PRIVACY POLICY

Omokos Diagnostics and Clinical Services Ltd

www.omokosdiagnostics.com.ng

Effective Date:  2026

Last Updated:  2026

Data Controller:  Omokos Diagnostics and Clinical Services Ltd

Address:  Ekehuan Barracks, Benin City, Edo State, Nigeria

Website:  www.omokosdiagnostics.com.ng

Applicable Law:  Nigeria Data Protection Act 2023 (NDPA) | Nigeria Data Protection Regulation 2019 (NDPR)

At Omokos Diagnostics and Clinical Services Ltd (“Omokos”, “we”, “us”, or “our”), we are deeply committed to protecting the privacy and confidentiality of every person who visits our website, uses our services, or entrusts us with their personal and health information.

This Privacy Policy explains who we are, what personal data we collect, why we collect it, how we use it, how we protect it, and what rights you have regarding your data. It applies to all users of the website www.omokosdiagnostics.com.ng (the “Website”) and all patients and clients who access Omokos diagnostic and clinical services.

This Privacy Policy is designed to comply with the Nigeria Data Protection Act 2023 (NDPA), the Nigeria Data Protection Regulation 2019 (NDPR), and applicable healthcare confidentiality obligations under Nigerian law. By using our Website or services, you agree to the terms of this Privacy Policy.

Please read this Policy carefully. If you do not agree with the terms described here, please do not use our Website or services. If you have questions about this Policy, please contact us using the details provided at the end of this document.

1. WHO WE ARE

Omokos Diagnostics and Clinical Services Ltd is a fully incorporated Nigerian healthcare company providing medical laboratory testing, diagnostic imaging, clinical services, and health education to patients, corporate clients, and healthcare providers.

We are the Data Controller for all personal information collected through our Website and in the course of providing our diagnostic and clinical services. As Data Controller, we are responsible for deciding how your personal data is collected, stored, processed, and used.

Our facility is located at Ekehuan Barracks, Benin City, Edo State, Nigeria. We are registered with the Corporate Affairs Commission (CAC) of Nigeria and operate in compliance with the regulatory requirements of the Medical Laboratory Science Council of Nigeria (MLSCN).

2. WHAT PERSONAL DATA WE COLLECT

We collect different types of personal data depending on how you interact with us. The categories of data we may collect include:

2.1 Identity and Contact Information

• Full name
• Date of birth and age
• Gender
• Home address
• Phone number
• Email address
• Next of kin details

2.2 Health and Medical Information

• Medical history and pre-existing conditions
• Presenting complaints and symptoms
• Medications currently being taken
• Laboratory test results and diagnostic reports
• Ultrasound images and scan reports
• Doctor referral information and clinical notes
• Vaccination records where relevant

2.3 Payment and Financial Information

• Bank transfer details and payment references
• HMO membership number and scheme details
• Corporate account information for institutional clients
• Receipt and invoice records

2.4 Website Usage Data

• IP address and approximate location data
• Browser type and version
• Pages visited and time spent on the Website
• Referring website or search terms used to find us
• Device type and operating system
• Cookie identifiers and session data

2.5 Communication Data

• Content of messages or enquiries submitted through our Website contact forms
• Email correspondence with our team
• WhatsApp messages where you contact us through that channel
• Appointment booking requests and confirmations

We collect only the minimum personal data necessary to provide you with our services. We do not collect personal data that is irrelevant or excessive relative to the purpose for which it is needed.

3. HOW WE COLLECT YOUR PERSONAL DATA

We collect your personal data through the following means:

3.1 Directly From You

• When you register or create an account on our Website
• When you book an appointment online, by telephone, or in person
• When you complete patient registration forms at our facility
• When you submit a contact or enquiry form on the Website
• When you subscribe to our health education newsletter or blog updates
• When you provide a biological sample for laboratory testing
• When you communicate with us by email, phone, or WhatsApp

3.2 From Healthcare Professionals

• When a doctor, hospital, or clinic refers you to Omokos for diagnostic testing
• When we receive a laboratory request form completed by your healthcare provider
• When clinical notes are shared with us to assist in result interpretation

3.3 From HMO or Corporate Bodies

• When your employer or health insurer registers you as an enrollee on our panel
• When eligibility or pre-authorisation information is shared by your HMO

3.4 Automatically Through the Website

• Through cookies and tracking technologies when you browse our Website
• Through our website analytics tools that record usage patterns
• Through server logs that automatically record access information

4. WHY WE COLLECT AND USE YOUR PERSONAL DATA

We collect and use your personal data only for legitimate, specific, and clearly defined purposes. These purposes include:

