How we collect, use, and protect your information.
Last updated: August 2026
DX Enterprise ("we," "our," or "us") operates a diagnostic medical laboratory information management platform. We are a data controller responsible for the personal data processed through this service. This Privacy Policy explains how we collect, use, disclose, and safeguard your information, and the rights available to you under the Nigeria Data Protection Act 2023 (NDPA) and other applicable data protection laws (including the EU GDPR where relevant).
We collect the following categories of personal data:
We process your data on the following legal bases:
We use the collected information to:
We engage vetted third-party service providers ("processors" / "sub-processors") to operate and improve our platform. We only share the minimum data necessary for each provider to perform its function, under written confidentiality and security obligations (data processing agreements). We do not sell your personal data. The categories of processors we use are summarised below.
| Purpose | Sub-Processor(s) | Location | Data Shared | Legal Basis |
|---|---|---|---|---|
| Website analytics | Google Analytics (Google LLC) | United States | Device, browser, and usage metadata (no health data) | Consent (cookie banner) / Legitimate interests |
| AI-assisted features (result interpretation, patient summaries, radiology/dental drafting, trend analysis) | Google Gemini (Google LLC); DeepSeek; Puter | USA; People's Republic of China; USA | Relevant health data required to generate the output | Explicit consent (off by default) |
| SMS / text messaging (result alerts, appointment & recall reminders) | Termii; Siteti (and other SMS gateways) | Nigeria | Patient name, phone number, and message content | Contract / Consent for marketing messages |
| WhatsApp Business messaging (result & appointment notifications) | Meta Platforms, Inc. (WhatsApp Business API) | United States / Ireland | Patient name, phone number, and message content | Contract / Consent for marketing messages |
| Email delivery & marketing (transactional reports and, where opted in, promotional emails) | Third-party email service providers (SMTP/ESP) | Varies | Email address and message content | Contract / Consent for marketing emails |
| Hosting & infrastructure | Our cloud hosting provider (cPanel / 9jaoncloud) | Nigeria | All platform data stored on our behalf | Legitimate interests / Contract |
| Payment processing | Payment gateway / acquiring partners | Varies | Payment reference and amount (we do not store full card numbers) | Performance of contract |
Marketing communications. Promotional emails, SMS, and WhatsApp messages are sent only where you have given a positive, recorded opt-in (or where a narrow legal exception applies). Birthday and promotional SMS additionally require per-channel consent. You can withdraw marketing consent at any time via the unsubscribe link in any message, the consent revocation portal, or by contacting our DPO — withdrawal is immediate and does not affect any standard service.
International data transfers. Some sub-processors are located outside Nigeria, including in the United States and China. Where we transfer personal or special-category data internationally, we rely on your explicit consent (for AI) and seek to apply appropriate safeguards such as contractual confidentiality, encryption in transit, and standard data-protection commitments. You may withdraw consent at any time (see Section 7).
Explicit consent required for AI. AI-assisted processing of your health data is off by default. It is only performed after explicit, informed consent is recorded against your patient record. You may refuse or withdraw this consent without affecting any standard laboratory service. AI output is decision-support only and is always reviewed by a qualified professional before it forms part of any report.
We do not sell your personal information. We may share your information with:
Under the NDPA and applicable law, you have the right to:
Retention carve-out. The right to erasure is not absolute. Where we are required by law to retain medical and laboratory records (for example, statutory retention periods for patient records and notifiable-disease reporting), we will restrict the processing of that data rather than delete it, keep it only for the legal obligation, and sever it from your identity by pseudonymisation. We will tell you when this applies. We respond to erasure requests within the timeframes required by the NDPA.
We retain personal and health data only as long as necessary for the purposes described above and to meet legal, accounting, and regulatory obligations. Medical and laboratory records are retained for the period required by Nigerian law and professional standards (commonly a minimum of the period mandated for patient records). AI analysis logs are retained for service improvement and audit, and are minimized where possible. When retention is no longer required, data is securely deleted or anonymized.
We implement appropriate technical and organizational measures to protect your personal data, including: encryption of credentials and of API keys at rest; transport encryption (HTTPS/TLS) with HSTS enforcement; role-based access controls; audit logging; rate limiting; and secure session management. No internet-transmitted data can be guaranteed 100% secure, but we work to protect your information using industry-standard controls.
Our lead supervisory authority in Nigeria is the National Data Protection Commission (NDPC). If you have questions about this Privacy Policy or wish to exercise your rights, please contact our Data Protection Officer at privacy@dxenterprise.com or info@dxenterprise.com. You may also contact the NDPC at ndpc.gov.ng.
We may update this Privacy Policy from time to time. Material changes will be reflected by the "Last updated" date above and, where required, notified to you directly.