Privacy Policy

Crafts and Clicks Technology Ltd operates Result To Care and is the data controller for the information described here. This policy explains what we collect, why, who we share it with, how long we keep it, how we protect it, and what rights you have. We process personal data in accordance with the Nigeria Data Protection Act 2023 (NDPA) and the Nigeria Data Protection Regulation (NDPR), and with any other data protection law applicable where the service is actively offered. Health information, identity documents, photographs and home addresses are sensitive personal data. We treat them accordingly, and this policy names each category separately rather than hiding them inside a general reference to "your information". Contact us about anything in this policy at support@resulttocare.com.

Account and contact information • Name, title, email address, telephone number, password (stored hashed, never in readable form). • Date of birth, gender, nationality and residential address. • Login timestamps, device and session activity. Health information • Laboratory reports and other documents you upload. • AI-generated interpretations of those reports. • Symptoms, history and anything else you tell a professional during a consultation. Please note that video consultations are not recorded. • Consultation notes and outcomes recorded by the professional treating you. • Prescriptions issued to you. Identity verification information — for in-person services • A valid means of identification: National Identification Number (NIN), driver's licence, or international passport, and an image of the document. • A photograph or selfie, used so the attending provider can confirm who they are meeting. • The full address at which the service will be delivered, and any directions you give. • Emergency contact or guarantor details — their name, telephone number, address and occupation. • The name of the person expected to be present during a home visit. Communications • Messages exchanged with the professional treating you. • Voice messages you record. • Files you attach to a conversation. • Video consultations are transmitted live. We do not record them — see 'Video Consultations' below. • Correspondence with our support team. Payment information • The amount, currency, reference, status and date of each transaction. • Bank account details, where you are a professional or an affiliate receiving payouts. • We do not store full card numbers. Card details are handled by our payment partners. Professional and affiliate information • Professional registration or licence numbers, licensing body, certificates, and the results of our verification checks. • Qualifications, specialties, years of experience, service areas, availability and pricing. • Profile photograph and signature. • Commission, earnings and payout records. Technical information • IP address, browser and device type, and pages visited. • Information from cookies and similar technologies — see the Cookie Policy.

We use your information to: • Provide the service you asked for — arrange a consultation, deliver a home visit, interpret a result, issue a prescription. • Give the professional treating you what they need to treat you safely. • Verify identity, on both sides, before someone attends a private address. • Take payment, pay professionals and affiliates, and keep accurate financial records. • Verify professional credentials before someone is allowed to accept work. • Communicate with you about your care, your bookings and your account. • Investigate reports, resolve disputes, and detect and prevent fraud and abuse. • Keep the Platform secure and working. • Meet legal, regulatory and professional record-keeping obligations. • Improve the Platform, using aggregated or de-identified information wherever that is sufficient. We do not sell your personal information. We do not use your health information for advertising, and we do not use it to train models for purposes unrelated to your care. Our lawful bases are: performing our contract with you; your consent, where we ask for it; our legal obligations; and our legitimate interests in operating a safe platform — balanced against your rights, and never applied to sensitive health data where consent or a legal obligation is the proper basis.

The professional treating you They receive what they need to deliver your care, and no more. For an in-person service that is your name, photograph, telephone number, service address, what was requested, the agreed schedule, the booking reference, and the emergency contact details where those are relevant. Submitting this information does not release it to the provider. It is held by the Platform and reviewed by an authorised administrator, who may approve or reject the verification. Only after approval is the information the provider needs to deliver the service released to them, and only that information. A rejected verification releases nothing. Our administrators Authorised staff may access information where necessary to verify identity or credentials, investigate a report, resolve a dispute, process a refund, or comply with a legal obligation. Access is limited to staff whose role requires it and is logged. Booking records show when a provider viewed a patient's details. Service providers acting for us • Payment processors, to take payment and make payouts. • Cloud hosting and file storage providers. • Email and notification delivery services. • Video calling providers, for the duration of a video consultation. • Automated analysis providers, described in the next paragraph. • Error monitoring providers, which receive technical fault reports that can incidentally contain some of your information. Each is bound by its own terms to use the information solely to provide that service to us, and not for its own purposes. Automated analysis of your information Two features send information away to be processed by machine rather than read by a person: • Lab result interpretation. The contents of a laboratory report you upload are analysed to produce the plain-language explanation you are shown. • Voice notes. A voice note you record in a consultation is transcribed into text so it can be read and searched. This is automated processing, not a clinical decision. Nothing produced this way is a diagnosis, and it never replaces the judgement of the professional treating you — see the Medical Disclaimer. The provider carrying it out is bound by its terms to use your information only to return the result to us, and not to train or improve its own products or for any other purpose. Where the law requires We may disclose information to comply with a court order, a lawful request from a regulator or law enforcement, or where disclosure is necessary to protect someone from serious harm. Other patients or providers Never. A provider does not see another provider's offer. A patient does not see another patient. A request sent to one chosen provider is not visible to anybody else.

Some of the service providers described above operate outside Nigeria, so some of your information is stored or processed abroad. This applies to our hosting, file storage, video calling, automated analysis and error monitoring providers. Your payments are processed within Nigeria. Where information leaves Nigeria, we use providers who are bound by their own terms to protect it and to use it only to provide their service to us, and we hold them to the standard the Nigeria Data Protection Act 2023 (NDPA) and the Nigeria Data Protection Regulation (NDPR) expects. Your rights under that law continue to apply to information held abroad exactly as they do to information held here, and you exercise them through us in the same way. We do not sell information, and we do not transfer it to anyone for their own purposes. If you would like to know which countries your information is held in, or which providers are involved, contact our Data Protection Officer and we will tell you.