4.1 Providing Diagnostic and Clinical Services

• To process your appointment bookings and manage your schedule
• To collect and analyse biological samples and produce accurate laboratory results
• To prepare and deliver diagnostic reports and ultrasound findings
• To communicate test results to you or your referring doctor
• To manage your patient records and maintain continuity of care

4.2 Patient Safety and Clinical Quality

• To verify your identity before releasing confidential results
• To check for any contraindications or special requirements before conducting tests
• To follow up on critical results that require immediate medical attention
• To conduct quality control and ensure accuracy of our laboratory processes

4.3 Billing and Payment Processing

• To generate invoices and receipts for services rendered
• To process payments through approved payment channels
• To submit claims to HMO providers for covered services
• To manage corporate billing for institutional clients

4.4 Legal and Regulatory Compliance

• To comply with the requirements of the Medical Laboratory Science Council of Nigeria (MLSCN)
• To maintain records as required by Nigerian healthcare law
• To respond to lawful requests from regulatory authorities or courts
• To comply with the Nigeria Data Protection Act 2023 and NDPR 2019

4.5 Service Improvement and Communication

• To respond to your enquiries, complaints, and feedback
• To send appointment reminders and result notifications
• To send health education content and newsletter updates — only where you have consented
• To analyse website usage and improve the functionality and content of our Website

4.6 Research and Public Health

• To contribute anonymised, aggregated data to health research and public health monitoring — only in a form that does not identify any individual

We will never use your personal data for any purpose incompatible with the purposes described above without first obtaining your explicit consent.

5. LEGAL BASIS FOR PROCESSING YOUR DATA

Under the Nigeria Data Protection Act 2023, we must have a valid legal basis for processing your personal data. The legal bases we rely on are:

• Contract Performance — processing necessary to fulfil our service agreement with you, including delivering test results and managing your appointment
• Legal Obligation — processing required to comply with our obligations under Nigerian healthcare and data protection law
• Vital Interests — processing necessary to protect your life or the life of another person in emergency circumstances
• Legitimate Interests — processing for purposes such as fraud prevention, website security, and internal quality management, where these do not override your fundamental rights
• Consent — where you have given us clear, specific consent to process your data for a particular purpose, such as receiving marketing or health education communications

For health and medical data, which is classified as sensitive personal data under Nigerian data protection law, we rely specifically on:

• Your explicit consent to process health data for the purpose of providing diagnostic and clinical services
• The necessity of processing for the provision of healthcare services and management of healthcare systems
• Compliance with our legal and regulatory obligations as a licensed diagnostic facility

6. HOW WE SHARE YOUR PERSONAL DATA

We treat your personal data — especially your health information — with the highest level of confidentiality. We do not sell, rent, or trade your personal data to any third party for commercial purposes. We only share your data in the circumstances described below:

6.1 With Your Referring Healthcare Provider

If you were referred to Omokos by a doctor, hospital, or clinic, we will share your results and reports with that referring provider as part of your care pathway. This is a standard and necessary part of coordinated healthcare delivery.

6.2 With Your HMO or Corporate Health Scheme

If your diagnostic services are covered by a Health Maintenance Organisation or corporate health package, we will share relevant billing information and service confirmations with the relevant body. We share only the minimum information necessary for billing purposes.

6.3 With Your Authorised Representatives

We may share your results or records with a person you have specifically authorised in writing — such as a family member, legal guardian, or personal representative. We will require evidence of authorisation before releasing any information.

6.4 With Regulatory and Law Enforcement Authorities

We may be required by law, court order, or regulatory directive to disclose certain patient information to the Medical Laboratory Science Council of Nigeria, the Nigeria Centre for Disease Control (NCDC), law enforcement agencies, or other public bodies. We will comply with lawful requests while protecting your rights to the fullest extent possible.

6.5 With Service Providers and Technology Partners

We may share data with carefully selected third-party service providers who assist us in operating our business — such as our website hosting provider, payment gateway provider, or laboratory information management system provider. These parties process your data only on our instructions and are bound by confidentiality obligations.

6.6 In Medical Emergencies

If we receive a critical laboratory result that indicates an immediate risk to your life, we may contact your emergency contact or the relevant medical facility even without your prior consent, where this is necessary to protect your vital interests.

We do not share your personal health data with employers, insurance companies seeking to assess your risk profile, or any commercial third party without your explicit written consent.

