collected, used and disclosed;
3. what constitutes the Data Subject's Consent;
4. the technical methods used to collect and store information;
5. available remedies in the event of violation of the Policy and the timeframe for remedy; and
6. information needed to exercise privacy rights, such as access to, rectification and deletion of Personal Data.

5. Purpose and Category of Data Collected and Processed

RedCareHMO will only collect and use your Personal Data where we have obtained your prior consent or have a lawful and legitimate interest to do so. You may withdraw your consent at any time by contacting the Data Protection Officer at dpo@redcarehmo.com.

The following are examples of data collected and processed by RedCareHMO:

• communication data, such as name, telephone/mobile number, email, home/mailing address and IP address;
• key contract data, including contractual relationship, product or contractual interest;
• customer history, contract billing and payments data, planning and control data;
• movement data, such as patterns of behaviour for human mobility, visits and traffic routes;
• disclosed information from third parties;
• employee and prospective employee data collected for recruitment and onboarding, such as photo, date of birth, email, marital status and sex;
• medical data, Personal Health Records (PHR), Electronic Medical Records (EMR) and Electronic Health Records (EHR).

RedCareHMO may collect and store Personal Data through mobile applications, cookies, CCTV recordings, physical and online forms, biometric tools/devices and IoT devices.

6. Legal Grounds for Processing Personal Data

Processing of Personal Data by RedCareHMO shall be lawful where at least one of the following applies:

1. the Data Subject has given Consent to the processing of his/her Personal Data for one or more specific purposes;
2. processing is necessary for the performance of a contract to which the Data Subject is party, or to take steps at the Data Subject's request before entering a contract;
3. processing is necessary for compliance with a legal obligation to which RedCareHMO is subject;
4. processing is necessary to protect the vital interests of the Data Subject or another natural person; or
5. processing is necessary for a task carried out in the public interest or in the exercise of an official public mandate vested in RedCareHMO.

7. Consent

Where processing of Personal Data is based on Consent, RedCareHMO shall obtain the requisite Consent of Data Subjects at the time of collection. RedCareHMO will ensure that Consent is requested in clear and plain language, freely given without fraud, coercion or undue influence, distinct from other matters, explicitly affirmative, obtained for each purpose, and clearly manageable or withdrawable by the Data Subject.

7.1 Valid Consent

For Consent to be valid, it must be given voluntarily by an appropriately informed Data Subject. Consent cannot be implied. Silence, pre-ticked boxes or inactivity does not constitute Consent under the NDPA. Consent in respect of Sensitive Personal Data must be explicit; a tick of the box would not suffice.

7.2 Consent of Minors

The Consents of minors under the age of 18 will always be protected and obtained from the minor's principals, sponsors or representatives in accordance with applicable regulatory requirements.

8. Data Subject Rights

Data Subjects whose Personal Data is held by RedCareHMO are entitled to the following rights:

1. the right to request and access their Personal Data collected and stored;
2. the right to information on their Personal Data collected and stored;
3. the right to object or request restriction;
4. the right to object to automated decision-making;
5. the right to request rectification and modification of their data;
6. the right to request deletion of their data, except as restricted by law or RedCareHMO's statutory obligations;
7. the right to request movement of data from RedCareHMO to a third party, known as data portability; and
8. the right to object to, and request restriction of, processing of their information, except as required by law or statutory obligations.

Data Subjects can exercise any of their rights by completing RedCareHMO's Data Subject Access Request (SAR) Form or by emailing dpo@redcarehmo.com.

9. Transfer of Personal Data

9.1 Third-Party Processor Within Nigeria

RedCareHMO may engage third parties to process Personal Data collected by the Company. Such processing shall be governed by a written contract that requires adequate protection and security measures in accordance with this Policy and the NDPA.

9.2 Transfer of Personal Data to a Foreign Country

Where Personal Data is transferred outside Nigeria, RedCareHMO shall put adequate measures in place to ensure the security of such Personal Data. RedCareHMO shall assess whether the recipient country is on NITDA's White List of countries with adequate data protection laws.

RedCareHMO will only transfer Personal Data outside Nigeria where a recognized condition applies, including Data Subject Consent, contractual necessity, public interest, legal claims, vital interests, or research/study purposes that do not expressly identify the Data Subject. RedCareHMO will take all necessary steps to ensure that Personal Data is transmitted safely and securely. Details of protection given to information transferred outside Nigeria shall be provided upon request.

Where the recipient country is not on the White List and no recognized condition is met, RedCareHMO will engage with NITDA and the Office of the Honourable Attorney General of the Federation (HAGF) for approval.