Video consultations are transmitted between you and the professional in real time. • We do not record video consultations, and neither party may record, screenshot or transcribe one without the express consent of everyone taking part. • The clinical record of the consultation — the notes the professional writes, any prescription issued — is retained as part of your medical record. The video itself is not. • The connection is encrypted in transit. • We cannot control the privacy of the room you are in. Take the call somewhere you are comfortable being overheard, or use headphones. The Video Consultation Policy sets out the full provisions.

• Data is encrypted in transit using TLS. • Passwords are stored hashed, never in readable form. • Identity documents and uploaded files are held in private storage. They are not publicly reachable and cannot be opened by a web address alone: every request for one passes through a check that the person asking is entitled to that particular file, and access ends when the entitlement does. • A visiting professional is given your photograph so that they can confirm who they are attending, and only after your identity check has been approved. They are never given your identity document. • Access is role-based: staff can reach only what their role requires. • Access to patient booking details by a provider is logged, with the time and the identity of who looked. • Authentication uses signed, expiring tokens, and sessions can be revoked. • We review and patch our systems, and monitor for unusual activity. No system is perfectly secure, and we do not claim otherwise. If a breach occurs that is likely to result in a risk to your rights and freedoms, we will notify you and the Nigeria Data Protection Commission (NDPC) as required by law and within the time limits it sets.

• Medical records, consultation notes, prescriptions and uploaded laboratory results: retained for the period required by Nigerian medical record-keeping obligations, and in any event for no less than the minimum those obligations set. This applies even if you close your account — we are not permitted to delete them on request. • Identity verification documents: retained while the booking is live and for the period needed to resolve any dispute or meet a legal obligation, then deleted. • Messages, voice notes and files attached to a consultation or booking: retained with the clinical record of that service. • Financial and payment records: retained for the period required by tax and accounting law. • Account and profile information: retained while your account is open, and deleted or anonymised afterwards except where a retention obligation applies. • Technical logs: retained for a limited period for security and troubleshooting. Where an obligation requires us to keep something you have asked us to delete, we will tell you which obligation, and delete everything not covered by it.

Under the Nigeria Data Protection Act 2023 (NDPA) and the Nigeria Data Protection Regulation (NDPR) you have the right to: • Be told what we hold about you and why. • Access a copy of your personal data. • Have inaccurate information corrected. • Have information deleted, where no legal obligation requires us to keep it. • Restrict or object to certain processing. • Receive your data in a portable format. • Withdraw a consent you have given, at any time. • Complain to the Nigeria Data Protection Commission (NDPC). Withdrawing consent Where we rely on your consent — for example, consent to share your details with an attending provider — you may withdraw it. Withdrawal stops future processing that depended on it; it does not undo processing already carried out lawfully, and it does not require us to delete records we are obliged to retain. Withdrawing consent to share your details with a provider will usually mean the service cannot be delivered. Where that happens before delivery, the Refund and Cancellation Policy applies. To exercise any right, email support@resulttocare.com. We will respond within the period the law allows, and will verify your identity first — a request to disclose health data is exactly the request an impersonator would make.

We use cookies and similar technologies for authentication, session management, security, and remembering your preferences. The Cookie Policy sets out what is used, what each one does, and how to control them. We do not use cookies for advertising, and we do not include technologies we do not actually use.

The Platform is not intended for children under 15. A person aged 15 to 17 may use it only with the consent of a parent or guardian, who accepts the Terms of Use on their behalf and whose consent we rely on for processing. If we learn that we hold information about a child under 15 collected without appropriate consent, we will delete it, subject to any medical record-keeping obligation that has already attached to it.

We may update this policy. The version and last-updated date are shown at the top of this page. Where a change is material — a new category of information, a new recipient, a materially different retention period — we will tell you, and where the law requires it we will seek your consent again rather than assume it. Previous versions are retained so that it is possible to establish which text applied at any given time.

Crafts and Clicks Technology Ltd has designated a Data Protection Officer, who is responsible for how this policy is applied, for answering requests about your rights, and for dealing with the the Nigeria Data Protection Commission (NDPC) on our behalf. You can reach them directly: Data Protection Officer Email: support@resulttocare.com You do not have to go through anyone else to reach them, and you do not have to explain why you want to. A request or complaint about your personal data sent to any of our addresses is passed to them in any case.

Questions or requests about privacy: Email: support@resulttocare.com Data protection matters: support@resulttocare.com Phone: +234 904 788 5872 WhatsApp: +234 906 785 8606 Response time: within 48 hours on business days Making a formal complaint A complaint is different from a question, and it is handled differently. Use the complaints form on the Platform and your complaint is recorded in our complaints register: you are given a reference, we acknowledge it within 48 hours, and we give you a substantive answer within 30 days. You are told the outcome and the reasons for it whether or not your complaint is upheld. A complaint made by email or telephone is recorded in the same register and handled the same way. Crafts and Clicks Technology Ltd (operator of Result To Care) If you are not satisfied with our response, you may complain to the Nigeria Data Protection Commission (NDPC). You do not need our permission, and complaining to us first does not affect that right. Note: the ₦15,000 Verification Fee described in the Terms of Use pays for the identity checks described in this policy. It is a processing cost, not a charge for your data.