SASRec
For practitionersGet your ID
Back to the home page

SASRec Limited

Privacy Policy

Last updated: 29 September 2026

SASRec Limited operates SASRec Health. We handle some of the most sensitive information a person can share: their health history. We do not take that lightly.

This Privacy Policy explains what data we collect, why we collect it, how we protect it and what rights you have over it. It applies to the SASRec Health mobile application, the patient web application at app.sasrecglobal.com and the website at sasrecglobal.com. We comply with the Nigeria Data Protection Act 2023 (NDPA). SASRec Limited is the data controller; our address is No 6, Divine Grace Street, Orita Aje, Abule Alfa, Mowe, Ogun State, Nigeria.

1.What data we collect

Identity data

When you create a SASRec Health account, we collect:

  • full name, date of birth and sex;
  • phone number and/or email address;
  • your National Identification Number (NIN), if you register with it. We do not store the number itself, only a one-way code made from it;
  • a photograph of your NIN card or, if you register without a NIN, a photograph of your face, used by our team to check your identity and deleted once the check is decided; and
  • if you register without a NIN, a next-of-kin phone number and your area of residence.

Health record data

Records entered by health workers include diagnoses and clinical notes, prescribed medications and dosage, laboratory test requests and results, vital signs, blood group, pregnancy and child health records, vaccination records, allergies, appointments and clinical photographs. You may also add your own allergies and answer appointments. Each clinical record is also kept in the international FHIR R4 format, and all stored data is encrypted at rest using AES-256.

Device and usage data

The app creates a random identifier for your installation and records each time your health record is opened. The app does not collect analytics, advertising identifiers or crash reports. On our website, with your consent only, the Meta Pixel records the pages you visit, your browser and device type and your IP address (see our Cookie Policy). Enquiries you send through the website forms are also kept.

Practitioner data

If you register as a Verified Practitioner, we additionally collect your licence number and regulatory body (MDCN, NMCN, PCN or other), your clinic or hospital, your verification status, and a log of the records you enter and open.

2.Why we use your data

PurposeLegal basis (NDPA 2023)
Create and manage your accountContract performance
Check your identity and prevent duplicate recordsLegal obligation and legitimate interest
Store and display your health recordsExplicit consent and contract performance
Enable record sharing with health workers, and access by a Verified Practitioner using your Health ID for your careYour explicit instruction and consent; medical purposes by health professionals bound by confidentiality
Show your allergies and blood group in an emergencyProtection of your vital interests
Send service messages, and medication and appointment remindersContract performance
Prevent fraud and protect platform integrityLegitimate interest and legal obligation
Measure visits to our websiteYour consent

3.Who we share your data with

We will never sell your health data. We will never use it for advertising. We share data only in the following circumstances.

Service providers. Companies that host our servers and database, store files, and deliver our emails and text messages. They are bound by agreements that restrict them to using your data solely for the services they provide to SASRec.

Meta Platforms. Only on our website, and only if you accept the Meta Pixel in the cookie banner. It never receives health information and is not used in the app.

Health workers. When you share your records through a QR code or link, the health worker can view the records you have authorised, until the share expires or you stop it. A Verified Practitioner can also open your record by entering your Health ID. Every opening is logged in your access history.

Legal requirements. We may disclose your data if required by Nigerian law, a court order or a regulatory authority. We will notify you of any such request where we are legally permitted to do so.

4.Where your data is stored

Your data is stored and processed outside Nigeria, within the European Union. We transfer personal data outside Nigeria only where it remains adequately protected, as the NDPA requires.

5.How we protect your data

  • AES-256 encryption for all stored data.
  • TLS 1.2 or later for all data in transit between your device and our servers.
  • Your NIN is never stored in plain text; only a one-way code made from it is kept.
  • A log of every access to your record that cannot be altered or deleted.
  • Role-based access controls: SASRec staff access to patient data is restricted to authorised personnel, and all access is logged.
  • The app is protected by your PIN, blocks screenshots, and keeps its data out of phone backups.

In the event of a data breach affecting your personal or health information, we will notify the Nigeria Data Protection Commission within 72 hours of becoming aware of it and, where the breach is likely to put you at risk, we will notify you without undue delay, in compliance with the NDPA.

6.Your rights

Under the Nigeria Data Protection Act 2023, you have the right to:

RightWhat it means
AccessRequest a copy of all personal and health data we hold about you.
CorrectionRequest correction of any inaccurate information in your account or records.
DeletionDelete your account and data, subject to the retention obligations below.
PortabilityTake a copy of your health record in a machine-readable format (JSON, with each clinical record also in FHIR R4).
ObjectionObject to processing that goes beyond the core service, for example website measurement.
Withdraw consentChange your choices at any time in Settings, "What you have agreed to", or in the website's cookie preferences.
ComplainLodge a complaint with the Nigeria Data Protection Commission (ndpc.gov.ng).

To exercise any of these rights, go to Settings in the SASRec Health app (including "Take a copy of everything" and "Delete your account") or email sasrecofficial@gmail.com. We will respond within 30 days.

7.Data retention

  • Active account data: retained for as long as your account is open.
  • Health records: retained for a minimum of 10 years from the date of entry, in line with Nigerian medical records guidelines, including after account deletion.
  • NIN: only the one-way code is kept. The photograph used for the identity check is deleted once the check is decided; the result of the check is kept.
  • Non-health personal data (phone number, email address, sign-in and sharing details): deleted when you delete your account.
  • Access logs and consent records: retained for at least 7 years for regulatory compliance.

8.Children's privacy

SASRec Health is designed for adults aged 18 and above. A child's health record is held through a parent or legal guardian, linked to the child's record by a health worker. If you believe a child has registered on our platform, please contact us immediately at sasrecofficial@gmail.com.

10.Updates to this policy

We may update this Privacy Policy to reflect changes in law, technology or our platform. When we make significant changes, we will notify you by email or through the app at least 7 days before the update takes effect. The date of the most recent update is always shown at the top of this page.

11.Contact us

SASRec Limited, No 6, Divine Grace Street, Orita Aje, Abule Alfa, Mowe, Ogun State, Nigeria.

Questions about this page: sasrecofficial@gmail.com or 0813 276 2591.