Document: Privacy Policy · Version 1.0 · Draft publication date: 5 November 2026

Privacy Policy

This Privacy Policy explains how AQIENTRA collects, uses, stores, shares and protects personal data when you visit or use its website, marketplace, account services, professional workspaces, support channels and related features (“Platform”). It is intended to be read together with the AQIENTRA Terms and Conditions.

1. Who is responsible for your information?

The AQIENTRA Platform operator is the data controller for personal data it processes for its own account administration, platform security, support, service operation and product management purposes. The operator's full legal name, registered address and privacy contact must be inserted in this notice before public release. An Organisation using a professional workspace may act as an independent data controller for personal data it enters or manages for its own business, clinical, employment or regulatory purposes. AQIENTRA may process such information on the Organisation's documented instructions as a data processor, subject to the applicable service terms and data-processing agreement.

2. Personal data we may collect

• Account data: full name, email address, account identifiers, password-authentication status, account preferences and consent records. Passwords are handled by the authentication provider and are not stored by AQIENTRA as readable text.
• Organisation and professional data: organisation names, business contact details, role and membership information, staff invitations, branch information, professional profile information and verification documents submitted by authorised users.
• Marketplace and service data: product enquiries, order details, provider interactions, appointment requests, delivery details, payment references and support communications.
• Operational records: inventory, batch, manufacturing, quality, finance, staff, audit, workflow and other records entered by an Organisation. These may include personal data about employees, suppliers, customers or patients.
• Health-related information: where a feature is enabled and an authorised user submits it, the Platform may process patient or health information. Such information is sensitive personal data and must only be entered where the Organisation or user has a valid lawful basis, appropriate notice and safeguards.
• Technical data: device and browser information, IP address and security logs where made available by service providers, approximate location where inferred from technical data, diagnostic events and cookie or similar technology information where used.
• Communications: support requests, feedback, email correspondence and notices sent to us.

3. How we obtain personal data

We collect data directly from you when you register, complete a form, use a service, contact support or submit content. We may receive information from the Organisation that invites you or administers your access, from providers involved in a transaction, from authentication, hosting, analytics, payment or communications vendors, and from public or professional sources where lawful and relevant to verification.

4. Purposes and lawful bases

Depending on the context, we process personal data to:

• create and secure accounts, authenticate users, verify email addresses and recover passwords;
• record mandatory acceptance of the Terms and Conditions and Privacy Policy, including the version accepted and the date/time;
• provide marketplace, enquiry, messaging, ordering, workspace, subscription and support functions;
• enable an Organisation to manage its staff, branches, records, workflows and permissions;
• protect the Platform, investigate misuse, prevent fraud, troubleshoot and maintain audit trails;
• process payments and maintain billing or transaction records where payment features are enabled;
• send service messages, security notices and essential operational communications;
• meet legal, regulatory, professional, accounting and dispute-resolution obligations; and
• understand service performance and improve features using appropriate safeguards.

Depending on the purpose, the lawful basis may include performance of a contract or steps requested before a contract, compliance with a legal obligation, legitimate interests balanced against your rights, consent where required, or another lawful basis recognised by applicable data-protection law. For sensitive personal data, additional conditions and safeguards are required. The relevant Organisation is responsible for determining its lawful basis when it acts as controller.

5. Health and sensitive personal data

AQIENTRA is designed for healthcare-related use cases, but not every part of the Platform is intended to collect patient records. Do not place patient identifiers, clinical notes, prescriptions, test results or other sensitive information into public profiles, general enquiries or support messages unless the relevant feature is expressly designed for that purpose and you are authorised to do so. Organisations must apply least-privilege access, appropriate notices and consent or other lawful conditions, retention schedules, staff training and confidentiality controls. Patient data must not be disclosed to unrelated Organisations or marketplace sellers merely because they use AQIENTRA.

6. How we share information

We may share personal data with:

• the Organisation that invited you or for which you are acting, within its authorised workspace and access controls;
• other users or providers only to the extent needed for an enquiry, order, appointment or service you request;
• hosting, database, authentication, email, payment, analytics, customer-support and security providers acting under appropriate contractual and security controls;
• professional advisers, auditors, insurers or service providers where necessary and subject to confidentiality;
• public authorities, courts or regulators where required by law or necessary to protect rights, safety or the Platform; and
• a successor or transaction counterparty in connection with a corporate restructuring or transfer, subject to applicable law and safeguards.

