This Privacy Policy explains how Olayemi Hospital ("we", "us", the Data Controller) collects, uses, stores, and protects personal information when you use our website and secure portal. We are committed to protecting your data in compliance with the Nigeria Data Protection Act (NDPA) 2023, the EU General Data Protection Regulation (GDPR), and applicable healthcare privacy standards.

Olayemi Hospital & Mental Health Centre
Lagos, Nigeria
Email: info@olayemihospital.com

For data protection queries, contact us at the email above or write "Attn: Data Protection Officer" on your correspondence.

• Account & contact details (name, email, phone) — to provide portal access and communication.
• Clinical information (appointments, prescriptions, medical records) — to deliver healthcare services.
• Billing & financial information (invoices, payments, payment plans) — to process transactions and meet tax/audit obligations.
• Security/audit information (login events, IP address, approximate location, device type) — to protect accounts and prevent misuse. Collected under legitimate interest.
• Preferences (theme, sidebar state) stored locally on your device — to improve usability. No personal data is sent to our servers.
• Optional analytics — only collected if you consent via the cookie banner.

We use essential local storage for portal functionality (e.g., authentication tokens, theme preference). These cannot be disabled as they are necessary for the service to function. Optional analytics cookies are only set if you give explicit consent via the cookie banner.

You can change your preferences at any time using the floating cookie button () shown on every page, or by clicking below:

We use the following third-party services to operate the portal:

• Supabase (database & authentication) — data may be stored on servers in the EU/US. Supabase Privacy Policy.
• Netlify (hosting & serverless functions) — infrastructure located in multiple regions. Netlify Privacy Policy.
• IP geolocation service — used server-side only for security audit logging. IP addresses are not shared with third parties beyond this lookup.

Where data is transferred outside Nigeria, appropriate safeguards (such as standard contractual clauses) are in place as required by the NDPA.

Under the NDPA and GDPR, you have the right to:

• Row-level security (RLS) ensuring users can only access their own data.
• Encrypted connections (HTTPS/TLS) for all data in transit.
• Server-side IP/geo resolution — your IP address is never exposed to third-party scripts in the browser.
• Comprehensive audit trail of all system access and data changes.
• Session timeouts (30-minute inactivity) and role-based access controls.