Customer Legal Document Pack — Index

DRAFT v0.1 — 11 November 2026 — Draft for discussion. Not legal advice. To be reviewed by Nigerian legal counsel before signature or publication.

The pack for Velnova Health (operated by {{COMPANY_LEGAL_NAME}}). All documents use the placeholders Velnova Health, velnovahealth.com, {{COMPANY_LEGAL_NAME}}, {{COMPANY_ADDRESS}}, {{CONTACT_EMAIL}} and {{EFFECTIVE_DATE}} until the brand, domain and company details are confirmed. Figures in [square brackets] are drafting proposals to be settled.

#	Document	Purpose	Signed by / status	When used
1	`01-master-services-agreement.md`	The main contract: services (Imaging module; EMR module where subscribed), fees in naira, term, clinical-responsibility boundary, liability cap, exit	Both parties (via the Order Form signature blocks)	At customer onboarding; once per hospital
2	`02-data-processing-agreement.md`	NDPA 2023 processing terms: hospital = controller, platform = processor; security measures, sub-processors, 48-hour breach notice to the hospital, audit rights	Both parties (Schedule 2 to the MSA)	With the MSA, before any patient data is uploaded
3	`03-privacy-notice.md`	Public notice covering staff users, referring doctors on secure links, and patients using report verification	Published, not signed (website + portal)	Published before launch; kept current
4	`04-terms-of-use.md`	Rules for individual portal accounts: password/PIN confidentiality incl. the shared-workstation design, acceptable use, suspension	Accepted by each user on first sign-in (Schedule 4 to the MSA)	Every user, every hospital
5	`05-order-form.md`	One-page commercial record: hospital details, subdomain, modules/tier, fees, billing cycle, start date, sites	Both parties	One per hospital (and per change of modules/tier)
6	`06-patient-consent-template.md`	Plain-language patient consent for platform processing and off-site reporting, with a separate WhatsApp/SMS "report ready" opt-in	Hospital uses with its patients (hospital = controller); patient signs	At intake, per patient
7	`07-mutual-nda.md`	Short mutual confidentiality cover for pre-contract and pilot discussions (3-year term)	Both parties	Before pilots, pricing or security discussions
—	Retention & Exit Policy (`../RETENTION-AND-EXIT-POLICY.md`)	Retention schedule, exit/export/grace/deletion-certificate process, verification continuity	Schedule 3 to the MSA, incorporated by reference — its terms are not restated anywhere in this pack	Referenced by the MSA, DPA and Privacy Notice

Open decisions before first use

Company legal name and brand/domain — confirm the operating company's legal name and the purchased domain/brand, then replace all {{placeholders}} throughout the pack (MSA, DPA, privacy notice, consent template, report footers).
Hosting-location option in the DPA (clause 9) — choose Option A (hosted in Nigeria) or Option B (hosted outside Nigeria with NDPA transfer safeguards), insert the hosting provider in the DPA sub-processor table (clause 5.1) and the matching paragraph in the Privacy Notice (section 3). This decision also interacts with the NITDA cloud guideline position recorded in the project blueprint.
NDPC registration position — confirm whether the platform must register with the Nigeria Data Protection Commission as a data controller/processor of major importance, and reflect the outcome in the DPA/Privacy Notice if needed (open item in Retention & Exit Policy §7).
SLA targets and credits — confirm or adjust the bracketed figures in MSA Schedule 1 (99.5% target, support hours, response targets, credit percentages) to what operations can actually deliver.
Bracketed commercial figures — settle the [bracketed] periods and percentages in the MSA (payment terms, interest, termination cure period, fee-change notice, liability approach for data-protection breaches in clause 12.3).
Nigerian legal counsel review — a Nigerian health/data-protection lawyer must review the whole pack before signature or publication, including the Retention & Exit Policy's open items (statutory footing of the retention figures, state-level variations, patient-facing verification wording). No document in this pack is to be signed or published before that review.
Messaging and payment sub-processors — confirm the actual WhatsApp/SMS provider and payment provider(s) and insert their legal names in DPA clause 5.1 (both were still undecided when this draft was written).

Pack index v0.1 · 11 November 2026 · Companion project documents: ../MVP-BLUEPRINT.md, ../NEXT-PHASE-PLAN.md, ../RETENTION-AND-EXIT-POLICY.md.