At a glance
This notice explains who is responsible for your information, how it is used and how to exercise your rights.
This overview is a reading aid. The full document follows.Who is responsible
Fesera Health Technologies Ltd, Lagos, Nigeria, operates fesera.com and the Fesera application. For accounts, platform security and Fesera-delivered care, Fesera determines the purposes of processing. When your hospital, clinic or independent physiotherapist uses Fesera, that provider normally determines the purposes of your clinical record, and Fesera processes it on their documented instructions. Responsibilities may differ where purposes are jointly determined; your provider should explain its own role and privacy notice.
Contact the Fesera privacy lead through [email protected] with the subject “Privacy request”. You do not need to use a particular form. Please avoid sending your full clinical history in an initial email.
Information we handle
Account and contact details, such as your name, email, telephone number and timezone; care-request details and drafts, including date of birth, location, symptoms, health history, goals and your answers to safety questions; provider connections and care episodes; assessment findings, pain check-ins, prescribed exercises, session completion, outcome measures and clinical notes; messages, deliberately submitted voice notes and appointment details; and payment references and access status where payment features are used.
The public website processes basic request/security information and details you choose to send through contact channels; clinical intake happens in the app. We also process service and security information, such as session identifiers, timestamps, browser information and audit records. Your device may retain recovery drafts, pending activity records and an offline copy of your patient page. Microphone and camera access is requested when you choose a relevant feature. We do not require continuous location tracking.
Purposes and lawful grounds
We use account information to provide the service you request, arrange provider access and support you. We use care information to support assessment, treatment, communication and continuity of care. Security and access logs support protection against misuse, subject to a documented legitimate-interest assessment; applicable record-keeping duties may also require retention.
Health information is sensitive personal data. Its processing needs a lawful basis and an applicable sensitive-data condition, not just agreement to these terms. Your responsible clinician must explain and document the applicable condition, including informed consent or an applicable healthcare condition under Nigerian law. Acknowledging this notice is not blanket consent to marketing, research, AI processing or disclosure to unrelated parties.
Where processing relies on consent, you may withdraw it by contacting us or your provider. Withdrawal does not invalidate earlier lawful processing or require destruction of records that must lawfully be kept. It may affect care that needs the information.
Who can receive information
For a Fesera Care request, authorised Fesera care-team members can review the details and symptoms you submit to assess suitability and arrange the next step, before a treatment episode begins. During treatment, your assigned care team can receive information needed for your care, subject to the access permissions attached to the relevant episode. An independent-provider connection request does not itself grant that provider access to your full clinical record. Authorised platform personnel may access information for a defined support, security or operational purpose.
Application service suppliers include Supabase for database, authentication and storage; Vercel for the patient web app’s hosting; Resend for configured account notification emails; and Daily when you use the video-call feature. These application services are separate from the public website’s hosting and request/security processing. Paystack handles payment information where its payment integration is used. Your provider may use its own approved systems. We may disclose the minimum necessary information when required by law, to respond to a valid regulatory request, or to protect a person in an emergency.
Our policy prohibits selling health records or using identifiable clinical records for advertising. Identifiable research, testimonials and new uses need a separate assessment and appropriate permission; they are not authorised by merely creating an account.
International processing
The primary Supabase project is configured in Ireland (eu-west-1), outside Nigeria. Other suppliers may process information in other countries depending on their service, support and subprocessors. Primary database location does not describe every copy or service involved.
International transfers require an applicable Nigerian transfer mechanism and assessment of safeguards. Do not assume that a supplier’s general security claims, an EU hosting region or accepting this notice establishes adequacy. You can request information about the recipients and safeguards relevant to your data. Supplier agreements and transfer assessments are part of our ongoing compliance review.
Security and its limits
The app uses authenticated accounts, episode-based access checks, database row-level security and clinical audit records. Voice-note objects are in private storage and are accessed through expiring links. These controls reduce risk; no online service can guarantee absolute security.
Protect your device and sign out on shared devices. A copied link, unlocked device or downloaded record may expose information outside the platform’s access controls. We investigate suspected breaches and make notifications required by applicable law. Report suspected exposure to [email protected] without attaching unnecessary clinical data.
Retention and account closure
We retain information for the purpose for which it was collected and any applicable professional, legal or provider obligations. For adult Fesera-delivered care, our default clinical-record review point is seven years after recorded discharge. This is a review point, not automatic deletion or a universal Nigerian statutory period. Your hospital, clinic or independent physiotherapist may require a different documented schedule. Children, safeguarding matters, uncertain age, disputes and legal holds require individual review. Clinical records may remain necessary after care ends or an account closes.
Raw care-message voice notes are due for review 30 days after they are saved. Before an original is removed, an authorised clinician must confirm that any important information has been preserved in a signed care record, or that the audio contains no information needed for that record. Holds and unresolved reviews can extend this period. Approved removal is performed only when the cleanup service is enabled and successful removal is confirmed; the 30-day review date is not a promise of automatic erasure. The clinical message, any signed summary and minimum accountability evidence remain.
We review financial records six years after the relevant financial year ends and closed privacy-request, complaint and incident files after three years, subject to applicable duties and documented exceptions. Enquiries that do not result in a contract are reviewed for removal within six months where applicable. Routine diagnostics have a 90-day retention target, subject to the actual supplier settings; clinical audit records follow the relevant clinical accountability period. Unused accounts are reviewed after two years of inactivity rather than automatically erasing linked care records.
The current ‘Delete account’ function closes sign-in access and removes selected profile details. It preserves clinical records and related identifiers; it is not complete erasure of every record, message, attachment or backup. Existing access tokens may persist until expiry. Contact [email protected] for a separate erasure or restriction request, including information held by your provider. Restricted backup copies may remain until their documented expiry, and recovery must reapply recorded erasures and restrictions. Information already downloaded by you or your provider requires separate handling.
Your rights and complaints
Subject to the applicable conditions and exemptions, you can ask to access or obtain a copy of your data, correct it, erase it, restrict processing, object to relevant processing, withdraw consent and exercise portability rights. You can request review of a decision that significantly affects you and challenge inaccurate care information. Clinical corrections may be recorded as an amendment to preserve the original record.
Send a request to [email protected] with enough information to locate your account and describe what you need. We use proportionate identity checks and will explain any refusal or limits. Our service targets are acknowledgment within two working days and a substantive response within 30 calendar days; an applicable shorter deadline takes priority. You may complain directly to the Nigeria Data Protection Commission at ndpc.gov.ng without first completing our process. See the Privacy requests page for practical steps.
Automation, AI and video
The app uses rule-based signals and progression checks to support care. They do not establish a medical diagnosis or replace clinician judgment. Contact your clinician if a recommendation seems unsuitable or the recorded information is wrong.
The current Fesera service does not include an AI transcription or clinical-assistant feature. Introducing one requires an updated assessment, supplier safeguards and appropriate patient information and permissions before clinical data is sent. Our call integration does not request video recording. Deliberately sent voice notes are separate stored messages.
Children, cookies and updates
The current account and Fesera Care flows are intended for adults aged 18 and over. Do not enter a child’s clinical information unless an approved guardian, consent and provider workflow has been established for that use.
Read the Cookies and device storage notice for information about sign-in cookies, preferences and offline health records. We update the version and date when this notice changes and provide appropriate notice of material changes; additional consent is obtained where required.