SHERIFAT AKINTOBI FOUNDATION

Menu
DONATE

Privacy Policy

Sherifat Akintobi Medical Foundation (SAMEDICAL FOUNDATION) · samedicalfoundation.org · Effective date: 12/10/2026 · Last updated: 14/10/2026

1. Introduction

Sherifat Akintobi Medical Foundation (“SAMEDICAL FOUNDATION”, “we”, “us” or “our”) is a non-profit healthcare organisation in Nigeria. We provide free medical outreaches, preventive healthcare, health education and community-based support to underserved communities.

We respect your privacy and are committed to protecting your personal data. This Privacy Policy explains what personal data we collect, why we collect it, how we use and protect it, who we share it with, how long we keep it, and the rights you have under the Nigeria Data Protection Act, 2023 (the “NDPA”), the NDPA General Application and Implementation Directive, 2025, and other applicable Nigerian data protection laws (together, the “Data Protection Laws”).

Please read this policy carefully. Where the law requires your consent for something, we will ask for it separately and clearly.

2. Who We Are

For the purposes of the Data Protection Laws, SAMEDICAL FOUNDATION is the data controller of the personal data described in this policy.

  • Registered name: SHERIFAT AKINTOBI MEDICAL FOUNDATION
  • Address: 4 Abdulrahim Babaita Street, Dawaki Extension. FCT, Abuja, Nigeria
  • Email: info@samedicalfoundation.org
  • Phone: +234-811-111-4069
  • Data Protection Officer / privacy contact: SAMEDICAL FOUNDATION

3. Scope of This Policy

This policy applies to personal data we collect through our website, samedicalfoundation.org (the “Website”), and through our dealings with visitors, donors, volunteers, sponsors, fundraisers, partners and newsletter subscribers.

It does not cover:

  • Health information collected from patients at our outreaches and clinics. That information is collected under separate registration and consent forms, and is explained in Section 8.
  • Third-party websites that our Website links to (see Section 17).

4. Personal Data We Collect

4.1 Information you give us

  • Enquiries: your name, email address, phone number and the content of your message when you use our contact form or email or call us.
  • Newsletter: your name and email address when you subscribe to our updates.
  • Volunteering: your name, contact details, profession or skills, qualifications and professional registration details (where you volunteer in a clinical role), availability and location.
  • Donations: your name, contact details, donation amount and date, and payment reference. We do not store your full card details (see Section 7).
  • Sponsorship, fundraising and partnership enquiries: your name, organisation, role, contact details and details of your proposal or campaign.

4.2 Information we collect automatically

When you visit the Website, we and our service providers may automatically collect technical information such as your IP address, approximate location, device and browser type, operating system, pages visited, time spent on pages, referring website, and date and time of visit. We collect this through cookies and similar technologies (see Section 15).

4.3 Information from other sources

We may receive limited information from payment processors (for example, confirmation that your donation was successful), from social media platforms when you interact with our pages, and from partners or referrers who introduce you to us.

4.4 Sensitive information

We do not ask you to provide health information or other sensitive information through the Website. Please do not include medical details, identification numbers or similar information in contact forms or emails unless we have specifically asked for it. If you do, we will treat it as confidential and use it only to respond to you.

5. How We Use Your Personal Data and Our Lawful Bases

We process personal data only where we have a lawful basis under the NDPA. The main purposes and bases are:

  • Responding to enquiries and requests: our legitimate interests in communicating with you, or steps you ask us to take.
  • Sending newsletters, campaign updates and event invitations: your consent, which you can withdraw at any time.
  • Managing volunteer applications and coordinating outreach activities: our legitimate interests, and steps taken at your request before you volunteer with us.
  • Processing donations, issuing acknowledgements and keeping financial records: completing the donation you have chosen to make, and our legal obligations (including accounting, tax and anti-money-laundering requirements).
  • Managing partnerships, sponsorships and fundraising activities: our legitimate interests and our agreements with you.
  • Operating, securing and improving the Website: our legitimate interests in running a safe and effective site and, for non-essential cookies, your consent.
  • Reporting on our impact to donors, partners and regulators: our legitimate interests, using aggregated or anonymised information wherever possible.
  • Publishing photographs, video and beneficiary stories: your consent (see Section 9).
  • Protecting our rights, preventing fraud or misuse, and complying with the law: our legal obligations and legitimate interests.

