CAREVILLE PRIVACY POLICY

Effective Date: April 27, 2026

Last Updated: April 27, 2026

1. INTRODUCTION AND SCOPE

CareVille Technologies Limited ("CareVille", "we", "us", or "our") is committed to protecting the privacy and personal data of all users of the CareVille mobile application and related services (collectively, the "Platform"). This Privacy Policy explains how we collect, use, store, share, and protect your personal data, and describes your rights under applicable data protection law.

This Policy applies to all users of the Platform ("you", "user", "patient") and should be read together with our Terms of Service. By using the Platform, you confirm that you have read and understood this Policy.

Our data protection practices are guided by:

• The Nigeria Data Protection Regulation (NDPR) 2019 and the Nigeria Data Protection Act 2023
• The General Data Protection Regulation (EU) 2016/679 (GDPR), to the extent applicable
• Applicable Nigerian healthcare data standards and the guidelines of the National Information Technology Development Agency (NITDA)

2. DATA CONTROLLER IDENTITY AND DATA PROTECTION OFFICER

2.1 Data Controller

CareVille Technologies Limited is the Data Controller for personal data collected and processed in connection with account registration, platform operations, and user experience.

CareVille acts as a Data Processor (on behalf of independent healthcare Providers, who are the Data Controllers) for clinical and medical data generated during healthcare service delivery.

2.2 Data Protection Officer (DPO)

In accordance with the NDPR and the Nigeria Data Protection Act 2023, CareVille has designated a Data Protection Officer. The DPO is responsible for overseeing our data protection compliance programme and can be contacted at:

Data Protection Officer, CareVille Technologies Limited
Address: 1 O.G Street Behind St Fidelis Catholic Church, Aduwawa, Benin City, Edo State, Nigeria
Email: care@carevilleapp.com

3. INFORMATION WE COLLECT

3.1 Personal Information

When you register and use the Platform, we collect:

• Full name
• Date of birth
• Gender
• Email address
• Phone number
• Residential address

3.2 Health and Sensitive Personal Data

Health data is classified as sensitive personal data under the NDPR and as special category data under the GDPR. We process health data only with your explicit consent or as otherwise permitted by applicable law. This includes:

• Medical history and pre-existing conditions
• Reported symptoms and diagnoses
• Consultation records and clinical notes
• Prescriptions and treatment plans
• Wellness, lifestyle, and fitness information
• Mental health information

3.3 Account and Technical Data

We automatically collect certain technical data when you use the Platform:

• Encrypted login credentials and authentication tokens
• Device type, operating system, and application version
• IP address and approximate geographic location
• Usage logs, session duration, and in-app activity data
• Crash reports and performance data

3.4 Payment Information

Payments are processed exclusively through licensed third-party payment processors. CareVille does not store full payment card numbers or bank account details on its systems. We retain only transaction references and amounts for accounting and dispute resolution purposes.

3.5 Family and Dependent Information

If you create or manage accounts for dependents (including minors), you confirm that you are the legal guardian or authorised representative of the dependent and that you are authorised to provide their personal and health information to the Platform on their behalf.

3.6 Communications Data

We retain records of communications between you and CareVille customer support, including emails, in-app messages, and call logs, for quality assurance and dispute resolution purposes.

4. LEGAL BASIS FOR PROCESSING

We process your personal data on the following legal bases, matched to specific processing activities:

• Consent: Processing of sensitive health and medical data; marketing communications; optional features such as sharing wellness data with third-party apps. You may withdraw consent at any time (see Section 11).
• Contractual Necessity: Account registration and management; facilitating booked consultations and services; processing payments and handling refunds; communicating service updates directly related to your account.
• Legal Obligation: Complying with NDPR, NAFDAC, and other applicable Nigerian regulatory requirements; responding to valid legal requests from courts or regulatory authorities; maintaining mandatory healthcare records.
• Legitimate Interests: Fraud prevention and platform security; improving Platform functionality through anonymised analytics; detecting and preventing abuse of the Platform, where such interests are not overridden by your data protection rights.

5. HOW WE USE YOUR INFORMATION

We use your personal data to:

• Create and manage your account and verify your identity.
• Facilitate telemedicine consultations, pharmacy access, nursing, wellness, and emergency services.
• Process payments and manage refunds and billing disputes.
• Communicate with you about appointments, service updates, and Platform changes.
• Provide customer support and resolve complaints.
• Improve and develop the Platform, including through anonymised usage analytics.
• Detect, investigate, and prevent fraud, security breaches, and violations of our Terms of Service.
• Comply with our legal and regulatory obligations.
• Send marketing communications where you have given consent (you may opt out at any time).

6. DATA SHARING

We do not sell, rent, or trade your personal data to third parties. We may share your information in the following circumstances:

• Healthcare Providers: We share relevant personal and health data with the independent Providers delivering services you have requested. These Providers are independent Data Controllers and are bound by their own professional confidentiality obligations.
• Payment Processors: We share transaction data with licensed payment processors (e.g., Paystack, Flutterwave) as necessary to process payments.
• Cloud and Technology Service Providers: We use reputable cloud hosting, analytics, and security service providers who process data only on our instructions under Data Processing Agreements.
• Legal and Regulatory Authorities: We may disclose personal data where required by law, court order, or lawful request from a Nigerian regulatory authority, including NITDA, NAFDAC, or the Medical and Dental Council of Nigeria.
• Emergency Services: In a genuine medical emergency, we may share necessary information with emergency responders to protect your life or safety.
• Business Transfers: In the event of a merger, acquisition, or sale of CareVille's assets, user data may be transferred to the acquirer, subject to equivalent data protection obligations. We will notify you before any such transfer takes effect.

