Privacy notice
Version 2026-08. This notice explains what MedGate does with personal data and how you can exercise your rights.
Who controls your data
MedGate is operated by Digital Public Infrastructure Platforms PBC, the data controller for the processing described here. MedGate monitors online medicine sellers and publishes a public register of their compliance standing.
NDPC registration status: Registration in progress.
What we process and why
Each activity below carries a lawful basis under section 25 of the NDPA. Our full record of processing activities is maintained internally and is available to the NDPC on request.
Public register of online medicine sellers
Public interestWe publish the name, storefront and compliance standing of businesses that sell medicines to the public in Nigeria. This covers business information and, where a pharmacy publishes it, the name of a superintendent pharmacist.
Automated compliance scans and change monitoring
Public interestWe fetch publicly available pages from storefronts, apply the regulatory checklist and keep a record of what changed between scans.
Discovery of unlicensed sellers
Public interestWe collect public signals such as certificate records, marketplace listings and social storefronts to find sellers that are not on the register.
Investigations and evidence
Legal obligationWe capture screenshots and page content when a storefront appears to offer prohibited or prescription-only medicines. Evidence is hashed, timestamped and held for enforcement.
Self-check submissions
ConsentWhen a pharmacy asks us to email a readiness report or to arrange an analyst review, we store the contact email and business name it gives us.
Disputes and data subject requests
Legal obligationWe store the contact details and the message you send so we can investigate and reply.
Staff accounts and audit log
Legal obligationWe record who signed in and which regulatory action they took. The audit log is append-only.
Your rights
We answer data subject requests within 30 days of receiving them. We will ask you to confirm your identity first so we release data only to the person entitled to it.
- Access
- Ask for a copy of the personal data we hold about you.
- Rectification
- Ask us to correct information that is wrong or out of date.
- Erasure
- Ask us to delete personal data where we have no lasting legal reason to keep it.
- Restriction
- Ask us to pause processing while a question about accuracy or lawfulness is settled.
- Portability
- Ask for the data you gave us in a portable format.
- Objection
- Object to processing we carry out on the basis of legitimate interest.
To exercise a right, email dpo@dpip.ai with the words "data subject request" and tell us which right you want to use. We log every request and track it against the 30 day deadline.
How long we keep data
Each category has a defined retention window recorded in our processing register. Self-check contact details are kept for a short period and then removed. Register entries and scan history are kept for as long as the seller is monitored. Enforcement evidence and the audit log are kept for the longer period required for legal and regulatory purposes and are held append-only.
Consent
Where we rely on consent, such as emailing a self-check report, we record the consent, the purpose and the version of this notice that applied. You can withdraw consent at any time by emailing the Data Protection Officer. Withdrawal applies from the moment we receive it.
Transfers outside Nigeria
Some of our infrastructure providers process data outside Nigeria. We transfer personal data only to a jurisdiction the NDPC has determined offers an adequate level of protection, under approved safeguards such as standard contractual clauses or binding corporate rules, or with your explicit consent.
Data breaches
If a personal data breach occurs we notify the NDPC without undue delay and, where feasible, within 72 hours of becoming aware of it. Where the breach carries a real risk of harm to you, we tell you directly in plain language.
Contact and complaints
Data Protection Officer: Data Protection Officer, dpo@dpip.ai. You also have the right to lodge a complaint with the Nigeria Data Protection Commission if you believe your data has been handled unlawfully.