LEGAL
Privacy policy
Effective: 1 November 2026
This Policy explains how Echotrac Ltd (“Echotrac”, “we”) handles personal data under the Nigeria Data Protection Act 2023 and the General Application and Implementation Directive 2025. It applies to our websites, apps, storefronts, and Research OS.
1. Our role
The role we play depends on the data.
| Data | Who decides how it is used | Our role |
|---|---|---|
| Your Echotrac account, billing, Growth Network, waitlist, website use and Research OS use | Echotrac | Controller |
| Patient records, sales, clinical reviews and pharmacy staff records kept in a pharmacy’s account | The pharmacy | Processor, following the pharmacy’s instructions |
| Storefront orders and prescriptions | The pharmacy you order from | Processor for the pharmacy. Controller only for platform security, fraud control, fee records, and legal duties |
If you are a patient or customer of a pharmacy, contact that pharmacy first about its records. We will help it respond, and you may also contact our DPO.
2. What we collect and why
| Who | Data | Purpose | Lawful basis |
|---|---|---|---|
| Website visitors, waitlist | Name, email, phone, device and usage data, cookies | Respond to you, run and secure the site | Legitimate interests; consent for optional cookies and marketing |
| Pharmacy owners and staff | Name, contact details, role, branch, login and activity records, licence number, organisation details | Provide accounts, verify pharmacies, support, security, audit | Contract; legitimate interests; legal obligation |
| Paying customers | Plan, invoices, credits, payment status and references. We do not store full card details | Billing, tax, fraud prevention | Contract; legal obligation |
| Patients at a pharmacy | Name, contact details, allergies, sex, date of birth, weight, height, medicines, purchases, notes | Dispensing, clinical review, record-keeping, on the pharmacy’s instructions | The pharmacy’s basis, usually express consent for health data |
| Storefront customers | Name, phone, address for delivery, order, notes, messages, payment status | Fulfil and track orders, refunds | Contract; legal obligation |
| Storefront customers with prescription items | Prescription photo or file and the health information it shows | Pharmacist checks and legally required records | Express consent; legal obligation |
| Research OS users | Questions, saved papers, uploaded documents, session cookie | Provide research results and your library | Contract; legitimate interests |
Health data is sensitive personal data. We use it only for the purposes above and with appropriate safeguards. Tell the pharmacy or us if you wish to withdraw consent. Withdrawal does not affect earlier lawful use, and some records must still be kept by law.
3. Who can see it
- Your pharmacy. Staff access depends on their role. Prescription photos are visible only to that pharmacy’s pharmacists and owners.
- Echotrac staff. Staff access is role-based, and their actions are logged. Our admin screens do not show patient allergies, weight, clinical notes or clinical reviews, and prescription photos are not shown there.
- Customer–pharmacy messages. Authorised Echotrac staff can view messages between customers and pharmacies to provide support, investigate complaints, keep the platform safe and meet legal duties. Please share health details only as needed for your order.
- Third-party providers. These include providers of hosting, payments, messaging, email, AI processing, security, and support. They act under contract and only for these purposes.
- Payment. When you pay a pharmacy online, your payment is handled by a third-party provider for that pharmacy, under that provider’s terms and privacy notice.
- Authorities and advisers. We share data when required by law or a regulator, including the PCN and NDPC, and with professional advisers, or in a business transfer with equivalent protection.
We do not sell personal data.
4. AI
Echo AI uses third-party providers to process text, including the medicines and patient details sent in a clinical review. Prescription photos are not sent to AI. Our contracts do not allow providers to train their models on identifiable patient data. AI output is advisory, and a person makes the decision. We do not make decisions with legal or similarly significant effects about you solely by automated means. If this changes, we will ask for express consent and allow you to contest the outcome.
5. International transfers
We transfer data only where the law allows: to a destination with adequate protection, under an approved instrument, or on another valid condition such as your informed consent. Contact our DPO for details of the safeguards used.
6. Retention
We keep data only as long as needed, then delete or anonymise it.
| Data | Period |
|---|---|
| Storefront orders and customer identity records | 5 years after the order |
| Prescription photos and files | 5 years with the order |
| Pharmacy records in an active account | As instructed by the pharmacy, for the life of the account |
| Pharmacy records after account closure | Export available for 90 days, then deleted unless the law requires otherwise |
| Invoices, tax and financial records | 6 years |
| Staff action audit logs | 6 years |
| Waitlist entries | Until you ask us to remove them, or 12 months after last contact |
| Research OS questions and library files | Until you delete them. Copies may stay in backups for up to 35 days |
7. Your rights
You may ask to access, correct or delete your data, restrict or object to its use, receive a portable copy, or withdraw consent. You may object to direct marketing at any time. You may also ask for a human to review a solely automated decision. We reply within 30 days and may need to confirm your identity. Some requests can be refused where the law requires us to keep the data. You may complain to the Nigeria Data Protection Commission at any time.
8. Security
We use role-based access, separate staff sign-in, logged staff actions, and encryption in transit and at rest. If a breach is likely to put your rights at risk, we will notify the Commission within 72 hours of becoming aware of it, and tell you promptly if the risk is high.
9. Children
Our accounts are for adults. Pharmacies may record a child’s data only with the express consent of a parent or guardian, or as the law otherwise permits. Tell us if you believe a child has given us data directly, and we will act on it.
10. Marketing
We send marketing only with your consent or where the law allows. Every message includes a way to opt out. Service messages such as order updates are not marketing.
11. Changes
We will post updates here and give notice of material changes. If a new purpose needs your consent, we will ask for it first.