Privacy requests and complaints

1. Make a request

Email [email protected] with the subject “Privacy request”. Describe the right you want to exercise and provide the email associated with your account. You can also request help through your treating provider. Do not attach your full medical history, government identification or passwords unless a proportionate verification step is specifically explained.

You may request access, correction, erasure, restriction, objection, portability where applicable, consent withdrawal or review of significant automated decisions. You do not need to quote legislation or use a form. An authorised representative can help; we may need to confirm their authority.

2. What happens next

Our service target is to acknowledge within two working days and provide a substantive response within 30 calendar days, subject to any applicable shorter deadline. We will explain identity checks, provider coordination, any lawful limits and how to challenge a decision. A formal grievance notice with an earlier applicable deadline takes priority.

For provider-controlled clinical records, Fesera may need to refer the decision to that provider while helping locate relevant data. Corrections to signed records may be made by an addendum rather than overwriting the original. Account closure is different from erasing all clinical records, attachments and backup copies.

3. Escalation

If you are dissatisfied or prefer to complain directly, contact the Nigeria Data Protection Commission through ndpc.gov.ng. You may use its standard grievance notice where appropriate, but it is not a prerequisite to a complaint or legal action. Clinical-conduct concerns should go to the responsible provider and relevant professional regulator.

4. Report a security incident

For suspected unauthorised access or disclosure, contact [email protected] immediately with the approximate time and affected feature. Do not investigate by opening another person’s records or publish their information. Our incident procedure separates containment, evidence collection and regulatory notification.