Privacy Policy

Welcome to Diagknos ("we", "us", "our"), a home diagnostics coordination platform operated by Orivoy Limited, a company incorporated under the laws of the Federal Republic of Nigeria.

Diagknos enables users to book laboratory tests online, have samples collected from their chosen location by qualified healthcare professionals, and have those samples delivered to a selected partner laboratory for testing.

This Privacy Policy explains how we collect, use, store, disclose, and protect personal data when you use Diagknos, including our website, web application and related services. We are committed to handling personal data responsibly and in accordance with the Nigeria Data Protection Act 2023 ("NDPA"), the Nigeria Data Protection Act General Application and Implementation Directive 2025 ("GAID"), and other applicable Nigerian laws and regulations.

Important: Diagknos is a diagnostics coordination and logistics platform. We are not a laboratory, diagnostic testing facility, or healthcare provider. We coordinate the booking, collection and delivery of samples to your selected partner laboratory. Diagnostic testing, analysis and interpretation of laboratory results are the responsibility of the relevant partner laboratory and, where applicable, your healthcare provider.

The data controller responsible for your personal data is:

Where a partner laboratory receives your sample and processes your information for the purpose of performing diagnostic testing, that laboratory may act as an independent data controller for the processing it carries out for its own diagnostic and regulatory purposes. You should also review the privacy policy of your selected laboratory.

3.1 Information You Provide Directly

When you create an account, book a test, or interact with our platform and its related services, we may collect:

• Account information: full name, email address, phone number, date of birth, gender
• Collection address: the physical location where you wish to have your sample collected
• Test selection: the laboratory tests you choose to book, your preferred partner laboratory, sample tracking information, sample identification, including barcode, laboratory test results and information relating to the collection and handling of the samples.
• Payment information: payment details are processed by our third-party payment processor; we do not store full card details on our servers
• Communications: any messages, feedback, or correspondence you send us

3.2 Sensitive Personal Data

Some of this information may constitute health or other sensitive personal data under applicable data protection law.

• Test types booked: the diagnostic tests you select, which may indicate health concerns or conditions
• Sample collection records: records confirming sample collection, including timestamps and phlebotomist notes relevant to sample integrity
• Test results: diagnostic results transmitted to you through our platform by the partner laboratory

We do not store your full bank card details on our own servers.

3.3 Information Collected Automatically

When you access or use Diagknos, we may automatically collect certain technical and usage information including:

• Device and browser information: IP address, browser information, operating system information, device identifiers
• Usage Information: pages visited, location information where applicable to the functionality of the service, features used, crash logs, error and diagnostics logs, analytics information, time spent on the platform, and referral sources
• Location data: approximate location derived from your IP address (we do not use GPS tracking)
• Cookies and similar technologies: as described in Section 10 of this policy

3.4 Information We Receive from Other Sources

We may receive personal data from third parties involved in providing your services, including:

• Partner laboratories: test results, sample status updates, processing confirmations, and other information necessary to complete the diagnostic service
• Phlebotomists: We may receive collection confirmations, sample condition information, sample integrity information and scheduling updates
• Payment processors: transaction confirmations, payment status, transaction references and other necessary information to reconcile payments.

We process sensitive personal data for the following purposes and on the following lawful bases under the NDPA:

• To deliver our service: We process your booking, coordinate phlebotomist dispatch, manage sample delivery to your chosen lab, and transmit results. This is necessary to perform the service you have requested.
• To manage your account: We create and maintain your account, authenticate your identity, and manage your preferences. This is necessary to perform our contract with you.
• To process your health data: We store and transmit your test selections, sample records, and diagnostic results. We do this with your explicit consent.
• To communicate with you: We send booking confirmations, phlebotomist arrival updates, result notifications, and service updates via SMS and email. This is necessary to deliver the service and is in our legitimate interest.
• To process payments: We process payments for services, issue receipts, and manage refunds. This is necessary to perform our contract with you.
• To maintain quality and safety: We monitor sample integrity, track collection-to-delivery timelines, manage quality incidents, and oversee phlebotomist performance. This is in our legitimate interest and may be required by law.
• To improve the platform: We analyse usage patterns to improve platform functionality and your experience. This is in our legitimate interest.
• To comply with the law: We comply with applicable laws, regulations, and lawful requests from authorities, as required by our legal obligations.

We share your personal data only as necessary for the purposes described in this policy and with the following categories of recipients:

5.1 Partner Laboratories

When you book a test, we share your name, contact information, test selections, and sample collection details with your chosen partner laboratory. Once the laboratory receives your sample, it becomes an independent data controller for all processing related to diagnostic analysis.

5.2 Phlebotomists

Our phlebotomists are certified healthcare professionals licensed by recognised regulatory bodies (including NMCN, MLSCN, or MDCN). They receive your name, collection address, scheduled time, and test requirements solely for the purpose of performing sample collection.

5.3 Technology Service Providers

We use third-party service providers who process data on our behalf under written data processing agreements. These include cloud hosting and infrastructure providers, SMS and communication providers, payment processors, and media storage providers.

5.4 Legal and Regulatory Disclosures

We may disclose your personal data where required by law, regulation, or court order, or where necessary to protect the vital interests of any person.

