Privacy Policy

Overview

This Privacy Policy explains how mlooop collects, uses, and protects information when you use our platform. We are committed to handling all data — especially patient data — with the highest level of care and in full compliance with the Nigeria Data Protection Regulation (NDPR).

1. Information we collect

We collect two categories of information:

Account and organisational data: This includes information about the hospital or facility using mlooop — such as the organisation name, contact email, administrator details, and billing information.

Platform usage data: We collect anonymised analytics on how the platform is used (e.g. feature usage, session duration) to improve performance and user experience. This data is not linked to individual patient records.

Patient data: mlooop stores patient records on behalf of hospitals. We do not use patient data for any purpose beyond providing the service. Hospitals are the data controllers for all patient information.

2. How we use your information

We use account and organisational data to: provide and maintain your access to mlooop; communicate service updates, security notices, and support; process payments; and comply with legal obligations.

We do not sell, rent, or share your data with third parties for marketing or advertising purposes.

3. Patient data

mlooop acts as a data processor for all patient information. The hospital remains the data controller and is responsible for obtaining appropriate consent from patients for data processing under applicable law.

We process patient data only as instructed by the hospital and never use it for our own purposes. Patient data is encrypted at rest and in transit and is never used to train models or shared with external parties.

4. Data retention

Account data is retained for as long as your organisation has an active subscription, plus 30 days following termination (during which you can export your data).

After the 30-day period, all data is permanently deleted from our systems. We do not retain backups beyond 90 days.

5. Your rights

Under the NDPR and applicable law, you have the right to: access the personal data we hold about you; request correction of inaccurate data; request deletion of your data; and object to or restrict processing in certain circumstances.

To exercise any of these rights, contact us at dev@mlooop.com.

6. Security

We implement technical and organisational measures to protect your data against unauthorised access, loss, or disclosure. See our Security page for a detailed overview of the measures in place.

7. Changes to this policy

We may update this policy from time to time. We will notify account administrators of material changes via email at least 14 days before they take effect.

Contact

For privacy-related enquiries, contact us at dev@mlooop.com .