Loading data...
Please wait while we prepare your experience
Clear, legally binding protocols governing how medical supply-chain credentials, cold-chain telemetry, and institutional procurement records are safeguarded.
Require an enterprise Data Processing Addendum (DPA) for your hospital board or health maintenance organization (HMO)?
This Privacy and Data Protection Policy governs the collection, processing, storage, and cross-party verification of institutional data across the MedSupply Healthcare B2B Infrastructure, operating in full compliance with the Nigeria Data Protection Act (NDPA 2023), the Nigeria Data Protection Regulation (NDPR 2019), the Pharmacy Council of Nigeria (PCN) Act, and the National Agency for Food and Drug Administration and Control (NAFDAC) Good Distribution Practices (GDP).
MedSupply operates exclusively as an enterprise business-to-business (B2B) digital pharmaceutical marketplace connecting licensed healthcare institutions (including Tertiary Teaching Hospitals, Specialist Medical Centers, Clinical Laboratories, and Community Pharmacies) with accredited pharmaceutical manufacturers, importers, and bulk distributors.
MedSupply does not solicit, capture, or market to individual retail patients or consumers. Individual patient-identifiable medical charts are never ingested into the MedSupply central procurement directory.
To uphold supply-chain integrity, prevent counterfeit drug proliferation, and fulfill anti-diversion statutory mandates, MedSupply collects and verifies the following categories of organizational information:
Official institutional email addresses, authorized telephone lines, hashed passwords, cryptographic two-factor authentication tokens, and audit session timestamps for clinical directors and procurement heads.
Under Section 25 of the Nigeria Data Protection Act 2023, MedSupply processes organizational and operational data under the following legitimate grounds:
MedSupply strictly maintains a Zero-Sale Policy: we never sell, monetize, or license your institutional order histories or corporate credentials to third-party commercial marketing brokers.
Information is only transferred to rigorously audited sub-processors strictly required to consummate your verified procurement orders:
Shared data: Destination hospital loading dock, delivery receiver name, phone contact, invoice manifest, and live temperature sensor IDs.
Shared data: Institutional corporate banking identifiers, transaction amounts, and escrow milestone release triggers.
Shared data: Batch release documentation, mandatory adverse event notices, and recall audit certificates in events of manufacturer alert notices.
MedSupply employs defense-in-depth infrastructure to insulate healthcare commercial assets from unauthorized intercept, data leakage, and cryptographic compromise:
All in-transit data protected by 256-bit elliptic-curve cryptography.
Institutional databases and audit vaults encrypted with rotating KMS keys.
Role-based controls isolating buyer hospital records from competitor views.
Routine penetration testing is conducted bi-annually by independent CREST-accredited cybersecurity auditors. Automated session timeouts and geo-fenced IP validation are applied to all procurement consoles.
In alignment with Nigerian pharmaceutical regulations, data is preserved in accordance with statutory minimum retention timeframes:
| Record Classification | Mandatory Retention | Regulatory Authority |
|---|---|---|
| General Pharmaceutical POs & Invoices | 6 Years | Federal Inland Revenue / CAC |
| Controlled Substances & Schedule Requisitions | 7 Years | PCN & NAFDAC Narcotics Desk |
| Cold Chain IoT Temperature Logs | 3 Years after product expiry | WHO / GDP Guidelines |
| Unsuccessful KYC Rejection Archives | 2 Years (Anti-Fraud Register) | MedSupply Compliance Audit |
Upon expiration of statutory retention mandates, records are securely shredded or irreversibly obfuscated using cryptographic zeroization protocols.
Designated institutional representatives and superintendent pharmacists retain full statutory rights regarding their institutional records:
If you have questions regarding this Privacy Policy, wish to exercise statutory institutional rights, or suspect an enterprise data security irregularity, contact our designated Data Protection Officer:
MedSupply Enterprise Healthcare Infrastructure Ltd.
Plot 14, Commercial District, Victoria Island, Lagos, Nigeria
Understand our escrow payment protections, cold-chain verification liabilities, and NAFDAC return policies.