Privacy Policy

Heltwise respects your privacy and understands the importance of protecting personal, medical and business information.

This Privacy Policy explains what information we collect, why we collect it, how it is used, who it may be shared with and the choices available to you.

1. Who We Are

Heltwise is a healthcare technology platform owned and operated by Caridon Global Services Limited, a company registered in the Federal Republic of Nigeria.

Heltwise is a brand and operating platform of Caridon Global Services Limited. It is not a separately incorporated company.

For the purposes of applicable data-protection law, Caridon Global Services Limited is the data controller responsible for determining how and why personal information is collected and used through Heltwise, except where another organisation or healthcare professional independently determines the purpose and means of processing.

Healthcare professionals, hospitals, pharmacies, laboratories and other healthcare organisations using Heltwise may act as independent data controllers for information they process to provide clinical, pharmaceutical or other regulated services. Where this applies, they are responsible for complying with their own legal and professional obligations.

In this Privacy Policy, “Heltwise”, “we”, “us” and “our” refer to Caridon Global Services Limited and the Heltwise platform it operates.

2. Laws That May Apply

We process personal information in accordance with the Nigeria Data Protection Act 2023, applicable guidance issued by the Nigeria Data Protection Commission and other relevant Nigerian laws.

The EU General Data Protection Regulation may also apply where Heltwise offers goods or services to individuals in the European Economic Area or monitors their behaviour there.

The UK General Data Protection Regulation and the Data Protection Act 2018 may apply where Heltwise operates in the United Kingdom, offers services to individuals in the United Kingdom or monitors their behaviour there.

Where another country’s privacy or health-data law applies to a service, we will comply with the relevant requirements before making that service available.

3. Our Privacy Commitments

• does not sell personal, medical or business information;
• does not allow advertisers, data brokers or unrelated third parties to purchase patient records;
• collects only the information reasonably required to provide and protect its services;
• uses personal information only for clearly stated, lawful and relevant purposes;
• does not use personal or health information for unrelated purposes without an appropriate lawful basis and, where required, the individual’s consent;
• does not use identifiable health information for targeted advertising;
• restricts access to authorised persons with a legitimate reason to use the information;
• applies appropriate technical and organisational safeguards;
• gives users clear information about how their information is used;
• respects applicable rights relating to access, correction, deletion, restriction, objection and consent withdrawal.

4. Information We Collect

The information collected depends on how you use Heltwise.

Patients

• your name, date of birth and contact details;
• identification information where required;
• sex or gender information where relevant to healthcare delivery;
• medical history, allergies and existing health conditions;
• symptoms and information provided during consultations;
• consultation notes, diagnoses, test results, prescriptions and treatment records;
• medicines ordered or purchased through the platform;
• pharmacy and fulfilment records;
• emergency contact and consent information;
• health measurements entered by you or an authorised healthcare professional;
• payment and transaction details;
• messages exchanged with healthcare professionals, pharmacies or support staff.

Healthcare Professionals

• identity and contact information;
• professional registration and licence details;
• qualifications, specialities and work history;
• professional profile information;
• consultation availability;
• consultation, prescription and treatment records;
• payment, fee and transaction records;
• information required to verify professional status;
• platform communications and activity records.

Pharmacies and Medicine Stores

• business-registration and pharmacy-licence information;
• pharmacist and authorised-user details;
• inventory, purchase, sales and fulfilment records;
• medicine batch and expiry information;
• supplier and purchasing information;
• revenue, profit and other business-performance information;
• payment and settlement details;
• information needed to verify the pharmacy or medicine store.

Suppliers and Vendors

• company-registration and verification documents;
• authorised representative details;
• regulatory and product documentation;
• product, stock and pricing information;
• orders received and orders supplied;
• buyer, delivery and fulfilment information;
• supply-chain and business-performance records;
• payment and settlement information;
• customer-support and transaction communications.

Technical and Usage Information

• IP address, device type, browser and operating-system information;
• login activity, authentication and security records;
• pages, tools and features used;
• error and diagnostic information;
• approximate location derived from an IP address;
• cookie and preference information;
• records of consent and privacy choices.

We will request access to a device’s camera, microphone, location or files only where the relevant feature requires it and appropriate permission has been provided.

5. Where Information Comes From

We may receive information:

• directly from you;
• from a parent, guardian, carer or authorised representative;
• from a healthcare professional involved in your care;
• from a pharmacy, laboratory, hospital or healthcare facility;
• from a supplier, buyer or business customer;
• from payment and identity-verification providers;
• from connected devices or services that you authorise;
• automatically when you use the website or platform;
• from public or regulatory registers used to verify healthcare professionals, pharmacies or suppliers.

