Privacy Notice

1. Who we are

Fitness Global Physiotherapy Clinic (“the Clinic”, “we”) is a physiotherapy practice operating in Nigeria. We are the data controller for the personal information described in this notice, and we process it in line with the Nigeria Data Protection Act 2023 (NDPA).

[LEGAL: registered business name, RC number, clinic address, and Data Protection Officer / privacy contact details.]

2. What we collect

• Identity and contact details — name, date of birth, gender, phone number, email, address, emergency contact.
• Health information — presenting complaint, medical history, medications, allergies, clinical notes, and treatment records created by our physiotherapists.
• Billing information — invoices, payments, and (where applicable) HMO membership details. Card payments are processed by Paystack; we never store your card number.

3. Why we process it (lawful basis)

• To provide physiotherapy assessment, treatment, and continuity of care.
• To manage appointments, reminders, invoicing, and payments.
• To meet our legal and professional record-keeping obligations.
• With your separate opt-in, to send you marketing or wellness content.

[LEGAL: map each purpose to its NDPA lawful basis — consent, contract, legal obligation, or legitimate interest.]

4. Who we share it with

Your information is shared only with the clinic staff involved in your care and the service providers that run our systems (secure database hosting, email delivery, and payment processing), under contracts that protect your data. If you use an HMO, we share the details needed to bill your insurer. We never sell your data.

[LEGAL: list processors and their locations.]

5. How long we keep it

[LEGAL: retention periods for clinical records per regulatory guidance, billing records per tax law, and marketing data until consent withdrawal.]

6. Your rights

Under the NDPA you have the right to:

• access a copy of your personal data;
• correct inaccurate or incomplete data;
• withdraw consent at any time (this does not affect processing already done);
• request deletion where we no longer have a legal duty to keep the record;
• complain to the Nigeria Data Protection Commission (NDPC).

To exercise any of these rights, contact the clinic front desk or the privacy contact below.

7. Security

Records are stored in an encrypted, access-controlled system. Access is limited by staff role, and every change to a patient record is logged with the identity of the staff member who made it.

8. Contact

[LEGAL: privacy contact email + phone; NDPC complaint channel reference.]