Privacy Policy & Data Protection Notice

1. Information We Collect

To generate your verified rider identity and emergency medical profile, we collect the following categories of data during registration or agent verification:

• Identity Data: Full legal name, date of birth, residential address, passport photograph, and government ID (NIN/Voter's Card/Driver's License).
• Vehicle & Operator Data: Vehicle category (Motorcycle/Tricycle/Car), license plate number, engine number, and registration status.
• Vital Medical & Emergency Data: Blood group, genotype, known severe allergies, existing medical conditions, advance directives ("No Blood" directives), and Next-of-Kin (ICE) contact details.
• Technical & Access Logs: IP address, device user-agent strings, timestamp, and location data captured when a QR code or emergency profile is scanned.

2. Legal Bases for Sensitive Medical Data Processing (NDPA 2023)

Under Section 25 and Section 26 of the Nigeria Data Protection Act 2023, processing of personal and sensitive category medical data is conducted strictly under the following statutory grounds:

• Explicit Informed Consent: You provide explicit consent upon account registration, credential activation, or execution of our Statutory Consent Notice & Disclaimer to encrypt, process, and make your vital medical data accessible for emergency triage.
• Protection of Vital Interests: In life-threatening emergencies, road accidents, or unconscious collapses, processing and disclosing triage data is necessary to protect your vital life and health interests when you are physically or legally incapable of giving immediate verbal consent.
• Legitimate Healthcare Verification: Facilitating immediate recognition by licensed healthcare practitioners, verified trauma hospitals, and first responders to prevent fatal mis-transfusion, adverse drug interactions, and unidentified casualty delays.

3. Standalone Consent Notice & Advance Directives Disclaimer

Our comprehensive Statutory Consent Notice & Disclaimer (MV-NDPA-CNS-2026) is incorporated herein by reference. It details emergency break-glass authorization protocols, Good Samaritan triage immunity, and our advance medical directive disclaimer (clarifying that while directives like "No Blood" cards are securely displayed, attending hospital clinicians operate under emergency medical triage discretion under Nigerian laws).

4. Next-of-Kin Telecommunications & SMS Dispatch Disclosures

When an emergency QR scan or hospital break-glass access event occurs, MyVault automatically transmits high-priority notifications to your registered Next-of-Kin:

• Emergency SMS messages and dispatch alerts contain your identifier, approximate GPS coordinates of the scan event, and timestamp.
• Recipient phone numbers are shared strictly with licensed Nigerian telecommunications gateway aggregators for the sole purpose of immediate emergency dispatch delivery.
• Emergency contact numbers are never sold, rented, or repurposed for commercial marketing.

5. Real-Time Audit Surveillance & Notifications

Under NDPA 2023 accountability principles, every access event to your emergency profile triggers:

• An immediate SMS / push notification to your designated Next-of-Kin detailing the scan event.
• A permanent, tamper-proof audit log recording the accessor's IP address, timestamp, facility name, and clinical justification.

6. Data Storage & Security Measures

We implement bank-grade technical and organizational safeguards to protect your personal data:

• All sensitive data in transit is encrypted using TLS 1.3 encryption, and sensitive health directives are encrypted at rest using AES-256-GCM cryptography.
• Access control is enforced via JWT authentication tokens and mandatory multi-factor validation for admin operations.
• We do not sell, rent, or trade your personal or medical data to third-party advertisers or marketers under any circumstances.

7. Your Statutory Rights & Consent Revocation Under NDPA 2023

As a data subject registered on MyVault, you possess the right to:

• Access: Request a copy of your personal data and emergency access logs held on our systems.
• Rectification: Correct inaccurate or outdated medical and emergency contact information via your user profile.
• Consent Withdrawal / Erasure: Revoke consent and deactivate your emergency profile at any time by contacting our Data Protection Officer. Deactivation immediately halts public QR code resolution. Note that historical clinical audit trail records are retained in encrypted cold storage strictly to satisfy statutory healthcare and criminal defense record retention laws.
• Objection & Data Portability: Object to automated processing or request digital portability of your compliance records.

8. Cookies & Local Storage

MyVault utilizes browser local storage and essential cookies strictly to manage active authentication sessions, remember theme preferences, and maintain NDPR consent choices. No third-party tracking cookies are placed prior to explicit consent.

9. Contact Information & Data Protection Officer

For data protection inquiries, privacy requests, or to exercise your NDPA rights, contact our Data Protection Officer:

Email: privacy@myvault.com.ng
Emergency Command Center: Support & Statutory Audit Office, Lagos, Nigeria
Hotline: 0800 MYVAULT