10. Data Breach Management Procedure

RedCareHMO maintains a data breach procedure to address incidents concerning Personal Data or privacy practices that lead to accidental or unlawful destruction, loss, alteration, unauthorized disclosure of, or access to, Personal Data transmitted, stored or otherwise processed.

Employees must immediately inform their designated line manager or the DPO of violations, including improper transmission of Personal Data across borders, loss or theft of data or devices, accidental sharing with unauthorized persons, inappropriate access controls, equipment failure, human error and cyber attacks.

When a potential breach occurs, RedCareHMO will validate the breach, conduct and document an impartial investigation, identify remediation requirements, report findings to management, coordinate with authorities where necessary, manage communications and notify impacted Data Subjects where required.

11. Data Protection Impact Assessment

RedCareHMO shall carry out a Data Protection Impact Assessment (DPIA) for any new project or IT system involving the processing of Personal Data to determine whether such processing is likely to create risks to the rights and freedoms of Data Subjects. DPIAs shall be carried out in line with RedCareHMO's Data Protection Impact Assessment Policy.

12. Data Security

All Personal Data must be kept securely and should not be stored longer than necessary. RedCareHMO will employ appropriate measures against unauthorized access, accidental loss, damage and destruction, including password-encrypted databases for digital storage and locked cabinets for paper records.

Appropriate controls may include industry-accepted hardening standards, full disk encryption on corporate devices, encryption at rest, security audit logging, restriction of removable media, anonymization in testing environments and physical access control for hardcopy records.

13. Data Protection Officer

RedCareHMO has appointed a Data Protection Officer (DPO) responsible for overseeing the Company's data protection strategy and implementation to ensure compliance with NDPA requirements.

The Data Protection Officer
RedCare Health Services Limited
41, Gbolade Adebanjo Street,
By Obanikoro B/Stop, Ilupeju,
Lagos.
dpo@redcarehmo.com

The DPO administers data protection policies, monitors compliance, advises the business, acts as a contact point, oversees implementation, supports Data Impact Assessments and maintains a database of RedCareHMO data collection and processing operations.

14. Training

RedCareHMO shall ensure that employees who collect, access and process Personal Data receive adequate data privacy and protection training. On an annual basis, RedCareHMO shall develop a capacity-building plan for employees on data privacy and protection in line with the NDPA.

15. Data Protection Audit

RedCareHMO shall conduct an annual data protection audit through a licensed Data Protection Compliance Organization (DPCO) to verify compliance with the NDPA and other applicable data protection laws. The audit report will be certified and filed by the DPCO to NITDA as required.

16. Related Policies and Procedures

This Policy shall be read in conjunction with RedCareHMO's related policies and procedures, including Information Security Policy, Data Retention Policy, Cookies Policy, Offsite Storage Policy, Human Resource Security Policy, Physical Facility Access Policy, Laptop Policy, Vulnerability Management Policy, Third Party Risk Management Policy, Data Anonymization and Encryption Policy, Business Continuity Policy, Personal Data Breach Management Policy and Data Protection Impact Assessment Procedure.

17. Changes to the Policy

RedCareHMO reserves the right to change, amend or alter this Policy at any time. If the Policy is amended, RedCareHMO will provide the updated version.

18. Glossary

Consent means any freely given, specific, informed and unambiguous indication of the Data Subject's wishes by which he or she, through a statement or clear affirmative action, signifies agreement to the processing of Personal Data relating to him or her.

Database means a collection of data organized in a manner that allows access, retrieval, deletion and processing of that data, including structured, semi-structured, unstructured, cached and file-system type databases.

Data Processor means a person or organization that processes Personal Data on behalf of and on instructions from RedCareHMO.

DPCO means an organization registered by NITDA to provide data protection audit, compliance and training services to public and private organizations that process Personal Data in Nigeria.

Data Subject means any person who can be identified, directly or indirectly, by reference to an identification number or to one or more factors specific to his or her physical, physiological, mental, economic, cultural or social identity.

NDPA means the Nigerian Data Protection Act, 2023.

Personal Data means any information relating to an identified or identifiable natural person, including identifiers such as name, address, photograph, email address, bank details, social networking posts, medical information, MAC address, IP address, IMEI number, IMSI number, SIM details, Personal Identifiable Information (PII) and other unique identifiers.

Sensitive Personal Data means data relating to religious or other beliefs, sexual orientation, health, race, ethnicity, biometric information, political views, trade union membership, criminal records or any other sensitive personal information.