How we use your health information

About this document

This is TarragonHealth's Data Processing Consent, Schedule A of our legal documentation. Version 2026-07-31-v1, published 31 July 2026. This document is currently in draft and pending final review by our legal counsel; some details (marked in brackets) are still being finalised.

Who we are

Tarragon Health Ltd (RC 9702108) ("TarragonHealth", "we", "us") operates a digital-first chronic disease, preventive health, and care-coordination platform in Nigeria, connecting patients with doctors, labs, pharmacies, specialists, employers, and HMOs. We are the data controller for the personal data described in this notice.

Data Protection Officer: [DPO name and contact, to be appointed and confirmed]. Nigeria Data Protection Commission (NDPC) registration status: [to be confirmed with counsel].

If you have questions about this notice or how we handle your data, contact us at privacy@tarragonhealth.ng, or write to our Data Protection Officer at the address above.

What personal data we collect

We collect the information you give us directly, the information your care team records about you, and the information generated by using the platform.

• Identity and contact details: name, date of birth, sex, phone number, email, state and local government area of residence.

• Emergency contact: the name and phone number of a next of kin, used to reach someone on your behalf in an emergency, or, with your consent, to let them view (not edit) your record.

• Health and clinical information: vitals readings (blood pressure, glucose, weight, and others); the device you use to take them; symptoms and messages you share with your care team; medications; screening and lab results; vaccination records; and clinical notes written by your doctor.

• Payment and voucher information: service purchase, Care Voucher, and order history, and payment references from Paystack. We do not store your full card number. Where someone buys you a Care Voucher, we record the purchase and the funding relationship between you.

• Device information: where you use a Bluetooth-paired reading device, its make, model, and serial number.

• Usage information: app and website activity, for security, fraud prevention, and service improvement.

Sensitive personal data

Most of what we hold about you (your readings, symptoms, diagnoses, medications, and results) is health information, which the Nigeria Data Protection Act 2023 classifies as sensitive personal data. We apply extra safeguards to this category of data: it is only visible to your care team and to you, access is logged, and every clinical action taken on your record is written to a record you can read yourself.

Why we process your data, and the specific consents we ask for

We rely on more than one lawful basis, depending on the purpose.

• Delivery of your care: processing your readings, symptoms, and clinical information to classify your results, alert your care team, and maintain your record is necessary for the provision of healthcare by a licensed clinician under a duty of confidentiality.

• Specific, scoped consent: for anything beyond your direct care, we ask for a specific consent, tracked individually and revocable at any time:

• Escalation contact: your consent for us to message or call you if we do not hear from you when we should. This is asked at enrolment and is required to activate your account.

• Clinical share: your consent to share your clinical information with a specific named recipient, for example a specialist you are referred to.

• Family/sponsor access: a family member, next of kin, or sponsor funding your care may, with your separate consent, view your record or manage bookings on your behalf. Funding your care never grants this access automatically; it is a separate, two-sided request either of you can initiate and either of you can decline.

• Institution aggregate: if you are enrolled through an employer or HMO programme, your data contributes to that organisation's aggregate statistics in de-identified form regardless of this consent, because the organisation never sees anything about you individually. See "Who we share your data with" below.

• Research, anonymised: your optional consent for your anonymised data to be used in research. This is off by default. If you consent and later withdraw, we stop including you in future research exports, but we cannot recall an export already delivered before you withdrew.

• Legal obligation: we process certain data, for example payment and tax records, to meet our obligations under Nigerian law.

[Counsel to confirm this consent-scope structure is the correct lawful-basis architecture under the Act, and specifically that account activation may properly be conditioned on the "escalation contact" consent.]

Where your data is stored, and international transfer

Your data is stored in a Postgres database operated by our infrastructure provider, Supabase, in the AWS eu-west-1 region (Ireland). We use this region because our provider does not currently offer a data centre in Nigeria or elsewhere in Africa; eu-west-1 is the nearest available region.

This means your personal data, including sensitive health information, leaves Nigeria as a routine part of how the platform runs, not as an occasional or optional event. This is the single highest-priority open item in our own legal review. Nigerian law requires a specific lawful mechanism before personal data is transferred outside Nigeria.

Separately, a summarising step assisting your doctor's own review (see "Automated processing" below) sends a limited, structured extract of your record (never your free-text notes) to a second processor, Anthropic, whose infrastructure is also outside Nigeria.

[The exact mechanism we rely on for each of these two transfers is being finalised with our legal counsel. Until confirmed, this section should be read as a disclosure of the fact of both transfers, not a representation that a specific lawful mechanism has been finalised for either.]

