GileaM privacy notice
Last updated: 25 November 2026
At Gileam, we consider your privacy as paramount and are thus committed to protecting and respecting your privacy. We are committed to being transparent about how we collect, process, share, and manage data about you (our customers and other natural persons where applicable).
This Notice describes our approach to handling your personal data and explains your rights in relation to our collection, use, storage, transfer, and sharing of that data. Your personal data may be collected by us, our affiliates, and authorised service providers in the course of providing our App, website, and related services to you across our service channels and touchpoints.
This privacy notice is provided in a layered format so you can click through to the specific areas set out below.
Important information and who we are
Purpose of this privacy notice
This privacy notice aims to give you information on how Gileam Technologies Limited (“Gileam”, “we”, “us” or “our”) collects and processes your personal data through your use of our App, website and related services, including any data you may provide when you create an account, request healthcare services for yourself or a beneficiary, coordinate with Healthcare Providers, make or receive payments, complete identity checks, contact support, use linked third-party tools or services made available through the App, or otherwise use our services, as well as personal data we generate or infer from such use. Gileam is the data controller for the personal data described in this notice except where this notice, a separate notice, or applicable law states that another party is the data controller.
It is important that you read this privacy notice together with any other privacy notice we may provide on specific occasions when we are collecting or processing personal data about you, so that you are fully aware of how and why we are using your data. This privacy notice supplements other notices and privacy notices and is not intended to override them.
Third-party links
This App may include links to third-party websites, plug-ins, and applications, and may also enable you to access third-party tools or services from within or alongside our App. Clicking on those links or enabling those connections, submitting a request to a third party, or using a third-party tool made available through our services may allow third parties to collect, retrieve or process data about you. We do not control these third-party websites, tools or services and are not responsible for their privacy practices and procedures. When you leave our App, use a third-party service, or interact directly with a third party, we encourage you to read the privacy notice and terms of that third party. Please note that this section concerns your voluntary navigation to or interaction with third-party sites and tools. It is separate from, and should be read alongside, the Third-Party Processing section below, which sets out the categories of third parties with whom we actively share your personal data as part of delivering our services.
The data we collect about you
In the course of providing services to you through our App, websites and related channels, we collect information you provide us directly, information provided to us on your behalf, information generated through your use of the services, information obtained from your device and browser, and information received from third parties such as banking or financial institution partners, payment/escrow partners, identity verification and KYC providers, healthcare providers, medical centres, laboratories, communications providers, support providers, publicly available sources and regulatory sources, where permitted by law. The information we collect may include, but is not limited to:
- Identity Data, such as name, gender, date of birth, nationality, government-issued identifier details where required for verification, and emergency contact or beneficiary details where you book or manage services for another person.
- Health Data, such as blood type, genotype, health status, symptoms, medical history, prescriptions, laboratory results, diagnostic reports, appointment notes, health-related uploads and other information you provide or authorise us or a Healthcare Provider to process in connection with healthcare service requests.
- Contact Data, such as residential/contact address, email address and telephone numbers
- Financial Data, such as bank account details, payment card or wallet details, transaction records, escrow/payment references, billing details, BVN or other verification information where required for payments, fraud prevention, AML, KYC or regulatory compliance.
- Technical Data, such as internet protocol (IP) address, device identifier, your login data, browser type and version, time zone setting and location, browser plug-in types and versions, operating system, and other technology on the devices you use to access this App or website.
- Booking Data, such as information on booking consultations, procedures, referrals or other healthcare services, including time, date, location, provider, beneficiary, appointment status and related coordination records.
- Profile Data, such as your username and password, account settings, preferences, beneficiary profiles, feedback, survey responses, support history and records relevant to risk, fraud, AML, KYC or compliance review.
- Usage Data, such as information about how you use our App, products, and services, including pages or screens viewed, features used, clickstream data, session information, diagnostics, crash reports and logs.