In all cases of data sharing, we ensure that appropriate contractual safeguards are in place.

7. COOKIES AND TRACKING TECHNOLOGIES

The CareVille mobile application may use cookies, mobile identifiers, and similar tracking technologies to:

• Maintain your session and authentication state.
• Analyse usage patterns to improve Platform performance.
• Remember your preferences and settings.

You may control tracking preferences through your device settings. Disabling certain tracking technologies may affect Platform functionality. We do not use tracking technologies for targeted third-party advertising.

8. DATA SECURITY

We implement appropriate technical and organisational security measures to protect your personal data against unauthorised access, disclosure, alteration, or destruction. These measures include:

• End-to-end encryption for data in transit using TLS 1.2 or higher.
• Encryption of sensitive data at rest, including health records.
• Role-based access controls ensuring only authorised personnel access personal data.
• Multi-factor authentication for administrative access to data systems.
• Regular security audits, penetration testing, and vulnerability assessments.
• Secure, reputable cloud infrastructure compliant with international security standards.

While we take all reasonable precautions, no method of electronic transmission or storage is 100% secure. We cannot guarantee absolute security. In the event of a data breach that poses a risk to your rights and freedoms, we will notify you and, where required, NITDA within 72 hours of becoming aware of the breach.

9. DATA RETENTION

We retain your personal data only for as long as necessary to fulfil the purposes for which it was collected, or as required by applicable law. Our retention periods are as follows:

• Medical and clinical records: Minimum of six (6) years from the date of last service, in accordance with Nigerian medical records standards and applicable health legislation.
• Account data: Retained for the duration of your active account and for three (3) years following account closure.
• Payment and transaction records: Retained for seven (7) years from the date of transaction, in accordance with Nigerian tax and financial records obligations.
• Communications and support records: Retained for three (3) years from the date of the communication.
• Usage logs and technical data: Retained for twelve (12) months, after which they are anonymised or deleted.

When data is no longer required, it is securely deleted or irreversibly anonymised. Data subject to an active legal dispute will be retained until the dispute is finally resolved.

10. INTERNATIONAL DATA TRANSFERS

Your data may be stored or processed on servers located outside Nigeria, including within the European Economic Area (EEA) or other jurisdictions where our cloud service providers operate.

Where data is transferred outside Nigeria, we ensure appropriate safeguards are in place, including:

• NDPR-compliant data transfer agreements with recipient organisations.
• Standard Contractual Clauses (SCCs) approved under the GDPR, where applicable.
• Transfers only to countries or organisations that provide an adequate level of data protection as assessed under the NDPR.

You may request details of the safeguards we apply to international transfers by contacting our DPO.

11. YOUR DATA PROTECTION RIGHTS

Subject to applicable law and verification of your identity, you have the following rights regarding your personal data:

• Right of Access: To obtain confirmation of whether we process your data and to receive a copy of it.
• Right to Rectification: To request correction of inaccurate or incomplete personal data.
• Right to Erasure: To request deletion of your personal data where it is no longer necessary for the purpose it was collected, or where you have withdrawn consent.
• Right to Restriction: To request that we limit processing of your data in certain circumstances.
• Right to Object: To object to processing based on legitimate interests.
• Right to Data Portability: To receive a copy of your data in a structured, commonly used, machine-readable format.
• Right to Withdraw Consent: To withdraw your consent to data processing at any time where processing is based on consent. Withdrawal does not affect the lawfulness of processing prior to withdrawal.

To exercise any of these rights, submit a written request to care@carevilleapp.com. We will acknowledge your request within five (5) business days and respond substantively within thirty (30) days. We may request proof of identity before processing your request.

If you are dissatisfied with our response, you have the right to lodge a complaint with NITDA, the Nigerian data protection supervisory authority, at: National Information Technology Development Agency (NITDA), Plot 28 Port Harcourt Crescent, Off Gimbiya Street, Area 11, Garki, Abuja.

12. CHILDREN'S PRIVACY

CareVille is not directed at children under thirteen (13) years of age, and we do not knowingly collect personal data directly from children in this age group without verifiable parental or guardian consent. Where a parent or guardian creates an account for a dependent minor, they assume responsibility for ensuring appropriate consent has been given.

Where applicable Nigerian law permits a minor above a specified age to independently consent to specific health services (such as reproductive or mental health services), we may process such data in compliance with those provisions.

If you believe that a child's data has been collected without appropriate consent, please contact us at care@carevilleapp.com and we will take appropriate action.

13. AUTOMATED DECISION-MAKING

CareVille may use automated processes for purposes such as fraud detection and platform security monitoring. These systems do not make decisions that produce significant legal effects on individual users without human review. If you believe an automated decision has adversely affected you, you have the right to request human review by contacting care@carevilleapp.com.

14. CHANGES TO THIS PRIVACY POLICY

We may update this Privacy Policy from time to time to reflect changes in our practices, technology, or applicable law. For minor, non-material changes, we will update the "Last Updated" date at the top of this Policy. For material changes (particularly those affecting how we use health data or your rights), we will notify you via in-app notification or email at least fourteen (14) days before the changes take effect and will request your renewed consent where required by applicable law.

We encourage you to review this Policy periodically. Continued use of the Platform following notification of material changes constitutes acceptance only where a consent mechanism has been provided and actioned by you.

15. CONTACT INFORMATION

For all privacy-related enquiries, requests, or complaints, please contact:

Data Protection Officer, CareVille Technologies Limited
Address: 1 O.G Street Behind St Fidelis Catholic Church, Aduwawa, Benin City, Edo State, Nigeria
Email: care@carevilleapp.com