This Privacy Policy explains how MindBridge Nigeria ("we", "us", "our") collects, uses, stores, and protects your personal data in compliance with the Nigeria Data Protection Regulation (NDPR) 2019 and the Nigeria Data Protection Act 2023.
1. Who We Are
MindBridge Nigeria is an online therapy platform operating in Nigeria. We connect clients with licensed mental health professionals via video, chat, and phone. Our contact address is: [email protected].
2. Data We Collect
We collect the following categories of personal data:
- Account Data: Name, email address, phone number, password (hashed), date of registration.
- Profile Data: Date of birth, gender, state of residence, occupation, emergency contact details.
- Health & Wellness Data: Intake questionnaire responses, mood journal entries, session notes (where you consent to share them), crisis alert records. This is sensitive personal data and receives the highest level of protection.
- Session Data: Booking records, session type, date and time, duration, therapist matched.
- Financial Data: Payment amounts, Paystack transaction references. We do not store full card numbers.
- Technical Data: IP address, browser type, pages visited, login timestamps.
3. How We Use Your Data
- To create and manage your account
- To match you with appropriate therapists based on your preferences
- To facilitate and record therapy sessions
- To process payments securely via Paystack
- To send session reminders, summaries, and important account notifications
- To monitor for and respond to crisis alerts
- To comply with legal obligations
- To improve our platform through anonymised, aggregated analytics
4. Legal Basis for Processing
We process your data on the following legal bases under the NDPR: (a) Contract — processing necessary to deliver our services to you; (b) Consent — for health data and optional features like sharing journal entries with your therapist; (c) Legitimate Interests — for platform security, fraud prevention, and service improvement; (d) Legal Obligation — where required by Nigerian law.
5. Data Sharing
We do not sell your personal data. We share data only with:
- Your Therapist: Only the data relevant to your care (booking details, intake summary, shared journal entries). Therapists are bound by professional confidentiality obligations.
- Paystack: For payment processing. Subject to Paystack's own privacy policy.
- Email Service Providers: For sending transactional emails. No health data is included.
- Legal Authorities: Only where required by Nigerian law or to protect life in a crisis situation.
6. Data Security
We implement industry-standard security measures including: encrypted data transmission (HTTPS/TLS), bcrypt password hashing, role-based access controls, and regular security reviews. However, no internet system is 100% secure and you use our platform at your own risk.
7. Your Rights Under the NDPR
As a data subject under Nigerian law, you have the right to:
- Access the personal data we hold about you
- Correct inaccurate data
- Request deletion of your data (subject to legal retention requirements)
- Withdraw consent at any time
- Lodge a complaint with the National Information Technology Development Agency (NITDA)
To exercise these rights, contact us at [email protected].
8. Data Retention
We retain your account data for as long as your account is active or as needed to provide services. Health and session data is retained for a minimum of 5 years in compliance with Nigerian medical records guidelines. You may request deletion of non-essential data at any time.
9. Changes to This Policy
We may update this policy periodically. We will notify you of significant changes by email and by updating the "Last updated" date above.
