1. Information We Collect

2vospace collects information you voluntarily provide when you register for, access, or interact with our platforms — including EMR CareBase, MPCS, and our web properties.

Identification & Contact Data: Names, phone numbers, email addresses, date of birth, and government-issued identification numbers where required for KYC or healthcare service delivery.

Health & Medical Data (CareBase): Medical history, consultation records, prescription details, diagnostic notes, and any other health information shared through the CareBase platform — processed with your explicit consent.

Financial Data (MPCS): Bank account details, BVN (for verification only), transaction history, loan records, and cooperative contribution data — processed securely for cooperative financial management.

Technical Data: IP addresses, browser type, device identifiers, usage patterns, and session information collected automatically to maintain service security and performance.

2. How We Process Your Information

We process your information strictly for the following purposes:

• Delivering and improving our platforms (CareBase, MPCS, and all 2vospace services)
• Creating and managing your secure user account
• Facilitating healthcare consultations, prescriptions, and records (CareBase)
• Processing cooperative financial transactions and member management (MPCS)
• Sending critical service and administrative communications
• Fraud prevention, security monitoring, and compliance enforcement
• Analytics and service improvement — using aggregated, anonymized data only
• Responding to legal obligations or vital safety interests

We do not use your data to train third-party AI models or for purposes beyond those disclosed herein.

3. Legal Bases for Processing

Under the Nigeria Data Protection Act (NDPA) 2023 and the EU GDPR, we rely on the following legal bases:

• Explicit Consent — Our primary basis for processing sensitive health and financial data.
• Performance of Contract — Processing necessary to deliver the services you have requested.
• Legal Obligation — Where processing is required by Nigerian law, including health record retention mandates.
• Vital Interests — Where processing is necessary to protect your life or the life of another person.
• Legitimate Interests — For security, fraud prevention, and service improvement, where balanced against your rights.

4. Information Sharing

We may share your information in the following limited circumstances:

• Healthcare Providers (CareBase): Doctors, pharmacists, nurses, and laboratory personnel involved in your care on the CareBase platform.
• Cooperative Partners (MPCS): BCorp and authorized cooperative administrators with appropriate access controls.
• Technology Service Providers: Trusted vendors (cloud hosting, payment processors, SMS gateways) who act as data processors under binding agreements.
• Legal Requirements: When compelled by law, court order, or regulatory authority in Nigeria or applicable jurisdictions.
• Business Transfers: In the event of a merger or acquisition, with prior notice to you.

5. Cookies & Tracking

Our web platforms use cookies and similar technologies for essential operation, performance analytics, and user preference memory. We do not use third-party advertising cookies.

You may control cookie preferences through your browser settings. Disabling essential cookies may affect platform functionality.

6. Data Retention

• Medical Records (CareBase): Retained for a minimum of 5–7 years as mandated by Nigerian health regulations.
• Financial Records (MPCS): Retained for a minimum of 5 years per CBN and NDIC guidelines.
• Account Data: Retained while your account is active and for a reasonable period thereafter.
• Technical Logs: Retained for 90 days for security and debugging purposes.

When no ongoing legal or business basis exists, we securely delete or anonymize your information.

7. Data Security

We implement industry-standard and sector-appropriate security measures:

• AES-256 encryption for data at rest; TLS 1.3 for data in transit
• Role-based access controls and multi-factor authentication
• Regular penetration testing and security audits
• Employee and contractor data privacy training
• Incident response procedures with 72-hour breach notification protocols

8. Minors' Privacy

Our platforms are not directed at children under the age of 18 without verifiable parental or guardian consent. A parent or legal guardian must create any account on behalf of a minor.

If we discover that data from a minor has been collected without verified parental consent, we will immediately deactivate the account and delete the data.

9. Your Privacy Rights

Under the NDPA 2023 and GDPR, you have the right to:

• Access & Portability: Request a copy of all personal data we hold about you.
• Rectification: Correct inaccurate or incomplete information.
• Erasure: Request deletion of your data (subject to legal retention obligations).
• Restriction: Ask us to pause processing of your data.
• Withdraw Consent: Withdraw any previously given consent at any time.
• Object: Object to certain types of processing.
• Complaint: Lodge a complaint with the Nigeria Data Protection Commission (NDPC) or your local data protection authority.

To exercise any right, contact our Data Protection Officer at dpo@2vospace.com.

10. Policy Updates

We may update this Privacy Policy as our services evolve or as required by law. We will notify you of material changes by posting a notice within our platforms and, where appropriate, via email or SMS.

We encourage you to review this policy periodically. The "Last Updated" date at the top of this page reflects the most recent revision.

11. Contact Us

For privacy-related inquiries, to exercise your rights, or to reach our Data Protection Officer:

12. Data Management Requests

To submit a Data Subject Access Request (DSAR) to review, update, or delete your personal information:

1. Email dpo@2vospace.com to request the DSAR form.
2. We will verify your identity before proceeding.
3. We will respond within 30 days as required under the NDPA.

Note: Deletion requests for medical or financial records are subject to mandatory legal retention periods.