Legal

Sanitas Privacy Policy

Effective date: 29 September 2026 | Last updated: 29 September 2026

Sanitas is a digital health financing platform operated by Isuna Technologies, registered in Nigeria under RC 7358142, with its office at No 2, Anthony Adegbulugbe Crescent, Jahi District, Abuja. This policy applies to sponsors, beneficiaries and visitors, and explains what data we collect, why, who we share it with and your rights under the Nigeria Data Protection Act 2023 and other applicable laws.

1. Who Is Responsible for Your Data

Isuna Technologies Limited is the data controller for data processed through Sanitas, including account, payment and enrolment data. SSHIAs are also controllers for their own records once beneficiary details are transmitted. Our Data Protection Officer can be contacted using Section 14.

2. What We Collect

We collect sponsor details (name, email, phone and location); beneficiary details (name, date of birth, sex, address, relationship, facility preference and insurance ID where available); transaction details; communications; and technical data such as IP address, browser, device and usage data. We also receive enrolment and coverage information from SSHIAs and payment confirmation or failure from payment providers. Health-insurance enrolment, coverage status and facility details are sensitive health-related data. We apply stricter controls, never use it for marketing, and do not collect medical records, diagnoses or treatment details.

3. Beneficiary Data and Sponsor Responsibilities

Sponsors confirm they have beneficiary consent or lawful authority, that information is accurate and current, and that beneficiaries know their data is shared with Sanitas and the relevant SSHIA. Beneficiaries may contact us directly to access, correct or otherwise exercise rights over their data.

4. How We Use Your Information and Our Lawful Basis

We process data to manage accounts; enrol, activate and renew coverage; process and remit payments; send service notices; answer support requests; send consented marketing; prevent fraud; improve platform security; create anonymised reports; and comply with law. Lawful bases include contract, consent, legal obligation, legitimate interests, and NDPA-permitted health and social protection processing. We do not make solely automated decisions with legal or similarly significant effects.

5. Cookies and Tracking Technologies

Necessary cookies are set automatically. Analytics and other non-essential cookies require consent and can be controlled through our banner, settings or browser. Disabling necessary cookies may affect platform operation.

6. Sharing and Disclosure of Information

We share data only where needed with SSHIAs and health authorities, accredited facilities, contracted providers for hosting, payments, analytics, messaging and support, regulators and law enforcement where required, and successors or acquirers subject to equivalent safeguards. Sanitas does not sell personal data.

7. International Data Transfers

Platform data is hosted in European Union data centres. We transfer data outside Nigeria only where permitted by the NDPA, including through adequate protection or safeguards such as NDPC-recognised contractual clauses. UK and EU sponsors may have relevant UK GDPR or EU GDPR rights.

8. Data Retention

We retain sponsor account data for the account life plus 24 months; beneficiary enrolment data for coverage duration plus 3 years; payment records for 3 years; support communications for 2 years after last contact; marketing preferences until withdrawal plus a suppression record; and technical and analytics data for 24 months. We securely delete or anonymise data when no longer needed.

9. Data Security

We use encryption in transit and at rest, role-based access controls, multi-factor authentication, regular security reviews and need-to-know access restrictions. Where a breach is likely to risk rights and freedoms, we notify the NDPC and affected people as required by law.

10. Children's Data

We process a child's data only with parental or guardian authority and only for enrolment and coverage. We do not use children's data for marketing, and sponsor accounts are for adults aged 18 or over.

11. Your Data Protection Rights

Subject to law, you may be informed, access and copy data, correct it, request deletion, restrict or object to processing, receive portable data, avoid solely automated significant decisions, withdraw consent and complain to the NDPC at www.ndpc.gov.ng. Contact our DPO; we may verify identity and respond within the applicable timeframe and in any event within 30 days.

12. Communication Preferences

You can opt out of marketing through unsubscribe links, STOP replies, account settings or by contacting us. Essential service messages will continue.

13. Changes to This Privacy Policy

The latest policy is available on this page with its effective date. We will notify you before material changes take effect and seek consent where required.

14. Contact Us

Data Protection Officer: Data Security Officer, Isuna Technologies Limited Email: support@sanitascare.org Address: Isuna Technologies Limited, 2 Anthony Adegbulugbe Crescent, Kado, Abuja