Who is responsible for your data
Renu Health Ltd, Lekki Phase 1, Lagos, is the data controller for the information described here. We process personal data in accordance with the Nigeria Data Protection Act 2023 and are registered with the Nigeria Data Protection Commission.
Questions, requests and complaints go to our Data Protection Officer at privacy@renuhealth.ng. You also have the right to complain directly to the Commission.
What we collect
Identity and contact details: your name, date of birth, phone number, email and delivery address.
Health information: your answers to the intake questionnaire, your weight and other measurements, medications and allergies, side-effect reports, uploaded progress photographs, and the messages you exchange with your doctor.
Transaction information: what you ordered, when it shipped, and a payment reference. We never see or store your full card number — that stays with our payment processor.
Technical information: device type, approximate location derived from your IP address, and how you move through the site.
Why we are allowed to hold it
For health information, our lawful basis is your explicit consent, given at intake, together with the provision of healthcare under Section 30 of the Act. You can withdraw consent, and doing so ends the clinical service.
For orders and payments, our basis is performance of our contract with you. For medical and pharmacy records we are required to retain, it is compliance with a legal obligation.
Who sees it
The doctors involved in your care, and only them — not the whole clinical team, and not by default.
The dispensing pharmacy, which receives what it needs to fill and label your prescription safely.
The courier, which receives your name, address and phone number, and nothing about what is in the box.
Our payment processor and our infrastructure providers, under contract, for the sole purpose of running the service.
We do not sell your data, we do not share it with advertisers, and we do not use your health information to target you with marketing.
How long we keep it
Medical records are retained for the period required of clinicians practising in Nigeria, currently a minimum of seven years from your last consultation. Marketing preferences are kept until you change them. Everything else is deleted or anonymised once it is no longer needed.
Your rights
You can ask for a copy of everything we hold about you, ask us to correct it, ask us to delete it where we are not legally required to keep it, object to processing, or ask for it in a portable format. We respond within 30 days and we do not charge for it.
Progress photographs are deleted on request without affecting the rest of your record.