Privacy policy

1. Who we are

Biomatrix is a hospital operations platform provided by Biomatrix Technologies Ltd (“Biomatrix”, “we”, “us”), Warri, Delta State, Nigeria. This policy explains how we handle personal data in connection with our website, our platform and our business.

2. Our two roles

We handle personal data in two different capacities, and it matters which one applies.

As a data processor

When a hospital, clinic or healthcare group (a “Customer”) uses Biomatrix, it records information about its patients and staff: appointments, clinical notes, laboratory results, prescriptions, rosters and so on. For that Customer Data, the Customer is the data controller and Biomatrix is a data processor. We process it only to provide the service, under our Data Processing Agreement. If you are a patient or staff member of a Customer, that Customer's own privacy notice governs how your information is used, and they are your first point of contact.

As a data controller

We are the controller for personal data we collect for our own purposes: website visitors, people who contact us or request a walkthrough, account administrators, billing contacts, and users' account and usage information needed to run, secure and improve the service. The rest of this policy mainly describes this processing.

3. What we collect

• Contact and enquiry details — name, work email, phone, organisation, role and anything you tell us in a form or email.
• Account information — name, email, role, branch assignment and authentication details for users of the platform.
• Billing information — billing contacts, invoices and payment records. Card details are handled by our payment provider and not stored by us.
• Usage and device data — log data such as IP address, browser type, pages and features used, timestamps and error reports.
• Cookies — see our Cookie policy.

4. How we use it

• To provide, maintain and support the platform for our Customers.
• To respond to enquiries and arrange demonstrations.
• To secure the service, prevent misuse and investigate incidents.
• To bill Customers and keep financial records.
• To understand how features are used so we can improve them, using aggregated or de-identified data where possible.
• To send service announcements and, where permitted, product updates you can opt out of at any time.
• To comply with legal obligations.

We do not use Customer Data — including any patient information — for marketing, advertising or profiling, and we do not sell personal data.

5. Legal bases

Under the Nigeria Data Protection Act 2023 (“NDPA”) and, where applicable, other data protection laws, we rely on: performance of a contract (to provide the service); legitimate interests (to secure and improve the service and respond to business enquiries, balanced against your rights); legal obligation (for example, tax records); and consent (for optional cookies and marketing, which you can withdraw).

6. Who we share it with

We share personal data only as needed to run the service:

• Sub-processors who host infrastructure, deliver email and messages, process payments or provide support tooling, under written contracts that require them to protect the data.
• Professional advisers such as auditors and lawyers, under confidentiality obligations.
• Authorities where we are legally required to, and only to the extent required. Where lawful, we notify the affected Customer first.
• A successor in the event of a merger or acquisition, subject to this policy.

7. International transfers

We aim to store Customer Data in the region agreed with each Customer. Where personal data is transferred outside Nigeria, we do so only in line with Part VIII of the NDPA — for example, to countries with adequate protection or under appropriate contractual safeguards.

8. How long we keep it

We keep enquiry data for up to 24 months after our last contact. Account and billing data are kept for the life of the contract and then for as long as required by law (generally six years for financial records). Customer Data is retained and deleted as set out in the Data Processing Agreement and the Customer's instructions.

9. Security

We use technical and organisational measures appropriate to health data, including encryption in transit and at rest, role-based access, audit logging and regular backups. More detail is on our Security page. No system is perfectly secure; if a breach affects your data we will notify the affected Customers and, where required, the Nigeria Data Protection Commission.

10. Your rights

Depending on applicable law, you have the right to:

• be informed about and access the personal data we hold about you;
• have inaccurate data corrected;
• have data deleted where there is no continuing reason to keep it;
• restrict or object to certain processing, including direct marketing;
• receive your data in a portable format;
• withdraw consent at any time, without affecting earlier processing;
• complain to the Nigeria Data Protection Commission or your local regulator.

To exercise these rights, email privacy@biomatrix.ng. We respond within the timeframes required by law.

11. If you are a patient

Your hospital controls your medical records in Biomatrix. Requests to access, correct or delete your records should go to the hospital or clinic that treated you. If you contact us, we will pass your request to them and help them respond.

12. Children

Our website and business services are not directed at children. Customers may record information about patients who are minors; that processing is governed by the Customer's instructions and applicable law.

13. Changes to this policy

We may update this policy as the service or the law changes. We will post the new version here with a new “last updated” date and, for significant changes, notify Customer administrators in advance.

14. Contact

Questions about this policy or our data practices: privacy@biomatrix.ng, or write to our Data Protection Officer at Biomatrix Technologies Ltd, Warri, Delta State, Nigeria.