Privacy Policy

Last updated: 2 November 2026

This policy explains how Bloom MedSys ("we", "us") collects, uses and protects personal data on DocWaka (docwaka.com), including health information. We follow the Nigeria Data Protection Act 2023 (NDPA) and the regulations of the Nigeria Data Protection Commission (NDPC). The NDPA treats health information as sensitive personal data, and so do we.

Who we are

Bloom MedSys runs DocWaka and is the data controller for it. Address: Scapular Plaza, KM 17, Lekki-Epe Expressway, Lagos, Nigeria. Email: [email protected]. Phone: +234 707 000 0654.

The professionals, hospitals and clinics you book are separately responsible for the clinical records they keep about your care.

What we collect

If you book care

Your name and phone number, your email address if you give it, the professional, date, time and type of appointment, and your reason for the visit if you choose to tell us. A reason for visit can be health information. Once payments start, we'll also record whether you've paid, but not your full card or bank details, which stay with the payment provider.

If you use "near me" to find hospitals and clinics, your browser asks for permission to share your location, which is used to sort results by distance.

If you join as a healthcare professional

Your name, profession and specialty, your regulatory council and licence or registration number, city, practice address, phone number, email address, how you consult (in person, video, voice or chat) and your fees.

If you list a hospital or clinic

The facility's name, type, address, city and registration number, the services it offers (such as 24-hour emergency care), and the name, phone number and email address of a contact person.

If you join the waitlist

Your name, phone number or email address, and your city.

Doctors' Lounge

Verified doctors' profile details and what they post. Case discussions must never include anything that identifies a patient.

Technical data

Your IP address, browser type and the pages you request, which our hosting provider records to run and protect the service.

How we use it, and why we're allowed to

• To book and manage your appointments, and share your booking details with the professional you choose. Lawful basis: performance of a contract with you, and your explicit consent for any health information, which you give with the checkbox when you book.
• To verify professionals' licences and facilities' registrations with the relevant council, board or state regulator (for example MDCN, NMCN, PCN or MRTB). Lawful basis: your consent, and our legitimate interest in keeping patients safe.
• To show public profiles of professionals and facilities: name, profession, verification status, location, fees and ratings. Lawful basis: our contract with the professional or facility.
• To send booking confirmations, reminders and service messages. Lawful basis: performance of a contract.
• To handle complaints, safety concerns and fraud. Lawful basis: our legitimate interests and legal obligations.
• To protect someone's life in an emergency. Lawful basis: vital interests.
• To meet legal and regulatory duties. Lawful basis: legal obligation.

We never sell personal data, and we never use health information for advertising.

Who we share it with

• The professional, hospital or clinic you book, so they can provide your care.
• Regulatory councils, boards and state health regulators, to verify professionals and facilities.
• Service providers who work for us under terms that protect your data: FormSubmit (formsubmit.co), which delivers applications and waitlist sign-ups to our inbox during the pilot; our hosting and email providers; Google Fonts, which supplies the app's fonts and receives your IP address when it does; and, once payments start, a licensed payment provider.
• Regulators, courts or law enforcement, when the law requires it.

Transfers outside Nigeria

Some of these providers store or process data outside Nigeria, including in the United States and the European Union. We only transfer personal data abroad as the NDPA allows: where the destination gives adequate protection, under appropriate safeguards such as contract terms with the provider, or with your consent.

How long we keep it

• Bookings: for six years after the appointment, to deal with complaints and meet legal duties. During the pilot, bookings stay on your device until you delete them or clear your browser data.
• Professionals and facilities: while they're listed, and for six years afterwards. Applications that aren't approved are deleted after 12 months.
• Waitlist: until DocWaka launches in your city, or sooner if you ask us to remove you.

How we protect it

DocWaka uses encrypted connections (HTTPS). Only staff who need it can see personal data, and verification documents and health information get the tightest access. If a data breach is likely to put your rights at risk, we'll report it to the NDPC within 72 hours and tell you where the law requires.

Your rights

Under the NDPA you have the right to:

• be told how your personal data is used (this policy);
• get a copy of the personal data we hold about you;
• have inaccurate data corrected;
• have your data deleted, or its use restricted, where the law allows;
• object to our use of your data, including for direct marketing;
• receive your data in a format you can take elsewhere;
• withdraw your consent at any time, without affecting anything we did before you withdrew it;
• not be subject to decisions made solely by automated means that significantly affect you.

To use any of these rights, email [email protected] with "Data protection" in the subject line. We may ask you to confirm your identity first. If you're unhappy with how we've handled your data, you can complain to the Nigeria Data Protection Commission at ndpc.gov.ng.

Cookies and browser storage

DocWaka doesn't use cookies for advertising or analytics. During the pilot, your bookings, Doctors' Lounge content (including photos you add) and settings are saved in your browser's storage on your own device. They aren't sent to us. You can remove them at any time by clearing this site's data in your browser.

Saved pages. To load faster and use less mobile data, your browser saves a copy of the pages, images and fonts you've viewed on DocWaka, so they open again without downloading, even with no connection. These copies are the same for every visitor and contain no personal data; your bookings are kept separately, as described above. You can remove them at any time by clearing this site's data in your browser settings.

Children

Bookings must be made by an adult. A parent or guardian can book care for a child and gives consent on the child's behalf.

Emergencies

DocWaka is not an emergency service. In an emergency, go to the nearest hospital or call 112.

Changes to this policy

We'll update this page if our practices change, and the date at the top will show when it was last updated.

Contact us

For questions about this policy or your data, email [email protected] with "Data protection" in the subject line, call +234 707 000 0654, or write to us at Scapular Plaza, KM 17, Lekki-Epe Expressway, Lagos, Nigeria.