Privacy Policy & Consent

1. Introduction

Cynosure Aesthetic Clinic ("we", "our", "the Clinic") is committed to protecting the privacy and confidentiality of all patient and visitor information we collect. This Privacy Policy explains how we gather, use, disclose, and safeguard your personal and medical data in accordance with applicable Nigerian data protection laws, including the Nigeria Data Protection Act 2023 (NDPA) and the Nigeria Data Protection Regulation (NDPR).

By registering as a patient, using our online consultation service, or accessing our patient portal, you confirm that you have read and understood this policy.

2. Information We Collect

2.1 Personal Identification Information

• Full name, date of birth, gender, and nationality
• Contact details — phone number, email address, residential address
• Emergency contact and next-of-kin information
• Government-issued identification (where required)

2.2 Medical & Health Information

• Medical history, past surgical records, allergies, and current medications
• Vital signs, laboratory results, diagnostic imaging, and clinical notes
• Anaesthetic records, surgical reports, and post-operative care documentation
• Nursing observations, drug charts, and fluid intake/output records
• Photographs and videos taken for clinical assessment or procedure documentation

2.3 Financial Information

• Invoice and payment records
• Insurance details (where applicable)
• Transaction references — we do NOT store full card numbers

2.4 Technical Information (Online Services)

• IP address, browser type, and device information when you access our website or patient portal
• Session data and page interaction logs for security and performance monitoring

3. How We Use Your Information

We process your personal and medical data for the following purposes:

• Provision of care: To diagnose, treat, and manage your medical condition and to coordinate care among our clinical team
• Appointment & scheduling management: To book, confirm, and remind you of consultations, procedures, and follow-ups
• Billing & administration: To generate invoices, process payments, and maintain financial records
• Clinical safety: To record and monitor observations, prescriptions, fluid charts, and other safety-critical data
• Quality improvement: Anonymised, aggregated data may be used internally to improve clinical protocols and patient outcomes
• Legal & regulatory compliance: To meet obligations under applicable healthcare regulations and respond to lawful requests from authorities
• Communication: To send appointment reminders, results notifications, and important updates about your care

4. Sharing of Information

Your information may be shared only in the following circumstances:

• Within our clinical team: Doctors, nurses, anaesthetists, and administrative staff directly involved in your care, across any of our branches where clinically relevant
• Referring practitioners: With your consent, to GPs or specialists you are referred to or from
• Laboratories & diagnostic partners: Where tests or imaging are performed externally
• Legal authorities: Where required by a court order, subpoena, or applicable law
• Emergency situations: Where disclosure is necessary to protect the vital interests of you or another person
• Technology service providers: Our HMS software is hosted on secure servers; providers are bound by strict data processing agreements and cannot use your data for their own purposes

5. Data Security

We implement appropriate technical and organisational measures to protect your data against unauthorised access, loss, or disclosure. These include:

• Role-based access control — staff can only access records relevant to their role and branch
• Encrypted data transmission (HTTPS/TLS) for all online services
• Audit logging — all access and changes to medical records are tracked
• Regular system backups and disaster recovery procedures
• Staff training on data confidentiality and patient privacy obligations

6. Data Retention

We retain medical records for a minimum of 10 years from the date of your last clinical contact, or longer where required by law or professional guidance. Financial records are kept for a minimum of 7 years for audit purposes. When records are no longer required, they are securely destroyed in accordance with applicable regulations.

7. Your Rights as a Patient

Under the Nigeria Data Protection Act 2023, you have the following rights regarding your personal data:

• Right of Access: Request a copy of the personal data we hold about you
• Right to Rectification: Ask us to correct inaccurate or incomplete information
• Right to Erasure: Request deletion of your data (subject to legal and clinical record-keeping obligations)
• Right to Object: Object to processing where we rely on legitimate interest as the legal basis
• Right to Data Portability: Receive your data in a structured, machine-readable format
• Right to Withdraw Consent: Where processing is based on consent, you may withdraw it at any time without affecting the lawfulness of prior processing

To exercise any of these rights, please contact our Data Protection Officer in writing at the address below. We will respond within 30 days.

8. Patient Consent Requirements

8.1 Consent for Procedures

Separate, specific informed consent is required before any surgical or aesthetic procedure. This consent process includes a full explanation of the procedure, its risks, benefits, alternatives, and expected outcomes. Consent forms are provided and signed before any procedure commences and are stored as part of your permanent medical record.

8.2 Photography & Visual Documentation

Clinical photography and video may be taken before, during, or after procedures strictly for medical documentation. Such images are stored securely as part of your medical record and are not shared publicly or used for marketing purposes without your separate, explicit written consent.

8.3 Minors

For patients under 18 years of age, consent must be provided by a parent or legal guardian. We may, at our discretion, also seek the assent of the minor patient themselves where appropriate for their age and maturity.

9. Online Consultation & Patient Portal

When you use our online consultation booking service or patient portal, we collect and process the information you submit to facilitate your care. By submitting an online consultation form, you consent to us contacting you via your provided details to schedule and manage your appointment.

Your patient portal account is protected by a secure access code. You are responsible for keeping this code confidential. If you believe your account has been accessed without your authorisation, please contact us immediately.

10. Cookies & Website Tracking

Our public website uses cookies to ensure the website functions correctly and to understand how visitors use it. Cookies do not contain personal medical information. You can disable cookies in your browser settings; however, some website features may not function correctly as a result.

11. Changes to This Policy

We may update this Privacy Policy from time to time to reflect changes in our practices or applicable laws. The "Last Updated" date at the top of this page will reflect any changes. We encourage you to review this policy periodically. Continued use of our services after changes are posted constitutes your acceptance of the updated policy.

12. Contact Us

For privacy-related enquiries, requests to exercise your data rights, or complaints, please contact:

If you are not satisfied with our response, you have the right to lodge a complaint with the Nigeria Data Protection Commission (NDPC) at ndpc.gov.ng.