Privacy policy

Who we are

CorrectMED is a receiving check for medicine deliveries. In this policy, “we” and “us” mean CorrectMED.

We’re the data controller, under the Nigeria Data Protection Act 2023 (the Act), for this website, the pilot form and the accounts people use to sign in. For the receiving data an organisation puts into its workspace, that organisation is the controller and we process it on its behalf, as the Your data section of our terms sets out.

Our privacy contact is Saviour Idu, founder. Email privacy@correctmed.site with any privacy question or request.

The pilot form

When you request a pilot, we collect:

• your name, work email and role;
• your organisation, its type, the number of branches or warehouses and the city;
• anything you write in the message box;
• your agreement that we can use these details to reply, and the time you sent the request;
• a keyed hash of your IP address (never the address itself), to stop repeated or automated requests.

Please don’t include patient information or other sensitive personal data in the message.

When you use the app

To run a workspace, the app keeps:

• your name, email address and how you sign in (Google or email and password);
• the workspaces you belong to, your role in each, and who invited you;
• a record of what you do: the counts you enter, corrections, decisions with their reasons, and exports, each with your name and the time;
• the photos your team uploads and what CorrectMED AI read from them;
• a keyed hash of your IP address when you open a workspace, to limit new workspaces from one network.

Delivery notes can carry names of supplier staff and signatures. Please photograph only the parts needed, and never patient details.

When you visit

Like any website, this one is delivered by servers that keep technical logs: your IP address, browser type, the pages requested and the time. These logs are used to deliver the site, fix problems and keep it secure.

The public pages don’t use advertising or analytics cookies. Signing in sets one cookie that keeps you signed in; the app doesn’t work without it.

Why we use it, and on what basis

The Act requires a lawful basis for each use of personal data. Ours are:

• Running the app for your organisation. The contract with your organisation; for receiving data, your organisation’s instructions as controller.
• Your account and sign in. The terms you accept when you sign up.
• Security and abuse limits (IP hashes and the limits on new workspaces and requests). Our legitimate interest in keeping the service available and secure.
• The record of receiving decisions. Our legitimate interest, and your organisation’s, in a record that shows who decided what and when, and legal obligations to keep records.
• Replying to a pilot request. Your consent, given with the tick box on the form.

We don’t sell personal data, add you to a mailing list or send you marketing emails unless you ask us to.

Who processes it, and where

We use these service providers. Each processes data only on our instructions, under written terms that require them to protect it.

Sign in

Google Cloud, which runs sign in globally, including in the United States.

Records and photos

Google Cloud, stored in its EU multi region (eur3).

Reading photos

CorrectMED AI runs on Google Cloud, through Google's European endpoint.

Hosting

Vercel, with the app's functions in Frankfurt, Germany, and request logs kept globally.

Email

Namecheap hosts our mailboxes and sends our emails; its mail servers may be outside Nigeria.

Transfers outside Nigeria

Most of these providers process data outside Nigeria. We transfer personal data only as sections 41 to 43 of the Act allow, relying on contractual clauses with each provider that require the same level of protection the Act gives.

How long we keep it

• Pilot requests are deleted within 12 months of our last contact if no pilot follows. If one does, they become part of that pilot’s records.
• Sandbox data: photos 30 days; receipts 90 days after their last activity. The audit log entries about them (who counted, corrected or decided, and when) are kept 6 years, like other records.
• Other workspace data: photos 12 months; receiving records, including the names on them, 6 years or until the organisation asks us to delete them.
• Your account is kept while you belong to a workspace. Your name stays on the records you took part in for as long as those records are kept.
• IP hashes used for limits are deleted after 2 days; the one stored with a pilot request is cleared after 24 hours.
• Technical logs are kept only as long as our hosting provider needs them for security and troubleshooting.

How we protect it

Data is encrypted in transit and at rest. Each workspace sees only its own records, every change is logged, and access on our side is limited to the people who run the service.

Your rights

Under the Act you can:

• ask what personal data we hold about you and get a copy of it;
• ask us to correct it, or to delete it;
• ask us to restrict how we use it, or object to a use based on our legitimate interests;
• ask for your data in a portable format;
• withdraw your consent at any time, without affecting what we did with it before;
• complain to the Nigeria Data Protection Commission.

Email privacy@correctmed.site to use any of these rights. We answer within 30 days, and may ask you to confirm your identity first. If the data belongs to an organisation's workspace, we pass the request to that organisation and help it answer.

Registration assessment

We assess whether CorrectMED must register with the Nigeria Data Protection Commission as a data controller or processor of major importance under section 44 of the Act. We keep that assessment on record and review it every 3 months, and at once if the data we process changes in kind.

Changes to this policy

We update this page when our practices change. If a change is significant and we hold your details, we tell you by email before it applies. See also our terms of use.