We do not sell your personal data. We do not use your personal data for automated decision-making that has legal or similarly significant effects on you. If we want to use your data for a new purpose that is not compatible with the ones above, we will tell you first and, where required, ask for your consent.

Where we rely on your consent, you may withdraw it at any time by contacting us using the details in Section 19 or by using the “unsubscribe” link in our emails. Withdrawing consent does not affect the lawfulness of processing carried out before you withdrew it.

We will only send you newsletters and promotional messages if you have subscribed or otherwise agreed to receive them. You can opt out at any time and we will stop within a reasonable time. We may still send you essential messages, such as a donation receipt or a reply to your request.

7. Donations and Payments

Donations made through the Website are processed by third-party payment providers [for example, Paystack or Flutterwave — confirm and list the providers you use]. These providers collect and process your payment details under their own privacy policies. We do not see or store your full card number, expiry date, CVV or PIN.

We receive confirmation of your payment, which includes your name, the amount, the date and a payment reference. If you donate by bank transfer, we see the account name and the details needed to reconcile and acknowledge your gift. We keep donation records to meet our financial reporting and legal obligations.

We will publicly acknowledge a donor only with that donor’s consent.

8. Health Information and Our Outreach Programmes

Information about a person’s health is sensitive personal data and receives a higher level of protection under the NDPA.

When you attend one of our medical outreaches or clinics, we collect health information directly from you (or your parent or guardian) under a separate registration and consent form, and we explain at that point how it will be used. In general:

  • We use health information only to provide care, referrals and follow-up, to keep patients safe, and to run our programmes.
  • We process it only on a lawful basis permitted for sensitive data, such as your explicit consent, protecting someone’s vital interests in an emergency, or the provision of healthcare by professionals who are bound by a duty of confidentiality.
  • Access is limited to authorised doctors, nurses, pharmacists and other personnel who need it and are bound by confidentiality.
  • We do not use health information for marketing or fundraising, and we do not sell it.
  • We share it only with your consent (for example, to refer you to another facility), where the law requires it, or to protect someone’s life or safety.
  • Reports to donors, partners and regulators use aggregated or de-identified data that does not identify you.

9. Photographs, Video and Beneficiary Stories

We may take photographs and videos at our events and outreaches, and share stories of the people we serve, to report on our work, raise awareness and attract support.

  • We seek consent before taking and publishing identifiable images or stories, or we display clear notices at the event where that is not practicable.
  • We do not publish an image or story that reveals a person’s health condition without that person’s explicit consent.
  • For children, we need the consent of a parent or guardian.
  • You can withdraw your consent to future use at any time by contacting us. We will remove the material from our Website and our own channels within a reasonable time, although we cannot recall printed materials or content already shared by others.

10. Children’s Privacy

Our Website is not directed at children under 18, and we do not knowingly collect personal data from children through it without the consent of a parent or guardian. If you believe a child has given us personal data through the Website, please contact us and we will delete it.

In our programmes, including child health, outreach and sponsorship activities, we collect a child’s personal data only with the consent of a parent or guardian, and we share or publish it only with that consent and with appropriate safeguards.

11. Who We Share Your Personal Data With

We share personal data only where necessary, and only with:

  • Service providers that help us run the Website and our activities, such as website hosting and maintenance, email and newsletter platforms, analytics, payment processors, IT support, accountants and auditors. They may process your data only on our instructions and under agreements that require them to protect it.
  • Partners and collaborators, such as healthcare institutions, government agencies, community leaders, corporate partners and donors, where this is needed to deliver a programme, make a referral or report on our work. We share identifiable information only with your consent or where the law allows, and otherwise use aggregated or anonymised information.
  • Professional advisers, such as lawyers, auditors and insurers.
  • Courts, regulators and law enforcement, where we are required by law or where it is necessary to protect rights, safety or property.

We do not sell or rent personal data to anyone.

12. Transfers Outside Nigeria

Some of our service providers, such as hosting, email or analytics providers, may store or process data outside Nigeria. Where we transfer personal data out of Nigeria, we do so in line with the NDPA: only to a country or organisation that provides an adequate level of data protection, or where appropriate safeguards (such as contractual protections) are in place, or where another basis permitted by law applies, such as your consent.

