MARCELLE RUTH CANCER CENTRE LIMITED
PRIVACY POLICY
Marcelle Ruth Cancer Centre Limited (“MRCC’’ or the “Centre”) respects your privacy and takes responsibilities with regard to the management of personal data very seriously. We do not take lightly the trust you have in us, in providing us with your Personal Data. This Data Privacy Policy (the “Policy”) describes how MRCC processes your Personal Data and is a guide to help you understand:
- The Information We Collect.
- How We Collect Personal Data.
- How We Use Your Information.
- Consent and Access Rights.
- Personal Data Protection Principles.
- User Responsibility.
- Data Security.
- Link to Third Party Websites.
- Third Party Access.
- Data Subject Access Request.
- Violation of Privacy.
- Data Retention.
- How to Contact Us.
MRCC reserves the right to make changes to this Policy at any time and for any reason. You will immediately be notified about any changes and all changes will be effective immediately unless otherwise specified. MRCC’s obligations and the exercise of such obligations pursuant to this Policy shall be subject to its obligations under Nigerian Data Act 2023.
You consent to this policy by your continued use of website and our services, and your supply of your personal data to us.
1. The Information We Collect
We collect the following information: name, date of birth, residential and contact address, telephone number, email address, marital status, nationality, gender, tax identity number, credit and/or debit card information, which includes card number, card expiry date and bank details, information on family members, medical information, race or ethnic origin, genetic data, biometric data, an identity number, location, photograph, IP address and other relevant information which constitute Personal Data.
2. How We Collect and Use Your Personal Data
2.1 We collect personal data that you voluntarily provide to us and any other individual whose details you provide us through the following methods:
a) Using forms provided to you physically at the hospital or via email;
b) when you contact us and express an interest in obtaining information about us or our products and services; or
c) based on the context of your interactions with us and the Platform
2.2 When you send an email to MRCC or use any other form of communication, we may retain the information from such communication in order to process your inquiries, respond to your requests and improve our services. When you access MRCC’s services, our servers automatically record information that your browser sends whenever you visit a website.
2.3 We will collect personal data from you when you express an interest in learning more about us or our Services, subscribe to marketing, or otherwise contact us. You can unsubscribe from our marketing emails at any time.
3. How We Use Your Information
3.1 In Order to achieve MRCC’s goals, we combine data we collect from different contexts or obtain from third parties in order to provide you with a more seamless, consistent, and personalized experience, and for other legitimate purposes in accordance with our legal obligations and/or your consent. We use the information we collect or receive;
a) To facilitate the provision of our services: The information you provide to us are necessary and will be used to provide our services including conducting medical investigations, making medical diagnosis, recommendations etc.
b)To request feedback: We may use your information to contact you about your use of our website and solicit feedback from you.
c) To Send administrative information to you: We may use your information to send you information about our services, and features, as well as changes to our terms, conditions, and policies.
d) To protect our website: We may use your information to help us keep our website safe and secure (for example, for fraud monitoring and prevention).
e) To enforce our terms, conditions, and policies in the course of business to comply with legal and regulatory requirements.
f) To respond to legal requests: We may need to inspect the data we hold to determine how to respond if we receive a subpoena or other legal request.
g) To respond to user inquiries and provide user support: We may use your information to respond to your inquiries and resolve any issues you may have with our services.
4. Consent and Access Rights
4.1 We require your consent for the processing of your personal data and where the service or processing of your data deals with different matters, we shall obtain your consent in a manner which clearly distinguishes it from the other matters in this Policy.
4.2 Notwithstanding paragraph 4.1 above, we can process your personal data in the absence of consent where:
a) Processing is necessary for the performance of a contract to which you are a party or in order to take steps at your request prior to entering into a contract;
b) Processing is necessary for compliance with a legal obligation to which we are subject;
c) Processing is necessary in order to protect your vital interests or that of another natural person; and
d) Processing is necessary for the performance of a task carried out in the public interest or in the exercise of official public mandate vested in us.
