Introduction

Welcome to the African Medical Centre of Excellence (AMCE) website. In partnership with King’s College Hospital, London, AMCE is dedicated to safeguarding personal and sensitive health information in accordance with national and international data protection standards. We ensure that your data is collected, processed, stored, and disclosed in a secure and lawful manner that respects your privacy and maintains data integrity and availability.

Regulatory Framework

Our data protection practices are adapted from regulations that govern privacy both locally in Nigeria and internationally. We strictly comply with the requirements of the Nigeria Data Protection Act (NDPA) under the oversight of the Nigeria Data Protection Commission (NDPC).

The Principles We Follow

Whenever we handle your information, we adhere to core data protection principles:

• Lawfulness, Fairness, and Transparency: Data is processed lawfully, fairly, and transparently.
• Purpose Limitation: Data is collected only for specified, explicit, and legitimate purposes.
• Data Minimization: We only collect data that is adequate, relevant, and limited to what is necessary.
• Accuracy: We take reasonable steps to keep data accurate and up to date.
• Storage Limitation: Data is retained only as long as necessary for its intended purpose.
• Integrity and Confidentiality: We use robust technical and organizational security measures to prevent unauthorized processing, accidental loss, destruction, or damage.

Information We Collect and How We Use It

AMCE collects and processes different categories of personal data depending on your relationship with us:

• Patients: To support clinical care, patient safety, convenience, treatment, and quality of service, we process names, age, sex, dates of birth, emails, and sensitive health-related metrics (such as weight, height, blood group, and medical history).
• Website Visitors & Enquirers: General contact details and information provided through web forms or complaints to follow up on concerns.
• Job Applicants & Contractors: Names, contact information, CVs, education, career histories, and background check data to manage recruitment and professional relationships.
• Business Partners & Suppliers: Contact details, integrity due diligence logs, and operational data to administer vendor, contractor, or joint-venture relationships.

Legal Basis for Processing

We will only process your personal data under authorized legal bases, including:

1. Your explicit Consent.
2. The performance or preparation of a Contract with you.
3. Compliance with our Legal Obligations.
4. To protect your Vital Interests or those of another natural person.
5. For our Legitimate Interests, provided they do not override your fundamental rights and freedoms.

Note on Sensitive Data: Special categories of data (such as medical records or biometrics) are handled with heightened protections and processed primarily for medical diagnosis, health care provision, or under explicit written consent.

Data Security

We implement strict technical controls, including encryption, multi-factor authentication,  access control, firewalls, network segmentation, and endpoint protection, to ensure the security of personal data. Access to personal data is restricted based on the principle of least privilege, ensuring only authorized staff who require information to fulfill their duties can view it.

International Data Transfers

If your data needs to be transferred outside of Nigeria, AMCE ensures a legal basis exists. In alignment with the NDPA, cross-border transfers are permitted only if the recipient country maintains an adequate level of data protection through applicable laws, binding corporate rules, or standard contractual clauses. In the absence of an adequacy status, we will obtain your explicit, informed consent prior to the transfer.

Data Retention

AMCE will not keep personal data in an identifiable format for longer than is necessary to achieve the purposes for which it was originally collected. Data may be held for longer periods strictly when required by statutory obligations, public interests, or historical/scientific research purposes.

Your Data Subject Rights

Under the NDPA, you hold the following rights regarding your personal information:

• Right of Access: Request confirmation of processing and a copy of your personal data.
• Right of Rectification: Request correction of incomplete, inaccurate, or outdated data.
• Right to Erasure (“Right to be Forgotten”): Request permanent deletion of your data when it is no longer required, subject to legal retention exceptions.
• Right to Restrict Processing: Request that we temporarily suspend processing your data.
• Right to Data Portability: Request a structured, machine-readable copy of your data to transfer to another entity.
• Right to Object: Object to processing based on legitimate interests or direct marketing.
• Right to Withdraw Consent: Cancel your consent at any time where processing relies on it.

How to Exercise Your Rights: Requests must be submitted via our online Privacy Portal or in writing directly to our Data Protection Officer (DPO). To safeguard security, you will be required to show proof of identity. We will acknowledge your request within five (5) business days and provide a substantive response within thirty (30) calendar days.

Children’s Privacy

Where AMCE provides online services to children under the age of 16, explicit parental or custodial authorization must be obtained.

Complaints and Contact Information

If you have questions, queries, or believe your privacy rights have been violated, we encourage you to contact us first so we can address your concerns. You can file a formal grievance using our Patient Voices under Contact or

• Contact Person: Data Protection Officer (DPO)
• Email: info@amce.net

To exercise any of these rights, please contact us at info@amce.net.

Data Retention
We retain your personal data only as long as necessary to fulfill the purposes outlined in this policy or to comply with legal obligations. You may request deletion of your data, subject to any legal requirements we must meet.

Policy Updates
We may update this Privacy Policy from time to time. Any changes will be posted on this page, and where appropriate, notified to you via email.

Contact
If you have any questions, concerns, or complaints regarding this Privacy Policy or our data practices, please contact us at info@amce.net