7. HOW LONG WE KEEP YOUR DATA

We retain your personal data only for as long as is necessary to fulfil the purposes for which it was collected, or as required by applicable Nigerian law. Our retention periods are:

• Patient records and laboratory results — retained for a minimum of 5 years from the date of the last service, in accordance with Nigerian healthcare regulations and good laboratory practice requirements
• Appointment and booking records — retained for 2 years
• Payment and financial records — retained for 7 years in accordance with Nigerian financial record-keeping requirements
• Website usage and analytics data — retained for 12 months
• Email and communication records — retained for 3 years
• Consent records — retained for the duration of the relationship plus 5 years

When the applicable retention period expires, we securely delete or anonymise your personal data so that it can no longer be linked to you as an individual.

You may request deletion of your personal data at any time. However, where we are required by law to retain certain records — such as laboratory results — we cannot fulfil deletion requests for those specific records until the mandatory retention period has expired.

8. HOW WE PROTECT YOUR PERSONAL DATA

The security of your personal and health data is a responsibility we take extremely seriously. We implement appropriate technical and organisational measures to protect your data against unauthorised access, accidental loss, destruction, or disclosure.

8.1 Technical Security Measures

• Secure, encrypted storage of electronic patient records
• Password-protected access to our laboratory information systems
• Secure HTTPS encryption for all data transmitted through our Website
• Regular security assessments of our digital systems
• Secure payment processing through PCI-compliant payment gateways

8.2 Organisational Security Measures

• Access to patient data restricted to authorised staff only — on a need-to-know basis
• Confidentiality obligations included in all staff employment contracts
• Regular staff training on data protection and patient confidentiality
• Clear desk and clear screen policies for staff handling patient records
• Physical security measures at our facility to prevent unauthorised access to paper records

8.3 Data Breach Response

In the unlikely event of a data breach that may affect your rights or privacy, we will notify you and the relevant Nigerian data protection authority within the timeframes required by law. We will take immediate steps to contain the breach, assess its impact, and implement remedial measures.

While we implement strong security measures, no digital system is entirely immune from risk. We encourage you to protect your own login credentials and to notify us immediately if you suspect any unauthorised access to your account.

9. YOUR RIGHTS UNDER NIGERIAN DATA PROTECTION LAW

Under the Nigeria Data Protection Act 2023 and the NDPR 2019, you have the following rights with respect to your personal data:

Right of Access

You have the right to request a copy of the personal data we hold about you. We will respond to your request within 30 days.

Right to Rectification

If any personal data we hold about you is inaccurate or incomplete, you have the right to request that we correct it. Please notify us promptly of any changes to your personal information.

Right to Erasure

You have the right to request that we delete your personal data where it is no longer necessary for the purposes for which it was collected, subject to our legal obligations to retain certain records.

Right to Restriction of Processing

You have the right to request that we limit how we use your data in certain circumstances — for example, while you contest the accuracy of your data.

Right to Data Portability

You have the right to receive a copy of your personal data in a structured, commonly used, and machine-readable format, and to have this data transferred to another service provider where technically feasible.

Right to Object

You have the right to object to the processing of your personal data for direct marketing purposes or where we rely on legitimate interests as our legal basis. We will honour all legitimate objections.

Right to Withdraw Consent

Where we rely on your consent to process your data, you have the right to withdraw that consent at any time. Withdrawal of consent does not affect the lawfulness of processing carried out before the withdrawal.

Right to Lodge a Complaint

If you believe we have violated your data protection rights, you have the right to lodge a complaint with the Nigeria Data Protection Commission (NDPC) — the national supervisory authority for data protection in Nigeria.

To exercise any of these rights, please contact us in writing using the contact details provided at the end of this Privacy Policy. We will respond to all requests within 30 days. We may need to verify your identity before processing your request.

10. COOKIES AND TRACKING TECHNOLOGIES

Our Website uses cookies and similar tracking technologies to enhance your browsing experience, analyse how our Website is used, and personalise content. A cookie is a small text file placed on your device when you visit a website.

10.1 Types of Cookies We Use

Essential Cookies

These cookies are strictly necessary for the Website to function. They enable core features such as security, session management, and login. You cannot opt out of these cookies as they are essential to service delivery.

Analytics Cookies

These cookies help us understand how visitors use our Website — which pages are most visited, how long visitors stay, and where they come from. This data is used in aggregate form to improve our Website. We use tools such as Google Analytics for this purpose.

Preference Cookies

These cookies remember your settings and preferences — such as your preferred language or region — so that you do not have to re-enter them on subsequent visits.