4.3 In the event of any arrangement whereby MRCC sells or transfers all, or a portion of its business or assets (including in the event of a reorganization, dissolution or liquidation) to third parties, you hereby consent that your personal data held by MRCC can be transferred or assigned to third parties who may become the controllers and/or processors of your personal data that was held by MRCC prior to such arrangement. MRCC shall at all times ensure that you are notified when your personal data is intended to be transferred to third parties in the circumstances outlined in this clause. MRCC will provide the third party with its Policy and will not be responsible for the failure of the third party to honor the commitments made in this Policy.
4.4 No consent shall be sought, given or accepted in any circumstance that may engender direct or indirect propagation of atrocities, hate, child rights violation, criminal acts and anti-social conducts.
4.5 You may withdraw your consent at any time and may request access to your personal information in our possession. Where MRCC has reasonable doubts concerning the identity of the person making the request, MRCC may request for information necessary to confirm the identity of the person making the request.
4.6 You reserve the right to request the deletion or modification/amendment or deletion of your personal data in our possession. We will erase personal data without delay if:
a) the personal data is no longer necessary for the purposes for which it was collected or processed, or
b) we have no other lawful basis to retain your personal data
4.7 In all cases of access deletion or modification/amendment of personal data, we shall request sufficient identification to enable us to confirm that you are the owner of the personal data sought to be accessed or modified/amended. Upon modification/amendment of personal data, MRCC shall notify the data subject of such completion of the modification/amendment. MRCC shall however not delete your personal data due to legal or operational requirements as specified by the NDPA
5. Personal Data Protection Principles
5.1 When we process your personal data, we are guided by the following principles, which require personal data to be:
a) processed lawfully, fairly, in a transparent manner and with respect for the dignity of the human person;
b) collected only for specified, explicit and legitimate purposes and not further processed in a manner incompatible with those purposes;
c) adequate, relevant and limited to what is necessary in relation to the purposes for which it is processed;
d) accurate and where necessary kept up to date;
e) removed or not kept in a form which permits identification of data subject for longer than is necessary for the purposes for which the personal data is processed;
f) Processed in a manner that ensures its security, using appropriate technical and organisational measures to protect against unauthorised or unlawful Processing and against accidental loss, destruction or damage.
6. User Responsibility
You are required to familiarise yourself with this Policy. Please also ensure that the information you provide to us is complete, accurate and up to date.
7. Data Security
7.1 MRCC implements and maintains appropriate safeguards to protect personal data, taking into account in particular the risks to you, presented by unauthorised or unlawful processing or accidental loss, destruction of, or damage to your personal data.
7.2 Safeguarding will include the use of encryption where appropriate. It also includes protecting the confidentiality (i.e. that only those who need to know and are authorised to use personal data have access to it), integrity and availability of the personal data. We regularly evaluate and test the effectiveness of those safeguards to ensure the security of our processing of personal data.
7.3 You should be aware, however, that no method of transmission over the Internet or method of electronic storage is completely secure. While we strive to protect the security of your information and are constantly reviewing and enhancing our information security measures, we cannot guarantee absolute security. MRCC, therefore, accepts no liability for any damage or loss, however caused, in connection with transmission over the Internet or electronic storage.
8. Links to Third Party Websites
8.1 The MRCC website may contain links to other websites owned and operated by third parties. These links are provided for your information and convenience only and are not an endorsement by MRCC of the content of such linked websites or third parties. The information that we collect from you will become available to these websites if you click the link to the websites. These linked websites are neither under our control nor our responsibility.
8.2 MRCC, therefore, makes no warranties or representations, express or implied about the safety of such linked websites, the third parties they are owned and operated by, and the suitability or quality of information contained on them.
8.3 This Policy does not apply to these websites and we cannot guarantee the safety and privacy of your information, thus, if you decide to access these linked third-party websites and/or make use of the information contained on them, you do so entirely at your own risk. MRCC accepts no liability for any damage or loss, however caused, in connection with accessing, the use of or reliance on any information, material, products or services contained on or accessed through any such linked website. We advise that you contact those websites directly for information on their privacy policy, security, data collection and distribution policies.