5.5 No Sale of Personal Data

We do not sell, rent, or trade your personal data to third parties for their marketing purposes. We do not share your data with advertisers.

Some technology and service providers used by Diagknos may process or store personal data outside Nigeria, including the United States and other jurisdictions. Where your personal data is transferred outside Nigeria, we will take steps required under applicable Nigerian data protection law to ensure that the transfer is subject to appropriate safeguards. Depending on the circumstances, these safeguards may include:

• Transfer to a jurisdiction recognised as providing an adequate level of protection;
• Appropriate contractual or other safeguards
• Other lawful transfer mechanisms permitted under the NDPA and applicable guidance; or
• Consent or other permitted grounds where applicable

We will take reasonable steps to assess the privacy and security implications of international processing and to ensure that service providers handle personal data in accordance with applicable contractual and legal requirements.

We retain your personal data only for as long as necessary to fulfil the purposes for which it was collected, to provide our services, to meet applicable legal, regulatory, accounting and contractual requirements, to resolve disputes or protect our legitimate interests.

• Account information: kept for the duration of your account plus 2 years after you request deletion.
• Booking and transaction records: kept for 6 years from the date of transaction, as required by Nigerian law.
• Health data and test results: remain accessible for the duration of your account and archived for 5 years after account closure.
• Sample collection records: kept for 5 years from the date of collection.
• Communication records: kept for 2 years from the date of communication.
• Automatically collected data: kept for 12 months.

We implement appropriate technical and organisational measures to protect your personal data against unauthorised access, alteration, disclosure, or destruction. These measures include:

• Encryption of data in transit (TLS/SSL) where applicable, and at rest
• Access controls restricting data access to authorised personnel
• Authentication mechanisms and role-based access to information
• Regular security assessments and vulnerability monitoring
• Limiting access to information to persons who need it for their responsibilities
• Incident response procedures for prompt detection of data breaches
• Measures designed to protect sample and booking information
• Controls around access to customer and diagnostic information

We regularly review our security measures and may update them as our systems, services and risks evolve.

No method of transmitting or storing information can be guaranteed to be completely secure. However, we take reasonable measures to protect the information entrusted to us.

Subject to applicable law and any relevant limitations, you may have rights regarding your personal data, including:

• Right of access: You may request a copy of the personal data we hold about you.
• Right to rectification: You may request correction of inaccurate or incomplete personal data.
• Right to erasure: You may request deletion of your personal data in circumstances where applicable law permits.
• Right to restriction: You may request that we restrict processing of your data.
• Right to data portability: You may request your data in a structured, commonly used and machine-readable format.
• Right to object: You may object to certain processing, including processing based on legitimate interests, subject to applicable legal requirements.
• Right to withdraw consent: Where we process your personal data based on consent, you may withdraw your consent. Withdrawal does not affect the lawfulness of processing carried out before withdrawal.
• Right relating to automated decision-making: Where applicable, you may have rights concerning decisions based solely on automated processing that produce legal or similarly significant effects.

To exercise your data protection rights, or raise a privacy concern, please contact us at privacy@diagknos.com. Please provide sufficient information for us to understand and verify your request. We may need to verify your identity before responding to certain requests to protect your personal data from unauthorised disclosure. We will respond within the timeframe required by applicable law. Where we cannot fulfil a request, we will explain the applicable reasons and inform you of any available right to lodge a complaint with the Nigeria Data Protection Commission.

Our platform uses cookies and similar technologies to ensure functionality and improve your experience. In accordance with Article 19 of the GAID:

• Essential cookies: These are necessary for core platform functions and do not require consent.
• Analytics cookies: These help us understand how users interact with our platform. We obtain opt-in consent before placing these.

Our Cookie Policy lists every cookie and similar technology we use, and lets you change your preferences at any time.

Diagknos services may be booked on behalf of minors (persons under 18 years of age) by their parent or legal guardian. Where a booking involves a minor:

• Consent for the processing of the minor's personal and health data must be provided by the parent or legal guardian.
• The parent or legal guardian may exercise the minor's data subject rights on their behalf.

Diagknos involves several parties in the delivery of its services.

• Diagknos/Orivoy Limited: Orivoy Limited is responsible for personal data processed through Diagknos for purposes including booking coordination, sample collection coordination, sample transportation, customer communication, account management and delivery of laboratory results.
• Partner Laboratory: Your selected partner laboratory may act as an independent data controller for processing carried out for diagnostic testing, analysis, result generation and its own legal or regulatory obligations.
• Phlebotomists: Phlebotomists and sample collection personnel receive information necessary to carry out assigned collection activities and are required to maintain confidentiality and handle information appropriately.
• Technology Service Providers: Technology providers may process personal data on our behalf to provide infrastructure, hosting, storage, communications, payment, analytics or other services necessary to operate Diagknos.

If you have concerns about how we handle your personal data, we encourage you to contact us first at privacy@diagknos.com. We will investigate and seek to resolve your concern. You also have the right to lodge a complaint with the Nigeria Data Protection Commission (NDPC) at ndpc.gov.ng.

We may update this Privacy Policy from time to time to reflect changes to our services, data processing activities, technology, applicable law and regulatory requirements, or other privacy practices. Where changes are material, we will take reasonable steps to notify you via email or through a prominent notice on our platform and other appropriate channels.