- Marketing and Communication Data, such as your preferences in receiving marketing from us and our third parties, and your communication preferences, your consent choices, opt-out records, and your preferences for operational, transactional, and compliance-related communications.
We collect Sensitive Personal Data about you, only where it is necessary for the healthcare facilitation services you request, where you have provided explicit consent, where processing is necessary for medical diagnosis, healthcare delivery or management of health services by or under the responsibility of a Healthcare Provider, or where another lawful basis under applicable data protection law applies. Unless expressly requested and legally permitted for a healthcare or compliance purpose, we do not collect other sensitive information such as race, religious or philosophical beliefs, sexual orientation, political opinions, trade union membership, criminal convictions and offences.
If you fail to provide personal data
Where we are required to collect personal data, or need it to provide our services to you, and you fail to provide that data when requested, we may be unable to provide the service to you.
How is your personal data collected?
We use different methods to collect data from and about you, including through:
Direct interactions
You may give us your data by filling out forms, creating or updating your account, providing health data and consultation data, uploading health-related documents, requesting healthcare services, booking or managing services for a beneficiary, contacting support, responding to surveys, submitting a complaint or by corresponding with us by phone, email, chat, social media or other available means. This includes personal data you provide when you:
- apply for or request our products or services;
- create an account on our App;
- request marketing materials or communication to be sent to you;
- make payments using, receive payouts, or use payment features through our App, or through our payment partners; or
- give us feedback, make a complaint, escalate a privacy concern or contact us.
Indirect interactions
Where you book a consultation or other healthcare service on behalf of another individual, you represent and warrant that you have the necessary authority or consent to submit their personal data and, where applicable, sensitive personal data, to us for that purpose, and you agree to indemnify us against any claim arising from your failure to obtain such consent. We may also receive personal data about you or a beneficiary from Healthcare Providers, medical centres, laboratories, pharmacies, payment or escrow partners, banks, identity/KYC providers, fraud-prevention partners, communications providers, support providers, regulators and other persons involved in fulfilling or verifying the requested service, where permitted by law.
Automated technologies or interactions
As you interact with our App, we will automatically collect Technical Data and Usage Data about your equipment, browsing actions and patterns, including logs, device identifiers, approximate location derived from your device or network, diagnostics and security events. We collect this personal data by using cookies and other similar technologies, subject to any consent or preference-management requirements that apply.
Third parties or publicly available sources
We may also receive and use personal data about you from various third parties, including Healthcare Providers, medical centres, laboratories, pharmacies, identity verification and security providers, payment or escrow partners, banks and other financial institutions, insurers and insurance intermediaries, communications service providers, analytics, hosting, cloud storage and infrastructure providers, fraud prevention and risk management providers, marketing partners where you have consented or where otherwise permitted by law, and publicly available, regulatory, or law enforcement sources.
How we use your personal data
We will only use your personal data when the law allows us to. Depending on the context, we will use your personal data in the following circumstances:
- Where processing is necessary to perform a contract with you or to take steps at your request before entering into a contract, including account creation, healthcare service requests, beneficiary bookings, provider coordination, support, payments and service communications.
- Where we need to comply with a legal obligation, including identity verification, AML/KYC, fraud prevention, tax, accounting, healthcare, regulatory reporting, law-enforcement or court-order obligations.
- Where processing is necessary to protect your vital interests or those of another individual.
- Where processing is necessary for our legitimate interests or those of a third party and your interests, rights and freedoms do not override those interests.
- Where the processing is necessary for medical diagnosis, medical care, healthcare delivery, provider coordination, management of health services, public health or community welfare, including where processing is carried out by or under the responsibility of a Healthcare Provider or other person subject to appropriate confidentiality obligations.
- Where applicable law otherwise permits the processing, including where processing is necessary for reasons of substantial public interest, the prevention or detection of unlawful activity, or the establishment, exercise, or defence of legal claims.