Marketing Cookies

Where you have given consent, marketing cookies may be used to deliver relevant health education content and service information based on your interests. We do not use marketing cookies for commercial advertising.

10.2 Managing Cookies

You can control and manage cookies through your web browser settings. Most browsers allow you to refuse or delete cookies. Please note that disabling certain cookies may affect the functionality of our Website and your ability to access some services.

For detailed guidance on managing cookies in your specific browser, please visit the browser manufacturer’s help pages or www.aboutcookies.org.

10.3 Cookie Consent

When you first visit our Website, you will be shown a cookie consent banner. By continuing to use the Website after accepting cookies, you consent to our use of cookies as described in this Policy. You may withdraw your consent at any time by adjusting your browser settings.

11. CHILDREN’S PRIVACY

We provide diagnostic services to patients of all ages, including children. Where laboratory tests are requested for a child under the age of 18, we require that a parent or legal guardian provides consent on behalf of the child, registers the child’s details, and takes responsibility for the child’s participation in our services.

We do not knowingly collect personal data from children under 18 years of age through our Website without verifiable parental or guardian consent. If we become aware that a child has submitted personal data to our Website without appropriate consent, we will delete that data promptly.

Parents and guardians may request access to, correction of, or deletion of their child’s personal data held by Omokos at any time by contacting us using the details below.

12. LINKS TO THIRD-PARTY WEBSITES

Our Website may contain links to external websites operated by third parties — such as health information resources, government health portals, or partner organisations. These links are provided for your convenience and information.

Omokos does not control the content or privacy practices of third-party websites and accepts no responsibility for them. Visiting third-party websites through links on our Website is entirely at your own risk. We encourage you to read the privacy policies of any external website you visit.

13. INTERNATIONAL DATA TRANSFERS

Omokos Diagnostics and Clinical Services Ltd is a Nigeria-based company and primarily stores and processes your personal data within Nigeria. Where we use third-party service providers whose systems are located outside Nigeria — such as cloud hosting services or international laboratory reference networks — we take steps to ensure that your data remains protected to a standard equivalent to Nigerian data protection requirements.

We will not transfer your personal data to countries that do not provide adequate data protection without your explicit consent, unless required to do so by applicable Nigerian law.

14. OUR SPECIFIC COMMITMENTS ON HEALTH DATA

Health and medical data is among the most sensitive categories of personal information. We make the following specific commitments regarding the handling of your health data:

• We will never use your health data to discriminate against you in any way
• We will never sell or commercially exploit your health data
• We will never share your health data with your employer without your explicit written consent
• We will never share your health data with life insurance or health insurance companies without your explicit written consent, except where required by law
• We will never use your health data for purposes unrelated to healthcare without your explicit consent
• We will store your health data securely and restrict access to authorised clinical and administrative staff only
• We will anonymise health data used for quality improvement or research purposes so that it cannot be traced back to you

Your health data belongs to you. At Omokos, we are privileged to be trusted with it. We treat that trust as a sacred responsibility and will always act in your best interest in how we handle your health information.

15. CHANGES TO THIS PRIVACY POLICY

We may update this Privacy Policy from time to time to reflect changes in our services, applicable Nigerian law, or best practices in data protection. The date of the most recent update will be shown at the top of this document.

Where changes to this Policy are significant, we will notify you by email (if you have provided your email address), or by displaying a prominent notice on our Website. We encourage you to review this Policy periodically to stay informed of how we protect your information.

Your continued use of our Website or services after any changes to this Policy are published constitutes your acceptance of the updated terms.

16. CONTACT US AND DATA PROTECTION QUERIES

If you have any questions, concerns, or requests regarding this Privacy Policy or how we handle your personal data, please contact us:

Omokos Diagnostics and Clinical Services Ltd

Attention:  Data Protection Officer / Management

Address:  Ekehuan Barracks, Benin City, Edo State, Nigeria

Website:  www.omokosdiagnostics.com.ng

Regulatory Authority:  Nigeria Data Protection Commission (NDPC) | www.ndpc.gov.ng

We will respond to all data protection queries and requests within 30 days of receipt.

BY USING OUR WEBSITE OR SERVICES, YOU CONFIRM THAT YOU HAVE READ AND UNDERSTOOD THIS PRIVACY POLICY AND CONSENT TO THE COLLECTION AND USE OF YOUR PERSONAL DATA AS DESCRIBED HEREIN.

Omokos Diagnostics and Clinical Services Ltd

Ekehuan Barracks, Benin City, Edo State, Nigeria

www.omokosdiagnostics.com.ng

Your Health, Our Commitment