Automated processing

Every reading you log is automatically classified against a clinical protocol appropriate to its type; this always happens, even for a normal reading, so nothing is silently skipped. Separately, an AI model may draft a plain-language summary of your record for your doctor to review before they act on your case; it never diagnoses, never closes a case, never prescribes, and every summary is labelled as AI-drafted and not yet reviewed until a doctor has actually looked at it.

When you tap "Help me understand this" on a reading or risk signal, the same kind of AI tool drafts a short, plain-language explanation in your own language: never a diagnosis, just a way to understand the number in front of you. As with the doctor-facing summary, this explanation is only ever a draft: it does not replace your doctor's own review, and a real doctor always makes the actual decision about your care.

A result classified urgent or emergency can only be closed by your doctor after they have spoken with you directly by phone or a live in-app conversation; it cannot be closed from a written note alone. You may ask us for an explanation of any automated assessment shown to you.

Who we share your data with

We share your data only as needed to provide your care and run the platform.

• Your care team: the doctors and coordinators involved in your care.

• A specific person or organisation you have separately consented to share with. See "Clinical share" and "Family/sponsor access" above.

• Your employer or HMO, where you are enrolled through their programme, only as aggregate statistics with no individual identified; any figure drawn from too few people is withheld rather than shown. We tell every patient plainly: TarragonHealth does not share individual health records with your employer.

• Our payment processor, Paystack, to process a payment you have initiated, and (for a limited, structured extract only) Anthropic, to draft a doctor-facing summary. See "Automated processing" above.

• Regulators, courts, or other authorities, where we are legally required to disclose information.

• Anonymised research exports, only for patients who have separately opted in (see "Research, anonymised" above), built so no individual can be re-identified from the output.

We do not sell your personal data.

How long we keep your data

We keep your data for as long as you have an active enrolment, and for a further period after that to meet our clinical record-keeping and legal obligations.

[A formal retention schedule, with exact periods per data category, is being finalised with counsel. Until then, requests for deletion are handled case by case, applying the most conservative retention period that plausibly applies.]

Your rights

Under Nigerian data protection law, you have the right to:

• Access the personal data we hold about you, and export it yourself at any time; this works from your first login and is never conditional on your subscription or payment being up to date.

• Ask us to correct inaccurate or incomplete data.

• Ask us to erase your data, subject to our clinical and legal retention obligations.

• Object to, or ask us to restrict, certain processing, and withdraw any of the specific consents listed above at any time.

• Lodge a complaint with the Nigeria Data Protection Commission [contact details, to be confirmed], or with us directly at privacy@tarragonhealth.ng.

Deleting your account

You can ask us to delete your TarragonHealth account and the personal data we hold about you at any time. There are three ways to do it:

• In the app: open More, then Privacy & your data, and tap "Request deletion of your data".

• On the web: sign in at app.tarragonhealth.ng, open Privacy & your data, and choose "Request deletion of your data".

• By email: write to privacy@tarragonhealth.ng from the email address on your account. We will confirm it is really you before acting on the request.

What happens next: a member of our team reviews every request. You can see its status on the same Privacy & your data page. Some clinical records must be kept for a minimum period under Nigerian healthcare regulation and the retention rules described above; if that applies to part of your record, we will tell you exactly what can and cannot be deleted before we complete the request. Everything that is not subject to a retention obligation, including your account, sign-in, contact details, paired-device details, and any data synced from a connected device or health app, is deleted when the request is completed. Once completed, the deletion cannot be undone.

Deleting your account never depends on a payment being up to date, and you do not need to give a reason.

Security

We restrict access to your data to the staff who need it for your care, encrypt data in transit and at rest, and keep an immutable log of every access to and change of your clinical record. No system is completely secure, and we will tell you and, where the law requires it, the NDPC, if we become aware of a breach affecting your personal data.

Guardian and dependant data

If you enrol a child under 18 as your dependant, you are their guardian for the purposes of this notice: you confirm you have the legal authority to consent to their information being processed, and you are responsible for the accuracy of what you record on their behalf. Each person, including a minor, has their own individually-structured record; we do not offer a shared or household account.

[Counsel to confirm the Act's threshold for "child" data requiring guardian consent, and that this dependant-enrolment mechanism satisfies it.]

Changes to this notice

We may update this notice as the platform changes. We will show you the current version and ask you to accept it again if a material change affects how your data is used.

Contact and complaints

Email privacy@tarragonhealth.ng with any question, request, or complaint about how we handle your data. You may also complain directly to the Nigeria Data Protection Commission.