Data and Insights- Privacy Notice
1.INTRODUCTION
One Global Medical Technology Ltd and its affiliates (“Helium Health,” “We,” “Us,” or “Our”) provide a healthcare technology ecosystem comprising electronic health records (“HeliumOS”), practice tools, patient portals and telehealth (“HeliumDoc”), financing (“HeliumCredit”), AI/analytics (e.g., “HeliumCoPilot”), and related services (the “Platform”).
Helium Health exists to make healthcare more connected, reliable, and safe. The systems We provide allow healthcare professionals to record, coordinate, and improve care, while ensuring that the information entrusted to Us is managed responsibly under the strongest privacy protections.
As part of this Platform, Our Data and Insights business creates Africa’s largest anonymised health data network, generating valuable insights to improve healthcare systems and advance health outcomes.
We process your information in accordance with applicable global data protection laws, including, amongst others, the Nigeria Data Protection Act, 2023 (“NDPA”).
2.TERMS OF USE
When you use any of Our products or participate in Our programs, you must comply with the terms of use for that product or program.
3. THE DATA WE PROCESS
Personal data means any information about an individual from which that individual can be directly or indirectly identified. We do not consider personal data to include information made anonymous so that it does not identify a specific individual or user.
Our Data and Insights product collects data from Our products and programs, anonymises it, and uses it to generate insights.
4. PRODUCTS COVERED
Helium Health offers a range of products and We may collect information from you while you use any of these products. These include the following products and any additional products which We develop in future:
- HeliumCredit: This product is a loan facility that allows healthcare facilities access to financial options that suit their needs. You can read HeliumCredit’s Privacy Notice here.
- HeliumDoc: This product brings together top doctors and other healthcare professionals under one roof and provides a wide range of healthcare services, including but not limited to doctor and treatment search, in-clinic appointment booking, and telemedicine. You can read HeliumDoc’s Privacy Notice here.
- HeliumOS: This product provides end-to-end digitalisation of medical records and hospital operations, which allows healthcare providers to access critical patient information quickly and easily. You can read HeliumOS’s Privacy Notice here.
- Helium Mum: An Antenatal Risk Stratification (“ARS“) program, aimed at strengthening a newly developed ARS tool, that can provide differentiated care to pregnant women in Nigeria by early identification of the health risk levels for such women and determining healthcare plans for them. You can read Helium Mum’s Privacy Notice here.
- Helium Health-MSD For M(om) Program: A program designed to improve the quality of maternal care, reduce maternal mortality, and ultimately strengthen systems for safer childbirth by providing healthcare financing, digital health tools, capacity building and community engagement for maternal health providers in Nigeria. You can read Helium MSD’s Privacy Notice here.
- HeliumCoPilot: HeliumCoPilot is an advanced feature within HeliumOS, leveraging a cutting-edge Large Language Model (“LLM”) Artificial Intelligence (“AI”) chatbot/software application that leverages Retrieval Augmented Generation (“RAG”) to enhance accuracy, minimize errors and improve predictive analytics for healthcare practitioners’ decision-making.
5. COOKIES AND TRACKING TECHNOLOGIES
We use cookies/SDKs for session management, analytics, security, and experience. Where required, We seek consent and honor regional choices. You can manage non-essential cookies via our banner and your browser/app settings.
6. LAWFUL BASES FOR PROCESSING
We generally process anonymised data under legitimate interest and public health grounds.
7. PURPOSES OF PROCESSING YOUR DATA
We process your data (including, but not limited to, your personal data, anonymized data, pseudonymised data, and any other variations or forms of your data) for any or all of the following purposes:
| Purpose | Examples | Lawful bases (NDPA) |
| Product research & improvement | Quality/safety analysis, usage analytics, feature development, model evaluation | Legitimate interests |
| Creation, use, licensing, and commercialization of de-identified or anonymized data | Transforming identifiable data into non-identifiable form; sharing with permitted partners for lawful purposes | Legitimate interests and/or consent (region-dependent) |
| Secondary communications (opt-in) | Clinical trial/research outreach, referrals, surveys, marketing, commercial outreach, feedback requests, business communications | Explicit consent |
| Legal & compliance | Regulatory reporting, audits, lawful requests | Legal obligation |
These purposes represent the lawful and limited ways data may be used. Most relate to providing healthcare and maintaining system integrity.