Purposes for which we will use your personal data
We have set out below, in a table format, a description of the main ways we plan to use your personal data, including the purposes for which we disclose it to third parties, and of the legal bases we rely on to do so. We have also identified what our legitimate interests are, where appropriate.
Note that we may process your personal data on more than one lawful ground, depending on the specific purpose for which we are using your data. Please contact us if you need details about the specific lawful ground on which we are relying to process your personal data, where more than one ground has been set out in the table below.
| Purpose/Activity | Lawful basis |
|---|---|
| Purpose/Activity To provide products and services which you have requested, and to conduct business with you (for example, to register you as a new customer, to process your application, to manage your account, to tell you about important changes to our services, to process and respond to your enquiries, complaints and issues), to update and improve your records). | Lawful basis (a) Performance of a contract with you |
| Purpose/Activity To facilitate the booking, scheduling, and recording of consultations between you and the healthcare providers, including where booked for yourself or on behalf of a third party. | Lawful basis Processing is carried out for purposes of medical care or community welfare, and undertaken by or under the responsibility of a professional or similar service provider owing a duty of confidentiality. |
| Purpose/Activity To hold, manage and disburse funds in escrow on your behalf for the payment of consultations or care services booked through the App, including verifying payment, releasing funds to healthcare providers upon completion of services and processing refunds where applicable. | Lawful basis (a) Performance of a contract with you (b) Compliance with a legal obligation |
| Purpose/Activity To improve customer service, and to analyse how our App and services are used, troubleshoot issues, monitor performance, develop and improve features and decide if a product or service is suitable for your needs. | Lawful basis Legitimate interests (we have a legitimate interest in providing quality customer service, as this allows us to maintain good client relationships and to deal with queries and complaints effectively. Also, we have a legitimate interest in ensuring that we provide our customers with appropriate products and services, to ensure both appropriate risk management and good client relationship management). |
| Purpose/Activity To provide you with the appropriate level of service, to accommodate your specific individual needs and treat you fairly based on any vulnerability you may have, whether you have told us, or we believe it necessary to record, to improve customer service and ensure equal treatment, protect vulnerable customers, or safeguard your economic well-being. | Lawful basis (a) Vital Interest (b) Legitimate interests (we have a legitimate interest in providing quality customer service, as this allows us to maintain good client relationships and to deal with queries and complaints effectively). |
| Purpose/Activity To carry out operational and administrative functions (e.g. to maintain our own accounts and records, operate information technology systems, host and secure our infrastructure, to carry out billing-related and payments administration, deliver email, SMS, push notifications and one-time passwords, manage claims or insurance related matters where applicable, and administer our business and internal reporting). | Lawful basis (a) Compliance with a legal obligation (to maintain certain statutory records) (b) Legitimate interests (we have a legitimate interest in running our business efficiently). |
| Purpose/Activity To share relevant information in respect of a prospective or actual sale, merger, acquisition, financing, reorganization or transfer involving Gileam, or any of its affiliates, or any part of its or their business, in each case subject to appropriate confidentiality measures. Where such a transaction results in your personal data being transferred to a third party, we will ensure that such transfer, is carried out in accordance with the Nigeria Data Protection Act 2023 and this Privacy Notice, and that you are notified of any material change to the manner in which your personal data is processed. | Lawful basis Legitimate interests (we have a legitimate interest in complying with due diligence requirements and being efficient in how we run the business). |
| Purpose/Activity Marketing: To tell you about products and services that may interest you (by email, phone, SMS, push notification, in-app message or other permitted channel in accordance with your preferences and applicable law). | Lawful basis (a) Consent (b) Legitimate interests (we have a legitimate interest in making our customers aware of our other services and offerings). |
Marketing
We respect your choices regarding the use of personal data, particularly for marketing and advertising purposes. Given the confidential nature of health data, the Company will not use health data for marketing purposes where doing so would breach its duty of confidentiality. Where required by law, we will obtain your consent before sending you third-party direct marketing communications.