13. How Long We Keep Your Personal Data

We keep personal data only for as long as we need it for the purposes described in this policy, including to satisfy legal, accounting and reporting requirements. Our usual retention periods are:

  • Enquiries and correspondence: up to [24 months] after our last contact with you.
  • Newsletter subscriptions: until you unsubscribe or withdraw consent. We keep a minimal record so that we respect your opt-out.
  • Volunteer records: for the duration of your involvement and [2 years] afterwards, unless you ask us to delete them sooner.
  • Donation and financial records: for the period required by Nigerian accounting, tax and regulatory laws.
  • Health records from outreaches: as stated in the consent form you completed, and in line with applicable medical record-keeping requirements.
  • Website analytics data: for the retention period set in our analytics tool [state period].

When we no longer need personal data, we delete it or anonymise it securely.

14. How We Protect Your Personal Data

We use appropriate technical and organisational measures to protect personal data against loss, misuse, unauthorised access, alteration and disclosure. These include encrypted connections (HTTPS) on the Website, access controls and strong authentication for administrator accounts, regular software and plugin updates, backups, confidentiality undertakings for our staff and volunteers, and limiting access to people who need it.

No method of transmission or storage is completely secure, so we cannot guarantee absolute security. If a personal data breach occurs that is likely to put your rights and freedoms at risk, we will notify the Nigeria Data Protection Commission (NDPC) within 72 hours of becoming aware of it, as required by law. If the breach is likely to result in a high risk to you, we will also notify you without undue delay and tell you what steps you can take to protect yourself.

15. Cookies and Similar Technologies

Cookies are small text files stored on your device when you visit a website. We use them, and similar technologies, as follows:

  • Strictly necessary cookies keep the Website secure and working, for example by remembering your cookie choices. These do not require consent.
  • Functional cookies remember your preferences and help forms and features work properly.
  • Analytics cookies help us understand how visitors use the Website so that we can improve it [for example, Google Analytics — confirm the tools you use]. Where required, we use these only with your consent.
  • Third-party cookies may be set by embedded content such as videos, maps or social media buttons. These providers have their own privacy policies.

You can manage or delete cookies through your browser settings [and through our cookie banner, where available]. Blocking some cookies may affect how the Website works.

16. Your Rights

Under the NDPA, you have the following rights regarding your personal data:

  • Access and information: to confirm whether we process your personal data, to receive a copy of it, and to be told how and why we use it.
  • Rectification: to have inaccurate or incomplete data corrected.
  • Erasure: to ask us to delete your data in the circumstances the law allows.
  • Restriction: to ask us to limit how we use your data in certain circumstances.
  • Objection: to object to processing based on our legitimate interests, and to object at any time to direct marketing.
  • Data portability: to receive your data in a structured, commonly used, machine-readable format and to have it transferred to another controller where possible.
  • Withdrawal of consent: to withdraw consent at any time, where we rely on it.
  • Automated decisions: not to be subject to decisions based solely on automated processing that have legal or similarly significant effects on you.
  • Complaint: to lodge a complaint with the Nigeria Data Protection Commission (NDPC), Abuja, Nigeria (www.ndpc.gov.ng). We would appreciate the chance to address your concerns first.

To exercise any of these rights, contact us using the details in Section 19. We may need to verify your identity before acting on a request. We will respond without undue delay and, in any event, within one month of receiving a verified request, unless we tell you that we need more time and explain why. We do not charge a fee unless a request is clearly unfounded or excessive. In some cases we may be unable to comply fully, for example where we must keep information to meet a legal obligation, and we will explain our reasons if so.

The Website may contain links to third-party websites, social media platforms and services, including our partners and payment providers. We do not control these third parties and are not responsible for their privacy practices. We encourage you to read their privacy policies before sharing any personal data with them.

18. Changes to This Policy

We may update this policy from time to time to reflect changes in our activities or in the law. We will post the revised version on this page and update the “Last updated” date at the top. If we make significant changes, we will take reasonable steps to tell you, for example by a notice on the Website or by email to subscribers. This policy is governed by the laws of the Federal Republic of Nigeria.

19. Contact Us

If you have questions about this policy, want to exercise your rights, or wish to raise a concern about how we handle your personal data, please contact:

  • Data Protection Officer: Sherifat Akintobi Medical Foundation
  • Address: 4 Abdulrahim Babaita Street, Dawaki Extension. FCT, Nigeria
  • Email: info@samedicalfoundation.org
  • Phone: +234-811-111-4069