Privacy Policy
This is health information. What you tell us about your body, your pain and your medical history is sensitive personal data under the Nigeria Data Protection Act 2023, and it is held as a confidential clinical record. It is treated that way throughout this policy.
Who holds your information
Fesera is a solo physiotherapy practice operating in Lagos, Nigeria. The data controller is the practice, and in practice that means your treating physiotherapist, Alao Daniel, who is the only person with routine access to your clinical record.
For any privacy question, request or complaint, write to [email protected].
1. What we collect
1.1 Before you book
The questions on this site collect your name, WhatsApp number, the area of Lagos you are in, which problem you are contacting us about, your answers to safety screening questions, and optionally your email address. This is enough to tell you whether it is safe to proceed and whether we can reach you.
1.2 During assessment and treatment
This is the most sensitive category we hold. It forms your clinical record:
- Your history: how the problem started, what makes it better or worse, previous treatment
- Relevant medical history, current medications, and known conditions
- Examination findings, including movement, strength and specific clinical tests
- Blood pressure and cardiovascular screening answers
- Outcome measure scores recorded at the start and at review points
- The activities you have told us you want to get back to
- Your exercise programme, and how much of it you have been completing
- Notes made at each visit
- Photographs or video, only where you have separately consented
1.3 Practical information
Your address and directions, so visits can happen, and details of anyone you have asked us to involve in your care, such as a spouse or an adult child.
1.4 Payment
We do not see or store your card number, CVV, expiry date or bank details. Where you pay through a payment provider, they handle the card data under their own security obligations. We keep a record that payment was made, for how much, and when.
2. Why we are allowed to hold it
Under the Nigeria Data Protection Act 2023, and the GDPR where it applies to you, we rely on the following:
| Purpose | Basis |
|---|---|
| Screening you safely before booking | Your consent, and our duty not to cause harm |
| Assessing and treating you | Provision of healthcare by a regulated health professional bound by a duty of confidentiality |
| Keeping a clinical record | Legal and professional obligation |
| Arranging visits and communicating with you | Performance of our agreement with you |
| Taking payment and keeping accounts | Performance of our agreement, and legal obligation |
| Writing to your doctor | Your explicit consent, asked for each time |
| Photographs and video | Your explicit, separate, withdrawable consent |
| Using your data in anonymised form to review our own results | Legitimate interest, once you can no longer be identified from it |
Where we rely on consent you can withdraw it at any time. Withdrawing consent does not make earlier processing unlawful, and it will never affect the standard of care you receive.
3. WhatsApp, and what it means for your privacy
Most conversation with the practice happens on WhatsApp, because that is what works in Lagos. You should understand what that involves before you send us health information there.
- WhatsApp is operated by Meta, not by us. Message content is end-to-end encrypted, so Meta cannot read it, but Meta does handle metadata such as your phone number and when messages are sent.
- Messages sit on your phone and on ours. If you back up WhatsApp to iCloud or Google Drive, your messages to us are included in that backup, under those companies' terms rather than ours.
- Anyone with access to your unlocked phone can read our conversation. Please think about that before sending sensitive detail.
- We keep clinically important information in your clinical record, not in the chat thread. Chat history is periodically cleared.
- You are never obliged to use WhatsApp. Email, phone or discussing things in person at your visit are all fine, and we will use whichever you prefer.
4. Where your information is kept
Some records are on paper, particularly assessment forms and your exercise diary. Paper records are stored securely and are not left in vehicles or in your home.
Digital records are held in an encrypted cloud database with access controls, using Supabase as the infrastructure provider. Information is encrypted in transit and at rest. Where a provider stores data outside Nigeria, we rely on the safeguards for international transfers required by the NDPA.
Our website is a static site and does not use tracking cookies, advertising pixels or third-party analytics. We do not track you across other websites.
5. Who else sees it
As a solo practice, the answer is normally nobody. Your treating physiotherapist is the only person with routine access to your record.
Your information is shared beyond that only in these situations:
- With your doctor or another clinician, when we refer you or write to them about your care, and only with your consent, which we ask for each time.
- With family or a carer you have named, and only to the extent you have agreed. Someone paying for your care does not by itself give them a right to see your record.
- With infrastructure providers who store data on our behalf under contract, and who may not use it for their own purposes.
- Where the law requires it,or where there is a serious and immediate risk to your life or someone else's.
What we will never do
Your health information will never be sold, licensed, rented, or shared for advertising. It will not be given to insurers, employers, banks or lenders. We do not use it to build advertising profiles, and we do not share it with data brokers.
6. How long we keep it
| Record | Kept for |
|---|---|
| Clinical records for adults | At least 7 years from your last visit, in line with professional record-keeping standards |
| Enquiries that never became a booking | 12 months, then deleted |
| Payment and accounting records | 7 years, as required by tax and accounting law |
| Photographs and video | Deleted as soon as you withdraw consent, or with your clinical record, whichever is sooner |
| WhatsApp conversation history | Cleared periodically once anything clinically relevant is in your record |
Clinical records are kept longer than most other information because we may need to account for the care we gave, and because your own history is often useful years later. This means a request to erase your clinical record may be refused while that obligation lasts. If that happens we will tell you why, and we will still restrict what the record is used for.
7. Your rights
You have the right to:
- See your record and get a copy of it
- Have mistakes corrected. Where we disagree with your view of a clinical finding, your comment is added to the record rather than replacing what was written
- Ask for deletion, subject to the record-keeping obligations above
- Withdraw consent at any time, including for photographs, video, or writing to your doctor
- Object to a particular use of your information
- Receive your data in a portable format
- Complain to the Nigeria Data Protection Commission
To exercise any of these, write to [email protected]. We respond within 30 days and there is no charge.
If you are in the UK or the European Union, you also have rights under the UK GDPR or GDPR, including the right to complain to your local supervisory authority.
8. If something goes wrong
If your personal data is lost or improperly accessed and this is likely to put your rights at risk, we will report it to the Nigeria Data Protection Commission within 72 hours of becoming aware of it, and tell you directly without undue delay, explaining what happened and what we are doing about it.
9. Children
We do not treat anyone under 18, and we do not knowingly collect information about children. If you believe a child's information has reached us, contact us and we will delete it.
10. Future digital tools
Fesera plans to introduce an application to support your home exercise programme between visits. It does not exist yet, and no part of this policy currently describes a live app.
When it is introduced it will handle personal data, including accounts and authentication, records of the exercises you complete, and your progress over time. This policy will be updated before it becomes available and you will be told what has changed. Using it will be optional. Declining it will not affect your care or your price.
11. Changes to this policy
If this policy changes materially, the date at the top is updated and current clients are told directly rather than being left to notice. Past versions are available on request.