DRAFT v0.1 — 11 November 2026 — Draft for discussion. Not legal advice. To be reviewed by Nigerian legal counsel before signature or publication.
This Data Processing Agreement (the "DPA") is Schedule 2 to the Master Services Agreement between {{COMPANY_LEGAL_NAME}} (the "Processor", operator of Velnova Health at velnovahealth.com) and the Hospital identified in the Order Form (the "Controller"). It applies to all personal data processed through the platform.
1.1 The Controller is the data controller and the Processor is the data processor for the purposes of the Nigeria Data Protection Act 2023 (the "NDPA").
1.2 Subject matter: the storage, viewing, reporting, delivery and verification of diagnostic imaging studies and related records, and — where the EMR module is subscribed — electronic medical record services, as described in the Master Services Agreement.
1.3 Nature and purpose: hosting and operating the platform so the Controller's authorised users can upload studies, report remotely, sign and deliver reports, and so reports can be verified.
1.4 Categories of data: patient identification and contact details; imaging studies (DICOM) and their metadata; clinical history and referral information; reports and all their versions; user account data for the Controller's staff; audit logs. Health data processed under this DPA is sensitive personal data under the NDPA.
1.5 Data subjects: the Controller's patients; the Controller's staff and clinicians; referring doctors.
1.6 Duration: the term of the Master Services Agreement, plus the exit and retention periods in the Retention & Exit Policy (Schedule 3).
2.1 The Processor will process personal data only on the Controller's documented instructions, which are: this DPA, the Master Services Agreement, and the Controller's use of the platform's functions by its authorised users.
2.2 If the Processor believes an instruction breaches the NDPA, it will inform the Controller promptly and may pause the affected processing. The Processor will inform the Controller if a legal obligation requires processing other than as instructed, unless prohibited by law.
3.1 The Processor will ensure that persons it authorises to process personal data are bound by confidentiality obligations.
3.2 Least-privilege boundary (by design): the Processor's platform administrators have no access to images or report content. Platform administration is limited to operational metadata — tenant and account administration, counts, statuses, storage volumes, sign-in and security events, and processing-queue state. The Processor will not open, read or use the Controller's clinical content except where the Controller expressly instructs it in writing for a specific support incident, and any such access will be logged.
The Processor will implement and maintain technical and organisational measures appropriate to sensitive health data, including:
5.1 The Controller authorises the Processor to use the following sub-processors for the purposes stated:
| Sub-processor | Purpose | Data involved |
|---|---|---|
| [Hosting provider — name and location to be inserted] | Cloud infrastructure and storage | All platform data, encrypted |
| Deepgram, Inc. | Speech-to-text for report dictation — only where the Controller has enabled dictation | Dictated audio for the report field being dictated |
| [Messaging provider — name to be inserted] | WhatsApp/SMS/email delivery of notifications | Recipient phone number/email and message content; messages carry no clinical content (for example, a "report ready" message contains only collection information and the report verification code) |
| [Payment provider(s) — e.g. Paystack / Flutterwave, to be confirmed] | Subscription billing | Hospital billing contact and payment data (no patient data) |
5.2 Changes: the Processor will give the Controller not less than [30] days' notice of any new or replacement sub-processor. If the Controller objects on reasonable data-protection grounds within that period, the Parties will discuss in good faith; if no solution is found, the Controller may terminate the affected Services on notice, and Schedule 3 will apply.
5.3 The Processor will bind each sub-processor by written terms no less protective than this DPA and remains responsible for its sub-processors' performance.
6.1 The Processor will notify the Controller of a personal data breach affecting the Controller's data without undue delay and in any event within 48 hours of becoming aware of it, so that the Controller can meet its own duty to notify the Nigeria Data Protection Commission within 72 hours under the NDPA.
6.2 The notification will include, so far as known at the time: the nature of the breach, categories and approximate numbers of data subjects and records, likely consequences, and measures taken or proposed. Information may be provided in stages as it becomes available.
6.3 The Processor will assist the Controller with breach investigation, mitigation, and any notification to the Commission or to data subjects that the Controller decides to make.
7.1 Data-subject requests. Requests from patients (access, correction, erasure, objection and similar) are decided by the Controller as set out in Schedule 3. The Processor will pass on promptly any request it receives directly, will not respond to the patient itself unless instructed, and will provide the tools and assistance the Controller reasonably needs (including in-platform export and access records) within [10] business days of instruction.
7.2 The Processor will assist the Controller, on request, with data protection impact assessments and with demonstrating compliance, taking into account the nature of the processing.
7.3 Erasure and retention. Erasure requests never override the retention schedule or a legal hold under Schedule 3; the Processor will explain its role on that basis only as instructed by the Controller, who responds to the patient.
8.1 At the end of the Services, the Controller's data is exported, retained, deleted and certified exactly as set out in the Retention & Exit Policy (Schedule 3), which forms part of this DPA. The Processor will not delete clinical data on its own initiative outside that Policy.
8.2 During the term, self-serve export is available to the Controller at any time, so the Controller is never dependent on the Processor for access to its own data.
[Decision required: the platform's hosting location is not yet settled. Delete the option that does not apply once hosting is decided, and insert the hosting provider and location in clause 5.1. Note also the NITDA National Cloud Computing Guideline position on health data being hosted within Nigeria by default, recorded in the project's blueprint documents.]
[Option A — data hosted in Nigeria. All personal data under this DPA is hosted and stored within the Federal Republic of Nigeria. The Processor will not transfer it outside Nigeria except: (a) dictation audio sent to Deepgram, only where the Controller has enabled dictation; (b) notification delivery data sent to the messaging provider; or (c) as instructed by the Controller in writing. Any such transfer will be made only under a lawful transfer mechanism under the NDPA.]
[Option B — data hosted outside Nigeria. Personal data under this DPA is hosted in [country/region — to be inserted]. The Parties record that this is a cross-border transfer under the NDPA and will be carried out only under a lawful transfer basis, including [the safeguards to be inserted — e.g. adequacy, appropriate safeguards/contractual terms, or another NDPA-permitted basis]. The Controller confirms it has assessed this transfer for its own compliance, including any requirement for prior authorisation. Sub-processing transfers under clause 5 follow the same rule.]
10.1 The Processor will make available, on reasonable request and not more than [once] per year (or additionally after a breach), the information reasonably necessary to demonstrate compliance with this DPA, including security documentation, audit-log summaries for the Controller's tenancy, and summaries of independent assessments where available.
10.2 Any on-site or systems audit will be by prior agreement, during business hours, under confidentiality, and must not compromise the security or data of other tenants; tenant-isolation constraints may require evidence-based (rather than direct-access) audit methods, which the Parties will agree in good faith.
11.1 In the event of conflict between this DPA and the Master Services Agreement on the processing of personal data, this DPA prevails. Retention, exit and verification-continuity terms are governed by Schedule 3.
11.2 This DPA is governed by the laws of the Federal Republic of Nigeria.
Draft v0.1 · 11 November 2026 · Placeholders in {{double braces}} and [square brackets] to be settled before first use; clause 9 requires a decision, not just completion.