You have the right to withdraw your consent to receive marketing communications at any time by contacting us or by using the unsubscribe or preference management options made available through our communication channels. The withdrawal of consent will not affect service-related, security, legal or other non-marketing communications that we are required to send in connection with your use of our services.
Promotional offers from us
We may use your Identity, Contact, Technical, Usage and Profile Data to form an opinion on what we think you may want or need, or what may be of interest to you. This is how we decide which products, services and offers may be relevant for you (we call this marketing).
We will send you marketing communications where you have given your consent to receive them. You may withdraw your consent or opt out of receiving such communications at any time by following the unsubscribe instructions provided in each message or by contacting us directly.
Third-party processing
We may share your personal data, where necessary and in accordance with applicable law, with the following categories of recipients, to provide services as requested.
- Healthcare providers, medical centres and laboratories, where necessary to provide healthcare-related services and manage your care;
- Payment partners, banks and other financial institutions, where necessary to process payments and facilitate financial transactions;
- Security and service providers, where necessary to protect our services, users and operations;
- Communications providers, including providers of email, SMS, voice calls, push notifications and one-time password services, where necessary to communicate with you and provide our services;
- Technology and service providers, including analytics, hosting, cloud and infrastructure providers, where necessary to operate, maintain and improve our services;
- Regulators, governmental authorities, law enforcement agencies, courts and dispute-resolution bodies, where disclosure is required or permitted by applicable law or is otherwise necessary to comply with legal or regulatory obligations;
- Prospective or actual investors, purchasers, transaction counterparties and their professional advisers, where necessary in connection with a proposed or completed corporate transaction, subject to applicable legal requirements; and
- Other third parties, where you have requested or authorised us to share your personal data, or where such sharing is necessary to provide a service you have requested.
Data sharing undertaken for the purposes of providing our services, complying with legal or regulatory obligations, protecting our services, or otherwise supporting our legitimate operations is not subject to marketing opt-out rights. Any sharing of personal data for direct marketing purposes will be carried out in accordance with the applicable consent requirements and your right to opt out of such communications.
Some third parties process personal data on our behalf and only in accordance with our instructions, while others may process personal data as independent controllers where you interact with them directly, use their services, or are redirected to their websites, applications or tools. In those cases, their own terms and privacy notices will also apply to their handling of your personal data.
Cookies
We may use cookies and similar technologies to enhance user experience, analyse App performance, support security, remember preferences, measure usage and provide tailored features. This enables the application to store information about your preferences or device usage and support App functionality.
Necessary cookies may be used to provide core App and website functionality. You can manage optional cookies and similar tracking technologies through your device settings, browser settings or App settings where available.
Note that disabling these features may impact your ability to access certain functionalities of the App.
Change of purpose
We will only use your personal data and sensitive personal data for the purposes for which we collected it, unless we reasonably consider that we need to use it for another reason and that reason is compatible with the original purpose. If you wish to get an explanation as to how the processing for the new purpose is compatible with the original purpose, please contact us.
If we need to use your personal data for an unrelated purpose, we will notify you and we will explain the legal basis that allows us to do so.
Please note that we may process your personal data without your knowledge or consent, where it is required or permitted by law.
International transfers
We may transfer, access or store your personal data outside Nigeria where necessary for storage, hosting, backup, support, payment processing, identity verification, security, analytics, communications or cross-border healthcare facilitation, including where you request or authorise us to coordinate services with Healthcare Providers, family members, laboratories, hospitals, pharmacies, payment partners or other recipients located outside Nigeria. International transfers may occur to countries where our service providers, Healthcare Providers or other recipients operate. When such international transfers occur, we will ensure that they are carried out in accordance with the Nigeria Data Protection Act 2023 and other applicable data protection laws, including by relying on adequacy decisions, standard contractual clauses, binding contractual safeguards, transfer risk assessments, explicit consent where appropriate, necessity for performance of a contract or healthcare service request, or another lawful transfer mechanism. We will take reasonable steps to ensure that recipients protect your personal data to a standard comparable to this Privacy Notice.
