1. Addressing Privacy

Health Legacy Africa (HLA) is committed to protecting the privacy of all individuals whose information we handle. This Global Privacy Policy (“Policy”) explains how we collect and use personal data in connection with our clinical research and healthcare solutions, including services that support clinical trials and medical research studies for pharmaceutical companies, healthcare institutions, and research sponsors (“Sponsors”).

Both “personal data” and “personal information” refer to data that identifies or relates to an identifiable living person.

Under data protection laws, a “controller” determines how and why personal data is processed, while a “processor” processes data on behalf of the controller. In some instances, HLA acts as a controller, while in others, we act as a processor on behalf of our clients. Throughout this Policy, we clarify our role to help you understand your rights and our responsibilities regarding your personal data.

HLA complies with all applicable international and local data protection regulations, including but not limited to Nigeria’s Data Protection Regulation (NDPR) 2019, the Nigeria National Health Act 2014 (NHA 2014), and the confidentiality standards of Good Clinical Practice (GCP).

To help you navigate this Policy:

  • Section 2 details the types of personal information HLA handles and its purposes.
  • Section 3 provides general information on data protection, your rights, and our obligations in relation to sharing personal data internationally.

Additional privacy terms may apply for certain services, such as specific privacy notices for research participants. If alternative terms are provided, they will govern the processing of data in that context.

If you do not provide us with the necessary personal data, we may be unable to offer certain services or respond to your inquiries. We will always inform you when personal data is required for contractual, legal, or operational reasons.

2. What Personal Information Does HLA Handle and for What Purposes?

2.1 Website Visitors and Mobile Application Users

HLA’s websites and mobile applications collect personal data when users interact with us, such as subscribing to updates, requesting information, or using digital platforms that support research activities.

Personal data collected may include:

  • Name, email address, employer, and occupation for newsletter subscriptions and event registrations.
  • IP address, browser type, and device information to improve website functionality and security.
  • Cookies and analytics data to enhance user experience and tailor content.
  • Contact details and professional information for those applying for research collaborations, employment, or trial participation.

HLA’s websites and apps may use cookies to enhance performance and personalize content. Users can opt-in or manage their cookie preferences based on regulatory compliance requirements.

2.2 Potential Employees

HLA processes job applicants’ personal data as a controller to assess qualifications, manage recruitment, and comply with employment laws. Data collected includes:

  • Work history, qualifications, CVs, and references.
  • Identification documents and background verification (where legally permitted).
  • Diversity information (if required for compliance purposes).

2.3 Investigators, Clinical Site Staff, and Healthcare Professionals (HCPs)

We collect and process information about clinical trial investigators, research site teams, and healthcare professionals to facilitate clinical trials and medical research. This may include:

  • Names, contact details, professional credentials, and experience.
  • Research participation history and trial performance data.
  • Data for regulatory compliance and trial operations.

2.4 Participants in HLA Patient Databases

HLA maintains patient recruitment databases to identify individuals who may be eligible for clinical trials. Data collected includes:

  • Medical history, health conditions, genetic data, and treatment preferences (with explicit consent).
  • Contact details for follow-up on relevant studies.
  • Voluntary registration data submitted through our platforms.

2.5 Clinical Trial Participants at HLA-Managed Sites

For clinical trials conducted at HLA-affiliated study sites, we collect and process:

  • Health information, medical treatment data, and participation records.
  • Patient feedback, trial progress reports, and compliance data.
  • Data shared with study sponsors for regulatory submissions (under strict confidentiality protocols).

2.6 Clients and Business Representatives

We collect information about individuals representing sponsors, partners, and clients to facilitate research collaboration. This includes:

  • Contact details, professional role, and business-related interactions.
  • Data necessary for contract execution and service delivery.

2.7 Vendors and Service Providers

For vendors working with HLA, we collect:

  • Business information, contractual details, and compliance records.
  • Financial and payment information for transactions.

3. More Information

3.1 International and Third-Party Data Transfers

HLA may transfer personal data to international partners, sponsors, and service providers. These transfers comply with applicable data protection laws, using safeguards such as:

  • Standard contractual clauses approved by regulatory authorities.
  • Technical and organisational measures to protect sensitive data.

3.2 Legal Basis for Processing Your Personal Information

HLA processes personal data based on:

  • Your consent (e.g., for trial participation or marketing communications).
  • Contractual obligations (e.g., delivering research services).
  • Legitimate interests (e.g., improving our services and ensuring security).
  • Legal compliance (e.g., meeting regulatory requirements).

3.3 Your Data Rights

Depending on applicable laws, you may have rights such as:

  • Accessing your personal data.
  • Requesting corrections or deletions.
  • Restricting or objecting to processing.
  • Withdrawing consent (where applicable).

3.4 Data Retention and Security

HLA retains personal data only as long as necessary for regulatory, operational, or contractual purposes. We implement robust security measures to safeguard data against unauthorised access or misuse.

3.5 Inquiries, Complaints, and Contact Details

For questions, complaints, or to exercise your rights, contact HLA’s Data Protection Officer (DPO):

  • By Mail:
    Data Protection Officer
    Health Legacy Africa (HLA)
    Smithfield Square, High St., London N8 7FJ, United Kingdom.
  • By Email:
    privacy@healthlegacyafrica.com

3.6 Policy Updates

This Policy may be updated periodically to reflect changes in laws, regulations, or operational practices. Material changes will be communicated when necessary.

Last Updated: March 2025.