We do not sell personal health information. We do not permit advertisers to access private account conversations or Organisation records. Any future analytics, advertising or data-sharing feature must be separately assessed and transparently disclosed.

7. AQI AI and automated processing

AQI AI may process the information a user submits and the records that user is authorised to access, in order to answer questions, summarise information or prepare drafts. Access should follow the user's existing role, permissions, Organisation and branch scope. AQI AI must not be used to bypass access controls or to expose one Organisation's information to another. AI outputs may be inaccurate and require human review. AQIENTRA's intended use is not to make solely automated decisions with legal or similarly significant effects about individuals. Where automated decision-making is introduced, the notice and safeguards must be updated before launch.

Before public release, AQIENTRA must verify the AI providers and model settings in use, the data sent to them, retention settings, training-use restrictions and contractual safeguards. Do not submit information to an AI feature unless you are authorised to do so.

8. International transfers

Some service providers or infrastructure may process information outside Nigeria. Where personal data is transferred internationally, AQIENTRA and any relevant Organisation must ensure that the transfer is permitted under applicable Nigerian data-protection law, that the required adequacy, safeguards or other legal conditions are met, and that affected individuals receive appropriate information. The actual hosting regions and vendor locations must be verified and documented before publication.

9. Data retention

We retain personal data only for as long as reasonably necessary for the purposes described in this Policy, including account operation, security, contractual obligations, statutory retention, healthcare record obligations where applicable, audit, fraud prevention and dispute resolution. Retention periods vary by data category and the Organisation's role. When data is no longer required, it will be securely deleted, anonymised or otherwise disposed of in accordance with the applicable retention schedule and legal requirements. Account deletion does not automatically erase records an Organisation is legally required to retain.

10. Security measures

We use technical and organisational measures intended to protect information, which may include encrypted connections, authentication controls, role-based access, database row-level security, audit logging, backups, monitoring and restricted administrative access. No internet service can guarantee absolute security. Organisations are responsible for securing their own user accounts, devices, permissions, staff practices and data submissions. Suspected incidents should be reported promptly through the Platform's designated support channel.

11. Your privacy rights

Subject to applicable law and any lawful exemptions, you may have rights to request access to your personal data, correction of inaccurate information, deletion, restriction or objection to certain processing, data portability where applicable, withdrawal of consent where processing relies on consent, and information about complaints or remedies. You may also contact the relevant data-protection authority. If an Organisation controls the information, direct your request to that Organisation first; AQIENTRA will support the Organisation as required by the applicable service arrangement.

To exercise a right concerning AQIENTRA-controlled account information, use the Platform's designated privacy or support channel. We may need to verify your identity and clarify the scope of your request. We aim to respond within the time required by applicable law.

12. Cookies and similar technologies

The Platform may use essential browser storage and similar technologies to maintain authentication sessions, security preferences and service functionality. Optional analytics or marketing technologies, if introduced, should be disclosed and controlled in accordance with applicable law and the Cookie Policy. You can manage browser cookies through your device settings, although disabling essential storage may prevent sign-in or other functions from working.

13. Children

The Platform is not designed for independent account creation by children. A parent, guardian or appropriately authorised healthcare provider must act in accordance with applicable law when a service involves a child. Organisations are responsible for ensuring that any child-related health or personal data is handled lawfully and with appropriate safeguards.

14. Changes to this Policy

We may update this Policy to reflect changes in law, technology, vendors, Platform features or processing activities. The current version and effective date will be published on the Platform. Where a change materially affects users or requires renewed consent, AQIENTRA may ask users to review and accept the new version. We will maintain records of the policy version accepted at registration and any later re-acceptance.

15. Complaints and contact

Privacy questions, requests and complaints should be submitted through AQIENTRA's designated privacy or support channel. The final published version must identify the operator's full legal name, registered address and official privacy contact. Where a complaint concerns an Organisation's processing as controller, the relevant Organisation's privacy contact should also be provided.

16. Applicable law

This Policy is intended to be interpreted consistently with the Nigeria Data Protection Act 2023 and other applicable Nigerian laws and regulations, including any applicable requirements issued by the Nigeria Data Protection Commission. This statement does not represent a certification or guarantee of compliance. The final notice must be checked against the Platform's actual processing activities and current legal requirements.