Data security
We have put in place appropriate security measures to prevent your personal data from being accidentally lost, used or accessed in an unauthorised way, altered or disclosed. In addition, we limit access to your personal data to those employees, agents, contractors and other third parties who have a business need to know. They will only process your personal data on our instructions, and they are subject to a duty of confidentiality.
If we become aware of a personal data breach affecting your personal data, we will assess the nature and likely consequences of the breach, take reasonable steps to contain and remediate it, document our response, and notify the Nigeria Data Protection Commission and affected data subjects where required by applicable law. Where direct notification is required, we will provide information about the nature of the breach, likely consequences, measures taken or proposed to address it, and contact details for further information, subject to any lawful restrictions.
We have put in place procedures to deal with suspected personal data breaches, including internal escalation, investigation, containment, remediation, record-keeping and notification to users, Healthcare Providers, processors, service providers or regulators where legally required or operationally appropriate.
Data retention
We will only retain your personal data for as long as reasonably necessary to fulfil the purposes for which we collected it, including for the purpose of satisfying any legal, regulatory, tax, accounting or reporting requirements. We may retain your personal data for a longer period in the event of a complaint or if we reasonably believe there is a prospect of litigation in respect of our relationship with you.
To determine the appropriate retention period for personal data, we consider the amount, nature and sensitivity of the personal data, the potential risk of harm from unauthorised use or disclosure of your personal data, the purposes for which we process your personal data and whether we can achieve those purposes through other means, and the applicable legal and regulatory requirements.
Indicatively, account and profile data are retained while your account remains active and for a reasonable period afterwards for support, audit, security, tax, accounting, regulatory and dispute-resolution purposes; Health Data and health-related uploads are retained only for as long as needed to facilitate the requested healthcare services, meet legal or professional obligations, resolve complaints or support provider coordination; transaction, payment, escrow, fraud, AML and KYC records are retained for the periods required or permitted by financial, tax, accounting, anti-money laundering and regulatory laws; support, complaint and data-subject request records are retained for as long as needed to respond, evidence our response and manage disputes; technical logs and security records are retained for security, diagnostics, fraud prevention and audit purposes; marketing preferences and opt-out records are retained to respect your choices; and anonymised or aggregated data that no longer identifies you may be retained and used indefinitely.
In some circumstances we will anonymise your personal data (so that it can no longer be associated with you) for research or statistical purposes, in which case we may use this information indefinitely without further notice to you.
Your legal rights
Subject to the conditions, limitations and exemptions under the Nigeria Data Protection Act 2023 and other applicable data protection laws, you have rights in relation to your personal data. You may:
- request access to your personal data and information about how we process it
- request correction of inaccurate or incomplete personal data
- request erasure of your personal data where the law permits
- object to processing of your personal data, including processing based on legitimate interests or direct marketing
- request restriction of processing of your personal data where the law permits
- request transfer or portability of your personal data where applicable
- withdraw consent at any time where we rely on consent, without affecting processing carried out before withdrawal
- lodge a complaint with the Nigeria Data Protection Commission or another competent supervisory authority, and escalate privacy concerns to us first if you would like us to try to resolve them
If you wish to exercise any of the rights set out above, ask a privacy question, submit a data-subject request, withdraw consent, opt out of marketing, report a suspected privacy issue or escalate a complaint, please contact our data-protection contact or Data Protection Officer using the details below. We may need to verify your identity and authority before responding, may request additional information where necessary, and will respond within the period required by applicable law. You may also use any in-App privacy request channel, support channel or email address that we designate for privacy requests.
Changes to privacy notice
Our Privacy Notice may be updated from time to time. We will post notice of such changes on this page and, if the changes are significant, we will provide a more prominent notice. We will also keep prior versions of this Privacy Notice in archive for your review.