9. Third Party Access
9.1 The personal data that we collect about you is critical to our activities. We respect and value this data and do not want to jeopardize the flow of the information. Therefore, we are not in the business of selling this information to other websites or businesses. There are very limited circumstances where we do share some of your information to our service providers, some of which are listed below.
- Laboratory and Health Plan Partners;
- Relevant Tax Authorities;
- Medical Waste Disposal Partners;
- Software and Cloud Computing Services;
- Finance & Accounting Organisations;
- Payment Processors;
- Sales & Marketing Tools and Platforms;
- Data Analytics and Performance Monitoring Organisations;
- Logistics Companies;
- User Account Registration & Authentication Services; or
- Our Insurance Partners.
9.2 MRCC only shares personal information with above entities in the following circumstances:
a) We have your consent;
b) We provide such information to other professional advisers or other trusted businesses or persons for the purpose of processing personal information on our behalf. We require that these parties agree to process such information based on our instructions and in compliance with this Policy and any other appropriate confidentiality and security measures;
c) We believe belief that access, use, preservation or disclosure of such information is reasonably necessary to (i) satisfy any applicable law, regulation, legal process or enforceable governmental request, (ii) enforce applicable terms of service, including investigation of potential violations thereof, (iii) detect, prevent, or otherwise address fraud, security or technical issues, or
d) protect against imminent harm to the rights, property or safety of MRCC, its users or the public as required or permitted by law.
10. Data Subject Access Request
10.1 We shall take appropriate measures to provide any information relating to processing to you in concise, transparent, intelligible and easily accessible form, using clear and plain language, for any information addressed specifically to a child
10.2 The information may be provided orally or in writing, or by other means, including where appropriate, by electronic means. Where we have reasonable doubt concerning the identity of the person making the request for information, we may request the provision of additional information necessary to confirm the identity of the Data Subject.
10.3 Requests (including for Data Subject access) will be complied with, usually within 30 days of receipt. To submit a Data subject request, please contact patientservices@marcelleruth.com;
10.4 Information provided to you and any communication, and any action taken shall be provided free of charge. Where in MRCC’s reasonable opinion, your request is manifestly unfounded or excessive, in particular because of their repetitive character, we may either:
a) charge a reasonable fee taking into account the administrative costs of providing the information or communicating or taking the action requested; or
b) write a letter to you stating refusal to act on the request and copy NDPC on every such occasion.
11. Violation of Privacy
11.1 We have put in place procedures to deal with any suspected personal data breach and may notify you of any significant breach to your personal data and let you know the steps we have taken to remedy the breach.
11.2 All suspected breach of personal data will be remedied with 1 (one) month from the date of the report of the breach.
11.3 If you know or suspect that a personal data breach has occurred, you should immediately contact MRCC at patientservices@marcelleruth.com
11.4 MRCC will not be responsible for any personal data breach which occurs as a result of:
a) an event which is beyond the control of MRCC including but not limited to government action;
b) an act or threats of terrorism;
c) an Act of God (such as, but not limited to fires, explosions, earthquakes, drought, tidal waves and floods) which compromises MRCC’s data protection measures;
d) war, hostilities (whether war be declared or not), invasion, act of foreign enemies, mobilisation, requisition, or embargo;
e) rebellion, revolution, insurrection, or military or usurped power, or civil war which compromises MRCC’s data protection measures;
f) the transfer of your personal data to a third party on your instructions; and
g) the use of your personal data by a third party designated by you.
12. Data Retention
We will retain your information for as long as necessary to fulfil the purposes for which they were supplied to us and to comply with legal and regulatory requirements. the retention periods for different categories of data may vary based on factors such as the amount, nature, and sensitivity of the personal data provided to us. Unless a longer retention time is required or permitted by law, we will only keep your personal data for as long as it is necessary.
If we no longer have a legitimate business reason to process your personal data we will either delete, or if that is not possible (for example, because your personal data is stored in backup archives), we will securely store it and isolate it from further processing until deletion is possible
13. How to Contact Us
For any enquiries you have in relation to this Privacy Policy, please feel free to contact us at patientservices@marcelleruth.com