Last updated June 5, 2026

Data Privacy Policy

Pink Petals Fertility Clinic — Online Payment Portal (PinkPay) Last updated: June 5, 2026

1. Our Commitment

At Pink Petals Fertility Clinic we take your privacy seriously. This policy explains what personal data we collect, why we collect it, how we use and protect it, and what your rights are under the Nigerian Data Protection Regulation (NDPR) and, where applicable, the EU GDPR.

If you do not agree with this policy, please do not use the PinkPay portal.

2. Who is the Data Controller?

Pink Petals Fertility Clinic #19 Ugwueme Crescent, off Umuoji Street, beside Prime College, by Agric Bank Bus Stop, Independence Layout, Enugu, Nigeria. 📧 dpo@pinkpetalsfertilityclinic.org (Data Protection Officer) 📧 info@pinkpetalsfertilityclinic.org ☎ +234 802 714 2889

3. What Data We Collect

a) Information you provide

First & last name
Email address
Phone number (optional)
Encrypted password
Two-factor authentication details (when enabled)
Information about services you book or pay for

b) Information collected automatically

IP address and browser type (for security & audit logging)
Device type and operating system
Page-visit and session timestamps
Authentication and login events (success / failure)

c) Payment data

Card / bank details are never stored on our servers. They are entered directly into our PCI-DSS compliant payment gateway, which returns to us only a tokenised reference and the transaction outcome.

d) Sensitive / clinical data

Where you choose to share clinical information through the portal (e.g. a service category), this is treated as special category data and protected with stricter controls (see §6).

4. How We Use Your Data

We process your personal data for the following purposes:

Purpose	Lawful basis
Creating and managing your portal account	Contract
Processing your payments and issuing receipts	Contract
Sending one-time codes for sign-in / password reset	Legitimate interest (account security)
Detecting fraud and suspicious activity	Legitimate interest
Complying with tax, accounting and clinical record-keeping obligations	Legal obligation
Sending occasional service updates (only if you opt-in)	Consent

We will never sell or rent your personal data.

5. Sharing Your Data

We share your data only with:

Payment gateway — to process transactions.
Email delivery provider — to send receipts, sign-in codes and password-reset messages.
reCAPTCHA (Google) — to verify you are human on sign-up forms.
Cloud hosting provider — to host the application and database (servers located in the United States of America).
Regulators and law-enforcement — when required by law or to protect our legal rights.

All third parties are bound by written contracts that require them to keep your data confidential and to use it only for the agreed purposes.

6. How We Protect Your Data

Encryption in transit — all portal traffic uses HTTPS (TLS 1.2+).
Encryption at rest — passwords are hashed with bcrypt; sensitive tokens (e.g. one-time codes) are hashed before being cached.
Access control — staff access is role-based with the principle of least privilege.
Mandatory two-factor authentication for all clinic staff.
Idle session timeout of 10 minutes for admin sessions.
Audit logging — every privileged action is logged with user ID, IP and timestamp.
Regular backups with restricted access.

Despite these measures, no system is 100% secure. If a breach affecting your personal data occurs, we will notify you and the regulator within 72 hours as required by NDPR.

7. How Long We Keep Your Data

Data type	Retention
Account profile	Until you request deletion + 30 days
Payment / receipt records	7 years (tax & audit requirement)
Audit and security logs	24 months
One-time codes & temporary tokens	Up to 15 minutes (then deleted)
Email delivery logs	6 months

Clinical health records are governed by separate medical retention rules (typically a minimum of 10 years from the last visit).

8. Your Rights

Under NDPR (and GDPR if you are in the EU/UK) you have the right to:

Access the personal data we hold about you.
Rectify inaccurate or incomplete data.
Erase your data ("right to be forgotten") subject to legal retention duties.
Restrict or object to certain processing activities.
Withdraw consent at any time (where consent is the lawful basis).
Data portability — receive a machine-readable copy of your data.
Lodge a complaint with the Nigeria Data Protection Commission (NDPC).

To exercise any of these rights, email dpo@pinkpetalsfertilityclinic.org. We will respond within 30 days.

9. Cookies & Similar Technologies

The portal uses a small number of cookies:

Session cookie — keeps you signed in (essential).
CSRF token — prevents cross-site request forgery (essential).
Currency preference — remembers your selected display currency.
reCAPTCHA cookies — anti-bot protection (Google).

We do not use advertising or third-party tracking cookies.

You can clear cookies in your browser settings at any time, but the portal will not function without the essential ones.

10. International Data Transfers

Some of our service providers (e.g. email delivery, reCAPTCHA) may process data outside Nigeria. Where they do, we ensure that an adequate level of protection is in place, such as Standard Contractual Clauses or equivalent safeguards required by NDPR.

11. Children's Data

The portal is not intended for use by children under 18. We do not knowingly collect personal data from minors. If you become aware that a minor has provided us with personal data, please contact us so we can delete it.

12. Changes to This Policy

We may update this policy from time to time. The "Last updated" date at the top reflects the latest revision. Material changes will be announced inside the portal and by email at least 14 days before they take effect.

Contact our Data Protection Officer (DPO) 📧 dpo@pinkpetalsfertilityclinic.org ☎ +234 802 714 2889 🏥 #19 Ugwueme Crescent, off Umuoji Street, beside Prime College, by Agric Bank Bus Stop, Independence Layout, Enugu, Nigeria.