RxNaija carries medical conversations. That makes this document a description of real obligations rather than a formality, so it is written to be read — plainly, in the order the questions actually occur to you.
Last updated 26 September 2026
RxNaija is a product of RXNAIJA HEALTH LTD, a company registered in Nigeria (CAC Registration No. 8345514). In this policy, "we", "our" and "us" mean that company.
RxNaija lets a Nigerian community pharmacy answer its customers on WhatsApp — quoting prices from the pharmacy's own catalogue, taking orders, and handing anything clinical to a registered pharmacist. This policy covers our websites, the pharmacy dashboard at app.rxnaija.com, the websites pharmacies publish through us, and the WhatsApp assistant itself.
We handle personal data under the Nigeria Data Protection Act 2023 and the regulations of the Nigeria Data Protection Commission.
This is the first thing to get straight, because the answer differs depending on who you are, and it decides who you should ask when you want something changed or deleted.
For your account, your staff's details and your billing, we decide how the data is used and we answer to you directly.
Your conversation, your orders and your purchase history belong to that pharmacy. We hold and process them on its instructions.
If you are a patient or customer and you want your data corrected or erased, the pharmacy you messaged is the right first place to ask — it is their record. You can also write to us and we will act on their instruction, or pass your request to them. We will not quietly delete a pharmacy's clinical or transaction records without them knowing.
These pages are deliberately the least intrusive thing we build. They contain no JavaScript at all, so there is no analytics snippet, no pixel and no third-party tracker on them.
For a published pharmacy website we store only a running total per day — how many times the page was served, and how many people tapped WhatsApp, the phone number, the map or the email link. We do not record your IP address, your browser, a session, a referrer or a cookie. The date is stored as a day rather than a timestamp specifically so that individual visits cannot be reconstructed from it afterwards.
When you sign in to app.rxnaija.com we process the usual server request data needed to run and secure a web application, and we store a sign-in session in your browser. We do not use advertising cookies and we do not run third-party advertising trackers.
Some of what passes through RxNaija is health data, which Nigerian law treats as sensitive. We handle it accordingly, and we are specific about its limits.
When a customer repeatedly buys a medicine associated with a long-term condition, RxNaija can flag that customer to their pharmacy so repeat supply and refill reminders work. That flag is an inference drawn from purchase history. It is not a diagnosis, it was not made by a clinician, and it is shown to pharmacy staff labelled as such.
Questions about doses, children, pregnancy, interactions or symptoms that need judgement are escalated to a registered pharmacist rather than answered. This is a designed limit, not a disclaimer: the software stops and waits for a person.
We use personal data to:
Our lawful bases are performance of a contract (running the service you or your pharmacy signed up for), legitimate interests (security, fault diagnosis, improving the product), consent where we ask for it, and legal obligation where the law requires retention.
Our database is hosted by Supabase in the European Union. Some of our processors, including OpenAI, operate outside Nigeria and the EU. This means personal data collected in Nigeria is transferred and stored abroad.
Where we transfer data outside Nigeria we do so on the bases permitted by the Nigeria Data Protection Act 2023, and we require our processors to protect it to a standard consistent with that Act.
When a pharmacy closes its account, we delete or irreversibly anonymise its data within 90 days, except where retention is required by law or needed to resolve a dispute.
Under the Nigeria Data Protection Act 2023 you may ask us to:
To exercise any of these, email support@rxnaija.com. We may need to verify your identity first. If you are a customer of a pharmacy, see section 2 — the pharmacy holds that record and we will act with them.
If you are unhappy with our response, you may complain to the Nigeria Data Protection Commission.
You can tell a pharmacy's WhatsApp assistant to stop messaging you at any time, and it will stop. Your existing orders and conversation history are kept as part of the pharmacy's record, but nothing further will be sent to you unless you message first.
RxNaija is intended for pharmacies and for adults buying from them. We do not knowingly collect personal data from children. A parent or carer may of course ask about a medicine for a child — in which case the question is about the child, and any question needing clinical judgement is passed to a pharmacist rather than answered by software.
If you believe a child has provided us with personal data, contact us and we will remove it.
No system can be guaranteed completely secure, and we do not claim otherwise. If we become aware of a breach affecting personal data we will notify the affected parties and the Commission as the Act requires.
A pharmacy's published website, and messages sent through a pharmacy's WhatsApp assistant, may contain links to sites we do not operate — a manufacturer, a map, a delivery service. Following one takes you to a site with its own privacy policy and its own practices, and this policy does not cover it. We have no control over those sites and we are not responsible for their content or how they treat your data, so we would encourage you to read the policy of any site you are sent to.
We do not sell or pass your details to any of them. Where a pharmacy uses a service that does process data on our behalf, it is listed in section 6.
We will post any change to this policy on this page and update the date at the top. If a change materially affects how we use personal data already collected, we will make a reasonable effort to tell you directly.
For any question about this policy, or to exercise a right described in it, write to support@rxnaija.com.
RXNAIJA HEALTH LTD
CAC Registration No. 8345514
NEEDS-INPUT: registered office address
Nigeria
Data protection contact: NEEDS-INPUT: named contact, reachable at the address above.
If something here is unclear, or you want to know exactly what we hold about you, write to us. A policy nobody can get an answer out of is not a policy.