Terms of Use & Data Consent

01 Who this covers

"Hembox," "the platform," "we," or "us" refers to the Hembox clinical registry and the organisation operating it. "You" refers to anyone using the platform: a patient whose clinical data is recorded through it, or a clinician or facility user who enters, views, or manages that data on behalf of a participating facility. Where a clause applies to only one group, it says so.

02 What data we collect

Depending on your relationship to the platform, Hembox collects:

• Patient clinical data — demographics, medical and disease history, laboratory results, treatment and medication records, staging/scoring inputs, and outcomes, entered by treating clinicians as part of routine care.
• Facility and account data — clinician and facility-user identity, role, and facility affiliation, used to control who can see which records.
• Platform activity data — access logs and audit trails recording who viewed or changed a record, and when.

Hembox does not collect patient data directly from patients through this website; it is entered by clinicians and facility staff as part of care delivery at a participating facility.

03 Why we collect it

• Direct care. To give clinicians a complete, standardised patient record — including automated staging and risk scores — across every department a patient touches.
• Cross-facility continuity. So a patient's record is usable by their care team regardless of which participating facility captured it, within the access controls each facility sets.
• Research and platform improvement. De-identified or aggregated data drawn from records across participating facilities is used to build research datasets, validate clinical scoring, and improve the platform — this is the "data collation" referred to in the consent below.

Hembox does not sell patient data, and does not use it for marketing, advertising, or any purpose unrelated to care, research, or operating the platform.

04 Legal basis and consent

Hembox processes personal and health data in line with the Nigeria Data Protection Act, 2023 (NDPA) and the data protection principles it sets out — lawfulness, purpose limitation, data minimisation, accuracy, storage limitation, security, and accountability.

Processing relies on one or more of the following lawful bases, as applicable:

• Consent — for the collation of a patient's data across facilities and its de-identified use in research, obtained by the treating facility at the point of care, in addition to acknowledgement of this page.
• Vital interest / provision of healthcare — for the core clinical record needed to treat the patient.
• Legitimate interest — for facility operations, audit logging, and platform security.

Where a participating facility is the data controller for the care relationship, Hembox acts as a data processor for that facility, and this section describes the basis on which Hembox itself collates and processes data across facilities for the platform's registry and research functions.

05 Your rights (patients)

Subject to the NDPA and the clinical record-keeping obligations facilities must also follow, you have the right to:

• Ask what data Hembox holds about you and request a copy of it.
• Request correction of inaccurate or incomplete data.
• Withdraw consent to further cross-facility collation or research use of your data at any time.
• Request erasure of your data, where retaining it is not otherwise required for care continuity or by law.

Withdrawing consent does not affect the lawfulness of processing carried out before the withdrawal, and does not require your treating facility to delete records it is legally obliged to retain. To exercise any of these rights, contact your treating facility directly, or reach us at info@hembox.org.

06 How data is protected

• Encryption in transit and at rest for all clinical data.
• Role-based access control — clinicians and facility staff see only the patients and facilities their role covers.
• Facility isolation — a facility's records are not visible to another facility except where a patient's care spans both and access is explicitly granted.
• Audit logging of record access and changes, reviewable to detect misuse.
• De-identification before any data leaves the clinical record for research or analytics use — direct identifiers are removed or replaced before a dataset is exported.

07 Data retention

Identifiable clinical records are retained for as long as required for ongoing care and by applicable clinical record-keeping requirements. De-identified research datasets may be retained longer, since they can no longer be linked back to an individual patient. When a facility ends its participation in Hembox, its records are retained only as long as care continuity or legal obligations require, then deleted or fully de-identified.

08 If you are a clinician or facility user

• You may only access, enter, or export patient data for patients under your or your facility's care, using your own account.
• Data you enter should be accurate and complete to the best of your clinical knowledge — the platform's scoring and research value depends on it.
• Account credentials are not to be shared; actions taken under your account are attributable to you.
• You are responsible for obtaining and documenting any facility-level patient consent your institution requires, in addition to this page.

09 Data breach notification

If a breach affecting personal data occurs, Hembox will notify affected facilities and, where required by the NDPA, the Nigeria Data Protection Commission and affected data subjects, without undue delay after becoming aware of it.

10 Changes to this page

As Hembox moves through development, this page will be updated to reflect how data is actually collected, secured, and used. Material changes to the consent described here will be dated at the top of this page; continued use of the platform after a change constitutes acknowledgement of the update.

11 Contact

Questions about this page, or requests relating to your data, go to info@hembox.org.