How we use your health information

About this document

This is TarragonHealth's Data Processing Consent — Schedule A of our legal documentation. Version 2026-07-29-v1, published 29 July 2026. This document is currently in draft and pending final review by our legal counsel; some details (marked in brackets) are still being finalised.

Who we are

TarragonHealth ("TarragonHealth", "we", "us") operates a digital health coordination platform for chronic disease management, preventive health, and family care in Nigeria. We are the data controller for the personal data described in this notice.

Registered entity: [Legal Entity Name — to be confirmed]. Data Protection Officer: [to be appointed and confirmed].

If you have questions about this notice or how we handle your data, contact us at privacy@tarragonhealth.ng, or write to our Data Protection Officer at the address above.

What personal data we collect

We collect the information you give us directly and the information generated by using the platform.

• Identity and contact details — name, date of birth, sex, phone number, email, state/city/area.

• Account and family information — your role on the platform, and, if you use a family plan, the profiles of dependants you manage on their behalf.

• Health and clinical information — vitals readings, symptoms, screening and vaccination records, lab and screening results, medications, care plans, mental-health screening answers, device and wearable readings, consultation notes, and messages with your care team.

• Payment information — subscription and order history, and payment references from our payment processors. We do not store your full card number; that is handled directly by Paystack or Stripe.

• Usage information — how you use the app and website, for security, fraud prevention, and service improvement.

Sensitive personal data

Most of what we hold about you — your vitals, symptoms, diagnoses, medications, and results — is health information, which the Nigeria Data Protection Act 2023 classifies as sensitive personal data. We apply extra safeguards to this category of data: it is only visible to your assigned care team and to you, access is logged, and it is protected in the same way whether it was entered by you, by a clinician, or by a connected device.

Why we process your data, and our lawful basis

We rely on more than one lawful basis, depending on the purpose.

• Delivery of healthcare — processing your clinical information to coordinate your care, alert your doctor to an abnormal result, and maintain your longitudinal health record is necessary for the provision of healthcare by a licensed clinician under a duty of confidentiality.

• Your consent — where processing is not necessary for your direct care, for example optional features, marketing communications, or sharing your data with a family sponsor or an employer/HMO wellness programme, we rely on your specific, informed consent, which you may withdraw at any time without affecting the lawfulness of processing carried out before withdrawal.

• Legal obligation — we process certain data, for example payment and tax records, to meet our obligations under Nigerian law.

• Legitimate interest — we process limited technical and usage data for security, fraud prevention, and to keep the platform working reliably, in a way that does not override your rights and interests.

Where your data is stored, and international transfer

Your data is stored in a Postgres database operated by our infrastructure provider, Supabase, in the AWS eu-west-1 region (Ireland). We use this region because our provider does not currently offer a data centre in Nigeria or elsewhere in Africa; eu-west-1 is the nearest available region.

This means your personal data, including sensitive health information, leaves Nigeria as a routine part of how the platform runs, not as an occasional or optional event. Nigerian law requires a specific lawful mechanism before personal data is transferred outside Nigeria, such as a finding that the destination country provides an adequate level of protection, appropriate contractual safeguards, or your specific, informed consent to that transfer.

[The exact mechanism we rely on for this transfer is being finalised with our legal counsel. Until confirmed, this section should be read as a disclosure of the fact of the transfer, not a representation that a specific lawful mechanism has been finalised.]

Some of the services we use to run the platform, our payment processors, communication providers, and the systems that support clinical decision support, may also process limited data outside Nigeria, under their own data processing agreements with us.

Automated processing and risk scoring

We use automated tools, including a rule-based Health Score, risk-assessment logic, and a machine-learning service that estimates things like cardiovascular risk and blood-pressure control, to help prioritise your care and flag results that may need attention. These tools support your care team; they do not make a final clinical decision about your diagnosis, treatment, or care without a licensed doctor reviewing it. Any decision that has a legal or similarly significant effect on you is made, or reviewed and confirmed, by a person, not by an automated system alone. You may ask us for an explanation of an automated assessment shown to you, or ask for it to be reviewed by a person.

Who we share your data with

We share your data only as needed to provide your care and run the platform.

• Your assigned care team — the doctors, care coordinators, and clinical staff involved in your care.

• Partner laboratories, pharmacies, and specialists you choose to book with, limited to what they need to fulfil that specific order or referral.

• Your employer or HMO, where you are enrolled through a corporate or HMO programme, only in aggregated, de-identified form for programme reporting, unless you have separately and specifically consented to direct sharing of your individual results.

• Our payment processors, Paystack and Stripe, to process a payment you have initiated.

• Regulators, courts, or other authorities, where we are legally required to disclose information.

We do not sell your personal data.

How long we keep your data

We keep your data for as long as you have an active account, and for a further period after your account closes to meet our clinical record-keeping and legal obligations.

[A formal retention schedule, with exact periods per data category, is being finalised with counsel. Until then, requests for deletion are handled case by case, applying the most conservative retention period that plausibly applies.]

Your rights

Under Nigerian data protection law, you have the right to:

• Access the personal data we hold about you.

• Ask us to correct inaccurate or incomplete data.

• Ask us to erase your data, subject to our clinical and legal retention obligations.

• Object to, or ask us to restrict, certain processing.

• Receive a copy of your data in a portable format.

• Withdraw consent at any time, where processing is based on consent.

• Lodge a complaint with the Nigeria Data Protection Commission, or with us directly at privacy@tarragonhealth.ng.

Security

We restrict access to your data to the staff who need it for your care, encrypt data in transit and at rest, enforce database-level access controls so that no organisation or account can see another's data, and keep an audit log of access to clinical records. No system is completely secure, and we will tell you, and where the law requires it the Nigeria Data Protection Commission, if we become aware of a breach affecting your personal data.

Family and dependant data

If you add a family member or dependant to your account, including a child, you confirm that you have the legal authority to consent to their information being processed on their behalf, and that you will help them understand how their data is used once they are old enough to do so themselves.

Changes to this notice

We may update this notice as the platform changes. We will show you the current version and ask you to accept it again if a material change affects how your data is used.

Contact and complaints

Email privacy@tarragonhealth.ng with any question, request, or complaint about how we handle your data. You may also complain directly to the Nigeria Data Protection Commission.