Privacy Policy

Effective date: August 5, 2026

CALM Global Information Technologies ("CALM Global", "we", "us", "our") operates the Ukodomed EMR Ecosystem, a family clinic platform used by physicians, clinic staff, and patients ("you") to manage appointments, clinical records, and related care information. This policy explains what personal and health data we collect, why we collect it, and the rights you have over it under the Nigeria Data Protection Act / NDPR and applicable law.

1. Who we are

CALM Global Information Technologies is the data controller for account and clinic administration data, and acts as a data processor on behalf of the clinic for clinical records entered by physicians. If you have questions about how a specific clinic handles your data, you can also contact that clinic directly.

2. Data we collect

Account data: name, email, phone number, role, and login credentials.
Clinical data: SOAP consultation notes, diagnoses (ICD-11 coded), medications, allergies, lab results, and clinical documents uploaded to your record.
Appointment data: booking times, providers seen, and appointment status.
Family/portal data: relationships between a family head account and the members it manages.
Usage & security data: login timestamps, session activity, audit log entries, and multi-factor authentication status (we do not store your authenticator app or backup codes in plain text).

3. How we use your data

To provide the clinical record, scheduling, and patient portal functionality of the platform.
To support clinical decision-making, such as drug interaction and allergy screening at the point of prescribing.
To maintain an audit trail of who accessed or changed a record, for accountability and security.
To keep your session secure, including detecting suspicious login activity and enforcing multi-factor authentication.
To meet legal, regulatory, and record-keeping obligations applicable to healthcare providers.

We do not sell personal or health data, and we do not use it for advertising.

4. Legal basis for processing (NDPR)

We process clinical data on the basis of the vital and legitimate interest of providing your healthcare, and the clinic's obligation to maintain your medical record. We process account and portal data on the basis of the contract under which the clinic (or, for family accounts, the family head) provides you access to the platform, and to comply with our legal obligations as a data processor under the Nigeria Data Protection Regulation (NDPR) / Nigeria Data Protection Act.

Your care team: physicians and clinic staff involved in your care can view your relevant clinical record.
Family accounts: a family head can view records for the family members linked to their account.
Infrastructure providers: we use cloud hosting and storage providers to run the platform; they process data only on our instructions.
Legal & safety: where required by law, court order, or to protect someone's vital interests.

We do not share your data with third parties for their own marketing purposes.

6. Data retention

Clinical records are retained for as long as required by applicable medical record-keeping regulations and clinic policy, even after an account becomes inactive. Account and audit log data is retained for as long as needed for security and compliance purposes, after which it is deleted or anonymized.

7. How we protect your data

Access to clinical records is role-based and logged in an audit trail. Accounts are protected with multi-factor authentication and backup codes. Data is transmitted over encrypted connections (HTTPS/TLS). We work to keep infrastructure-level encryption at rest in place for data in storage; if any specific safeguard is not yet enabled for a given environment, this policy will be updated once it is.

8. Your rights

Subject to applicable law, including the NDPR, you have the right to:

Request access to a copy of the personal data we hold about you.
Request correction of inaccurate or incomplete data.
Request deletion of your data, where we are not required to keep it for legal or clinical record-keeping reasons.
Object to or request restriction of certain processing.
Withdraw consent, where processing is based on consent.

To exercise any of these rights, contact us using the details in Section 12.

9. Cookies & similar technologies

We use strictly necessary cookies and local storage to keep you signed in and remember your session and theme preference. We do not use third-party advertising or tracking cookies.

10. Children's data

Ukodomed manages family health records, which may include data about minors added by a parent or guardian's family head account. A family head is responsible for the accuracy and appropriateness of data they add for a minor in their care.

11. Changes to this policy

We may update this policy from time to time. Material changes will be reflected by updating the effective date above. Continued use of the platform after a change constitutes acceptance of the updated policy.

12. Contact us

For privacy questions, data subject requests, or to reach our data protection contact, email contact@calmglobal.com.