Privacy Policy

1. Introduction

Innovate Health Africa (IHA) is committed to the responsible collection, processing, and protection of personal data in accordance with the Nigeria Data Protection Regulation 2019 (NDPR) and its implementing guidelines. This Privacy Policy explains how IHA collects, uses, stores, and protects the personal information you provide when using the DHL-SAT platform at dhl.innovatehealth.africa.

By using this platform and completing the registration process, you consent to the collection and use of your personal data as described in this policy.

2. Data Controller

The data controller for all personal data collected through the DHL-SAT platform is:

Innovate Health Africa
Lagos, Nigeria
info@innovatehealthafrica.org
innovatehealth.africa

IHA is registered with the Corporate Affairs Commission of Nigeria. All data collected through this platform is processed under Nigerian law in accordance with the NDPR 2019.

3. Data We Collect

When you register and complete the DHL-SAT, IHA collects the following categories of personal data:

Registration data: Full name, email address, country of residence, gender, and professional cadre.

Assessment data: Your responses to the 33-item DHL-SAT instrument, your domain-level scores, your overall Digital Health Literacy Score, and your proficiency tier classification.

Usage data: Date and time of assessment completion, device type, and platform access logs. This data is collected automatically and does not identify you individually beyond what is required for technical administration of the platform.

IHA does not collect financial information, government identification numbers, or health or medical records through this platform.

4. Purpose and Lawful Basis for Processing

IHA collects and processes your personal data for the following purposes, each grounded in a lawful basis under the NDPR:

To deliver the assessment and generate your results. Your registration data and assessment responses are processed to produce your personalised Digital Health Literacy Profile Report and AI-generated learning recommendations. Lawful basis: consent, provided at the point of registration.

To improve the instrument and platform. Anonymised and aggregated assessment data may be used to monitor the performance, reliability, and validity of the DHL-SAT instrument over time. No individually identifiable data is used for this purpose. Lawful basis: legitimate interests of IHA in maintaining a scientifically valid instrument.

To conduct programme evaluation and research. Anonymised aggregate data may be used in IHA's published evaluation reports and research outputs. No individually identifiable information will be included in any published output without your explicit written consent. Lawful basis: consent and legitimate interests.

To communicate with you about the platform. Your email address may be used to send you your profile report, certificate of completion, and — where you have opted in — updates about the DHL-SAT and related IHA programmes. Lawful basis: consent.

5. Data Sharing

IHA does not sell, rent, or trade your personal data to any third party.

Your personal data may be shared in the following limited circumstances:

With institutional partners: Where you access the DHL-SAT through a formal institutional deployment — for example, as part of a workshop facilitated by IHA at your employer's facility — your name and completion status may be shared with the designated institutional liaison for the purpose of certificate distribution and attendance confirmation.

With service providers: IHA may engage third-party service providers to support platform hosting, email delivery, and PDF generation. These providers process data on IHA's behalf and are contractually bound to handle it in accordance with the NDPR and IHA's data protection requirements. They are not permitted to use your data for any other purpose.

Where required by law: IHA may disclose personal data where required to do so by a court of competent jurisdiction, a regulatory authority, or applicable Nigerian law.

6. Data Retention

IHA will retain your personal data for a period of three years from the date of your most recent platform activity, after which it will be securely deleted or anonymised. Assessment response data retained for research purposes will be anonymised prior to retention beyond this period, such that it can no longer be attributed to you individually.

You may request deletion of your personal data at any time before the expiry of this retention period. See Section 7 for how to exercise this right.

7. Your Rights Under the NDPR

Under the Nigeria Data Protection Regulation 2019, you have the following rights with respect to your personal data:

Right of access: You have the right to request a copy of the personal data IHA holds about you.

Right to rectification: You have the right to request correction of inaccurate or incomplete personal data.

Right to erasure: You have the right to request deletion of your personal data, subject to IHA's legal obligations and legitimate interests.

Right to object: You have the right to object to the processing of your personal data for direct marketing or research purposes.

Right to withdraw consent: Where processing is based on your consent, you have the right to withdraw that consent at any time. Withdrawal of consent does not affect the lawfulness of processing carried out before the withdrawal.

To exercise any of these rights, submit a written request to info@innovatehealthafrica.org from the email address associated with your DHL-SAT registration. IHA will respond within 14 working days. Where a request cannot be fulfilled, IHA will provide a written explanation of the reason.

8. Data Security

IHA implements appropriate technical and organisational measures to protect your personal data against unauthorised access, disclosure, alteration, or destruction. These measures include encrypted data transmission via HTTPS, access controls limiting data access to authorised IHA personnel only, and secure server infrastructure.

No method of electronic transmission or storage is entirely secure. While IHA takes all reasonable steps to protect your data, IHA cannot guarantee absolute security. In the event of a data breach that is likely to result in risk to your rights and freedoms, IHA will notify affected users and the relevant regulatory authority in accordance with the NDPR's breach notification requirements.

10. Cookies and Tracking

The DHL-SAT platform uses essential cookies necessary for the technical functioning of the platform, including session management and access authentication. The platform does not use third-party advertising cookies or behavioural tracking technologies. You may disable cookies through your browser settings, though this may affect the functionality of the platform.

11. Changes to This Policy

IHA reserves the right to update this Privacy Policy at any time. Material changes will be notified to registered users via the email address provided at registration. The updated policy will be published on this page with a revised effective date. Continued use of the platform following notification of a material change constitutes your acceptance of the revised policy.

12. Contact and Complaints

For any query, concern, or complaint relating to the handling of your personal data, contact:

Data Privacy Officer
Innovate Health Africa
info@innovatehealthafrica.org