8. HOW WE USE DE-IDENTIFIED/ANONYMIZED DATA
As an integral function of the Platform, We process Health Information to create de-identified or anonymized data in accordance with NDPA, General Data Protection Regulation (“GDPR”), and Health Insurance Portability and Accountability Act (“HIPAA”) standards, as applicable. Once properly anonymized, it is no longer considered personal data under those laws.
We and Our contractual partners may use, disclose, license, aggregate, and commercialize such de-identified or anonymized data for purposes permitted by applicable law, including but not limited to:
- Supporting medical, scientific, technological, and public health advancements that improve health outcomes and strengthen healthcare systems, including participation in clinical studies, surveys, and research initiatives.
- Advancing the safe and responsible development of artificial intelligence (including large language models), analytics, and other technologies to enhance diagnosis, treatment, and healthcare delivery.
- Creating, enhancing, and commercializing products, services, and solutions across healthcare, life sciences, and other industries, and furthering Our and Our contractual partners’ business interests, for which We may receive remuneration as permitted by applicable law.
We may use, license, or share such data with public health organizations, research institutions, life sciences organizations, technology developers, third-party for-profit commercial entities, and other partners as independent controllers for purposes permitted by applicable law (e.g., research, artificial intelligence model training, product development, analytics, and commercialization of resulting outputs).
This section makes clear that once data is anonymized, it is no longer linked to you personally and can safely be used for broader purposes such as research or improving healthcare technology. You may revoke your consent for these purposes at any time by contacting us at dpco@heliumhealth.com. However, in certain cases it may not be possible to honor this request, for example if deletion is not technically feasible because your de-identified data can no longer be traced back to you.
9. HOW WE SHARE INFORMATION
- Partners:
- De-identified/anonymized data recipients.
- Legal/regulatory & corporate events – Regulators/law enforcement where required, during corporate transactions.
10. YOUR RIGHTS AS A DATA SUBJECT
Your rights will depend on the specific product/program you engage with. Please see the privacy notice for that product or program for details.
11. WHO WE DISCLOSE DATA TO
We may share anonymised/pseudonymizeddata with the following third-parties:
| Third Parties | Purpose of Data Sharing |
| Public health authorities | For monitoring and responding to public health concerns and epidemics |
| Research institutions | To support medical research and clinical trials, particularly for drug development and public health studies |
| Pharmaceutical companies | To aid in drug discovery, safety monitoring, and improving treatment efficacy |
| Funding and donor organisations | For monitoring program effectiveness and ensuring efficient resource allocation |
| Regulatory bodies | To comply with legal and regulatory requirements for health data handling |
| Third-party analytics providers | To help analyse anonymised data and generate insights for improving healthcare delivery |
| Collaborative Partners | We collaborate with other businesses to support Our legitimate business objectives and may share data with these partners to achieve these objectives |
12. RETENTION OF YOUR DATA
We retain personal data for as long as necessary for the purposes outlined in this Privacy Notice, in line with legal requirements. Data may be retained longer where legally required, even if you request deletion. Marketing data will be deleted once you unsubscribe. We retain personal data only as long as necessary for the purposes collected, to provide services, and to satisfy legal/clinical retention obligations. De-identified/anonymized data may be retained indefinitely.
Data is held only as long as necessary to meet care, legal, or regulatory requirements. Once anonymized, information can be retained without personal risk.
13. SECURITY OF YOUR DATA
We implement technical and organisational safeguards to protect your data against loss, misuse, or unauthorised access. While no system is entirely secure, We will promptly notify you and relevant authorities in the event of a significant breach.
14. INTERNATIONAL TRANSFERS
Where data is transferred outside your country of residence, We ensure appropriate safeguards are in place, such as adequacy decisions, standard contractual clauses, or regulator approval. Safeguards such as Standard Contractual Clauses and adequacy decisions are applied so that data receives the same level of protection internationally as it does locally.
15. MARKETING AND COMMUNICATIONS
We will only send marketing communications with your consent. You may opt out at any time via the unsubscribe link.
16. COMPLAINTS
If you have any inquiries or complaints, please contact Our Data Protection Officer (“DPO”) at dpco@heliumhealth.com.We will investigate and respond promptly.
17. CHANGES TO THIS NOTICE
We may update this Notice periodically. Please check the “last updated” date when reviewing.
18. CONTACT US
If you have any questions regarding this Privacy Notice or how your data is managed, please contact our DPO via email at dpco@heliumhealth.com.
19. GOVERNANCE
We operate a privacy program aligned to principles of the applicable data protection laws, with records of processing, DPIAs where required, vendor due diligence, training, and audits.
Last Updated December 2025