NDPR Compliance
Last updated: 11 September 2026 — DRAFT — pending legal/DPO review
ClickResult is designed to meet the Nigeria Data Protection Regulation (NDPR) and NDPA principles: lawfulness, purpose limitation, data minimisation, accuracy, storage limitation, integrity & confidentiality, and accountability.
1. Data controller & contact
Data Controller: ClickResult (Nigeria). For privacy enquiries or to exercise rights, use the contact form (topic: Patient support) or email info@clickresultapp.ng. Data Protection Officer (DPO): reachable via the same channel.
2. Categories of personal data
- Clinical data — results, result items, specimen quality, referral test requests (special-category health data, processed for healthcare delivery).
- Contact & account data — names, emails, phone numbers, DOB/gender, laboratory affiliation, credentials (hashed).
- Enquiry data — messages submitted via the contact form (notifications payload).
- Device & usage data — IP address, user agent, audit timestamps, security events.
3. Lawful bases
- Contract — delivery of laboratory and referral services.
- Legitimate interest — platform security, fraud prevention, service improvement (balanced against rights).
- Consent — where explicitly obtained (e.g. marketing, optional analytics).
- Legal obligation — audit and retention duties.
4. Patient rights
Under NDPR/NDPA you have the right to: access, rectification, erasure, restriction, portability, and objection. You may also withdraw consent where processing relies on consent. To exercise any right, contact us via the form above or email. We respond within 30 days. You also have the right to lodge a complaint with the Nigeria Data Protection Commission (NDPC).
5. Retention — live from the database
Retention is enforced automatically. Anonymise = PII fields cleared, audit row retained; Purge = row deleted.
| Data / log | Retention | Action on expiry |
|---|---|---|
| audit_log | 2555 days (7 yrs) | Anonymize |
| notifications | 365 days (1 yrs) | Purge |
| otp_codes | 30 days | Purge |
| password_resets | 90 days | Purge |
| rate_limits | 7 days | Purge |
| result_audit_log | 2555 days (7 yrs) | Anonymize |
| security_events | 730 days (2 yrs) | Purge |
Source: data_retention_policies — enforced by cron/data_retention.php (purge or anonymise per NDPR).
6. Security measures
- TLS in transit; HSTS when deployed over HTTPS.
- Hardened session cookies (HttpOnly, Strict, SameSite=Strict, use_strict_mode).
- CSP, WAF request screening, and rate limiting on login/contact/public APIs.
- Tamper-evident audit chaining (audit_log.hash_chain / prev_hash, SHA-256).
- Role-based access control plus row-level tenant isolation (lab_id); optional TENANT_MODE=isolated for physically separate Enterprise deployments.
7. International transfers
Data is hosted in Nigeria. Where a sub-processor (e.g. SMS gateway, hosting provider) processes data outside Nigeria, transfers occur only with adequate safeguards per NDPR.
8. Contact & complaints
Questions about this statement or to exercise rights: Contact us or info@clickresultapp.ng. You may also complain to the NDPC.