MONOVELLA LTD, RC 9872896, 33 Ilupeju Street, Alabata Road, Camp, Abeokuta, Ogun State, Nigeria ("Monovella", "we"). Data protection officer: Abdulazeez Jimoh, [email protected], +2348141284556.
Our Privacy Policy explains what personal data we collect and why. This Data Policy explains how we protect it once we have it: how long we keep it, the security measures around it, where it is processed, and what happens if something goes wrong.
1. How long we keep your data
We keep each category of data only as long as we need it for its purpose or the law requires. When a period ends, we delete or irreversibly de-identify the data and log that it happened. A legal hold or an open dispute pauses deletion of the data it concerns until the hold is lifted.
| Data | Kept until | Then |
|---|---|---|
| Account identifiers (phone, email, hashed password) | 12 months after your account is closed | Deleted |
| Case notes, Care Plans and prescriptions | 6 years after your Care Journey closes | Deleted |
| Images and documents your specialist attaches to a case note, including any shared with you in a Care Plan | As case notes and Care Plans, above | Deleted |
| Lab requests and results | 6 years after the result is released | Deleted |
| The concern you describe, the result of our triage check on it, and any answers to the five quick triage questions | Concern text and triage result: as case notes, above; a concern that never leads to a booking, 12 months after you describe it. Answers to the quick questions: 12 months after you give them (we keep which version of the questions was used) | Deleted |
| Payment, split, refund and recovery records | 6 years | Deleted or de-identified |
| Audit logs of admin and access activity | 24 months | Deleted |
| Alerts and how they were resolved | 24 months | Deleted |
| One-time-code and message delivery logs | 90 days | Deleted |
| A Provider's credentials and licence documents | 24 months after they stop offering services on Monovella, longer if a complaint is open | Deleted |
| A Provider's payout account details | Until any recovery is settled, then as payment records, above | Deleted |
| Consent records | 6 years after withdrawal or account closure | Deleted |
| Support and complaint records | 24 months after closed | Deleted |
| A copy of your data you asked to download | 7 days after it is prepared, or after the request fails | Deleted |
| A specialist's saved Care Plan items (guidance and files they reuse, holding nothing about a patient) | Until the specialist deletes them, or 24 months after they stop offering services on Monovella | Deleted |
| Opted-in Google Analytics event-level exploration data | 2 months | Deleted by Google Analytics under the property retention setting |
We do not record the video or audio of a consultation.
A deletion request may still require us to keep some records — case notes and their attachments, results and payment records in particular can carry a legal retention duty that outlasts a request. Where that applies, we tell you which parts and why, and keep only the minimum needed.
2. Security measures
We protect your data with:
- Encryption in transit and at rest.
- Access control by role, so a person or system only reaches the data their role needs — a laboratory sees only the booking sent to it, a specialist sees only their patients' records, and our admin team sees verification, Alerts and recovery queues, not clinical content beyond what resolving an Alert requires.
- Multi-factor authentication for every admin account.
- Audit logging of clinical-record access and admin actions, separate from each other, so we can show who read what and when.
- Monitoring and alerting for repeated failed sign-ins, unusual or bulk record access, and other signs of compromise.
- A tested ability to revoke sessions, rotate keys and disable an integration if something needs to be shut down quickly.
3. Where your data is processed
Some of your data is processed for us by outside service providers, each under a signed data processing agreement that limits them to our instructions, holds them to confidentiality and security duties at least as strong as our own, and requires them to tell us without undue delay, and within 24 hours, of any breach touching our data.
| Service | What it processes | Location |
|---|---|---|
| TrueHost Cloud | All platform data (the database and private file store), stored on our behalf | Nigeria |
| OpenAI | Only when the AI step of concern triage is switched on: a copy of the concern text with your name, email, phone numbers and other long numbers replaced; never your account, contact details, identifiers, bookings or records | The United States. Storage of the request is switched off, and we switch the step on only once OpenAI has confirmed in writing that it keeps no copy. |
| LiveKit | Video and audio of your consultation | The European Union. We do not enable recording. |
| Paystack | Payment details, amounts, splits and refunds | Nigeria |
| Termii | Your phone number and message text (no health content) | Nigeria |
| Zoho CPaaS (formerly ZeptoMail) | Your email address and message text (no health content) | The United States |
| Google Analytics | Only opted-in approved public page/marketing-link activity; never health, booking, account or form data | Google locations under the data-processing terms recorded before activation |
We keep encrypted backup copies of the database and file store off the server, in storage we control in Nigeria.
We keep an up-to-date record of every processor we use, the data it can reach, and its location, and we review that record whenever a provider's terms change or we add a new one.
4. Sending data outside Nigeria
Where a service in the table above processes data outside Nigeria, we rely on the data processing terms we have signed with it, together with your consent. For a video consultation, that is your consent to the transfer, which you give separately from your consent to our processing your health information. For concern triage, the redacted copy of your concern sent to OpenAI relies on your consent to our processing your health information as our Privacy Policy describes it. We use an adequacy decision or an approved transfer instrument in place of consent wherever the Nigeria Data Protection Commission recognises one for a given country; today, consent is the backstop for transfers where no such instrument yet applies.
We also limit what leaves Nigeria at all: our database, file store and backups stay in Nigeria; only a redacted copy of your concern, with nothing that identifies your account, goes to the triage model; we send no health content by SMS or email; and we do not record consultation calls.
5. If something goes wrong
If a breach is likely to put your rights at risk, we notify the Nigeria Data Protection Commission within 72 hours of becoming aware of it, adding further detail as it becomes known. Where the breach is high-risk to you, we tell you directly and without delay, in plain language: what happened, what data of yours was involved, what we have done about it, and what you should do. We never put health details in that message itself.
You can report a suspected security or privacy issue to [email protected] or to our data protection officer at [email protected], at any time.
6. Your rights
Your rights over the data described in this policy — to access, correct, delete, restrict, object to, or receive a portable copy of your data, and to withdraw consent — are set out in full in our Privacy Policy. Cookies and similar browser storage are covered separately in our Cookie Policy.
7. Changes
We will tell you about a material change to this policy and, where the law requires it, ask for your consent again.