6. Why We Use Your Information

We may use information to:

• create and manage accounts;
• verify identities and professional or business credentials;
• provide virtual consultations;
• maintain connected health records;
• enable patients to share records with authorised healthcare professionals;
• document consultations, tests, medicines and treatments;
• process prescriptions and medicine orders;
• connect patients with licensed pharmacies;
• verify healthcare professionals, pharmacies and suppliers;
• manage pharmacy inventory, sales, expiry dates and restocking;
• prepare sales, inventory and revenue summaries;
• manage supplier orders, deliveries, buyers and fulfilment;
• process consultation fees, payments and settlements;
• send service, appointment, prescription, stock and security notifications;
• provide customer support; detect misuse, fraud and security threats;
• comply with legal, regulatory, tax and professional obligations;
• establish, exercise or defend legal claims;
• improve the safety, accessibility and reliability of Heltwise;
• produce aggregated or appropriately de-identified operational insights.

7. Lawful Bases for Processing

Depending on the service and applicable law, we may process personal information on one or more of the following grounds:

Contract: Processing may be necessary to create an account, provide a requested service, process a consultation or order, manage a subscription or complete a transaction.

Consent: We may request consent where it is required, including for certain uses of health information, optional cookies, marketing communications, record sharing or device permissions. You may withdraw it at any time.

Legal Obligation: Processing may be necessary to meet legal, regulatory, tax, accounting, pharmaceutical, clinical or professional obligations.

Vital Interests: Information may be processed where it is necessary to protect your life, health or safety, particularly where you are physically or legally unable to provide consent.

Legitimate Interests: We may process information where it is reasonably necessary to operate, secure and improve Heltwise, prevent fraud, manage business relationships or protect our legal rights, provided those interests are not overridden by the individual’s rights and freedoms.

Healthcare and Public-Interest Grounds: Health information may be processed where necessary for medical diagnosis, treatment, healthcare management, public health, patient safety or another recognised healthcare purpose, subject to applicable law and professional confidentiality obligations.

8. Health Information

Health information receives additional protection because it is sensitive personal data (and special-category personal data under GDPR). We process health information only where an appropriate legal basis and an additional condition for processing sensitive data apply, such as explicit consent, healthcare provision, diagnosis or vital interests.

We will not use identifiable health information for unrelated advertising or sell it to third parties.

9. Medical Records and Consent Management

Heltwise enables patients to maintain information concerning medicines, prescriptions, consultations, allergies, tests, and treatments. Patients may grant, refuse or withdraw access to parts of their record through the platform.

A Heltwise record contains only the information entered, uploaded or transmitted through the platform. It should not be assumed to replace full records held by hospital systems.

10. How Information Is Shared

We may share relevant information with healthcare professionals, pharmacies, suppliers, diagnostic laboratories, payment processors, delivery logistics, regulators, and other trusted third parties only to the extent necessary to deliver the requested services.

We do not sell personal information or health records.

11. AI-Supported Features

Heltwise uses automated and AI-supported tools to organise information, prepare summaries, analyze sales trends, and forecast demand. AI-generated information is provided as decision support and must not replace professional medical judgement or commercial review.

12. Marketing Communications

Promotional communications will be sent only with an appropriate lawful basis. You may unsubscribe from marketing communications at any time. We will not use identifiable medical information to select or personalize advertisements.

13. Information Security

We use appropriate technical and organisational safeguards including encryption in transit and at rest, role-based access, and security testing. No digital service can guarantee absolute security. We will investigate and notify users and regulators of breaches where required by law.

14. International Transfers

Information may be processed outside Nigeria. Where cookie or personal information is transferred internationally, we will use approved transfer mechanisms (like Standard Contractual Clauses) to ensure safeguards match applicable laws.

15. How Long Information Is Kept

We retain information only for as long as reasonably required to provide the services, maintain transaction records, meet statutory requirements, protect safety, and resolve legal disputes.

16. Your Rights

Subject to local laws, you may have the right to access, correct, delete, restrict, or object to the processing of your data, or withdraw consent. To exercise these rights, contact info@caridonservices.com.

17. Complaints

You may contact us to resolve concerns. You also have the right to complain to the Nigeria Data Protection Commission (NDPC), the UK ICO, or an EEA supervisory authority where applicable.

18. Children

Children's data requires additional protection. Age-appropriate consents or parent/guardian authorization will be sought in compliance with local laws.

19. Data Protection by Design

We build Heltwise services with privacy in mind. This includes separating clinical and commercial data access, role-based permissions, and data impact assessments.

20. Changes to This Policy

We may update this policy. Material updates will be communicated through the platform. The effective date at the top indicates when the latest version came into effect.

21. Contact Us

For questions or requests concerning privacy, please reach out to:

Caridon Global Services Limited
Address: 150 Nkpor Road, Rumuolumeni Obio/Akpor, Rivers State, Nigeria
Email: info@caridonservices.com