RENALTRACK PRIVACY POLICY

Effective Date: 10 October 2026
Last Updated: 10 October 2026

1. Introduction

Welcome to RenalTrack.

RenalTrack is a digital health-monitoring platform designed to support the recording, organisation and monitoring of selected urine-test screening results over time. It is intended to support screening activities conducted by pharmacists, community health workers and other authorised personnel, subject to the scope of the pilot programme.

We recognise that health information is personal and sensitive. This Privacy Policy explains how RenalTrack collects, uses, stores, accesses, discloses and manages personal information when individuals use our website, screening portal and related services.

Our objective is to handle personal information responsibly, communicate our practices transparently and support the appropriate use of screening records.

By using RenalTrack, you acknowledge that you have had the opportunity to read this Privacy Policy. Where consent is required, we will seek it separately and appropriately. Accessing the platform does not, by itself, replace any consent required for the collection or processing of personal or health information.

2. About RenalTrack

RenalTrack is a digital monitoring tool that supports the recording and review of selected urine-test observations and results over time.

Depending on the features available and the user’s authorised role, the platform may support:

Patient or participant registration and identification.
Recording urine-strip screening observations and results.
Recording dates and other relevant screening information.
Reviewing previous screening records and result histories.
Monitoring recorded changes over time.
Supporting discussions with qualified healthcare professionals.
Administrative management of screening activities by authorised personnel.

RenalTrack is not a substitute for laboratory testing, clinical assessment or professional medical advice. It does not independently establish a medical diagnosis.

Any interpretation of urine-strip results must be based on the applicable, approved test-strip reference information and the limitations of the screening method. RenalTrack will not treat unvalidated colour ranges, thresholds or interpretations as authoritative clinical guidance.

3. Who This Policy Applies To

This Privacy Policy applies to:

Patients and screening participants: Individuals whose personal information or screening results are recorded in RenalTrack.
Pharmacists and community health workers: Authorised personnel who use the platform to conduct or document screening activities.
Programme administrators: Individuals authorised to manage screening operations, accounts or related administrative functions.
Website visitors and registered users: Individuals who visit the website, create accounts or interact with available features.

Different categories of users may have different access permissions. Access to patient information should be limited to what is necessary for an authorised purpose.

4. Personal Information We May Collect

The information collected depends on the features used, the screening workflow and the information entered by authorised users.

4.1 Identification and contact information

This may include:

Patient or participant name, where required.
Patient or participant identification number or internal reference.
Age or date of birth, where necessary.
Sex or other relevant demographic information, where necessary.
Telephone number, email address or other contact details, where provided.
Location or community information relevant to a screening programme.

RenalTrack should collect only the identification and contact information reasonably necessary for its intended purpose.

4.2 Health and screening information

Because RenalTrack supports health screening and monitoring, records may include:

Screening date and time.
Selected urine-test observations and recorded results.
Relevant test parameters supported by the implemented screening workflow.
Interpretation or category associated with a result, where supported by an approved reference.
Previous screening records and result history.
Relevant notes entered by authorised screening personnel.
Follow-up recommendations or referral information, where these features are available and appropriately used.

Screening information may constitute sensitive personal data under applicable data protection law.

4.3 Account and professional information

For registered personnel and administrators, the platform may collect:

Name and account username.
Email address and other account contact details.
Professional or organisational information, where required.
Assigned role and access permissions.
Account status and relevant account activity.

Passwords and authentication information are used to manage account access. Users should not disclose their passwords to other people.

4.4 Technical and usage information

Depending on the hosting environment, website configuration and services in use, technical information may include:

IP address.
Browser type and device information.
Access dates and times.
Website usage information.
Error logs and security-related events.
Cookie or session information necessary for website operation.

Analytics, advertising or other tracking technologies should only be used as applicable, with appropriate transparency and consent where required.

5. How We Collect Information

RenalTrack may collect information through the following methods:

Directly from patients or screening participants.
From pharmacists, community health workers or other authorised personnel during screening.
Through forms and account-registration features on the website.
When authorised users create, update or review screening records.
Automatically through necessary website functions, server logs and security mechanisms.
From an authorised organisation or programme where there is a lawful basis for providing the information.

Where information is provided by a healthcare worker or another person on behalf of a participant, that person is responsible for following the applicable consent, authorisation and confidentiality requirements associated with their role.

RenalTrack will not assume that a person has consented to the processing of their health information merely because an authorised worker has entered their details.

6. Why We Use Personal Information

RenalTrack may process personal information for the following purposes:

6.1 Screening and monitoring

To create screening records, organise results, maintain a history of recorded observations and support the monitoring of changes over time.

6.2 Account management

To register users, authenticate accounts, manage roles and permissions, and administer access to the platform.

6.3 Continuity and review of records

To allow authorised users to review relevant previous records and support appropriate follow-up discussions.

6.4 Platform operation and improvement

To maintain the website, troubleshoot technical problems, assess system performance and improve usability and reliability.

6.5 Security and accountability

To help protect accounts and records against unauthorised access, misuse, loss or alteration, and to investigate relevant incidents.

6.6 Communication

To send necessary service-related messages, account notifications or programme communications where appropriate.

6.7 Legal and regulatory obligations

To comply with applicable legal obligations and respond to lawful requests from competent authorities, where required.

RenalTrack will not use personal or health information for a new, incompatible purpose without an appropriate lawful basis and any additional notice or consent required by law.

7. Lawful Basis for Processing

RenalTrack will process personal information only where an appropriate lawful basis exists under applicable data protection law.

Depending on the circumstances, this may include:

The individual’s valid consent.
Processing necessary to provide a requested service or fulfil an applicable agreement.
Compliance with a legal obligation.
Another lawful basis permitted by applicable law, where its conditions are satisfied.

For sensitive personal data, including health information, additional legal conditions may apply. RenalTrack will identify and rely on an appropriate condition for the particular processing activity.

Where consent is relied upon, it should be informed, specific, freely given where required, and capable of being withdrawn in accordance with applicable law. Withdrawal of consent does not automatically invalidate processing that lawfully occurred before withdrawal.

8. Consent for Screening and Health Information

Before collecting or processing a participant’s health information, the responsible screening programme or authorised personnel should ensure that the participant receives appropriate information about:

The purpose of the screening.
The type of information that will be recorded.
How the information will be used and who may access it.
Whether the information will be shared with another organisation or professional.
Any applicable limitations of the screening process.
The participant’s relevant privacy rights and how to exercise them.

Where a person cannot provide valid consent, including certain situations involving children or individuals requiring a legally authorised representative, the applicable legal requirements must be followed.

RenalTrack should not be used to collect a person’s health information without the necessary authority or lawful basis.

9. Who May Access Personal Information

Access to personal information should be restricted according to the user’s role and legitimate responsibilities.

Depending on the implemented features and permissions, access may be available to:

Authorised screening personnel who need the information to carry out their assigned duties.
Approved programme administrators who require access to manage screening operations.
Authorised technical personnel who need limited access to maintain or troubleshoot the platform.
Relevant service providers acting under appropriate instructions and confidentiality obligations, where access is necessary.

RenalTrack is designed to distinguish authorised access from unauthorised access. However, the exact permissions available depend on the deployed configuration and must be maintained and tested.

We do not intend to make patient records publicly accessible or available to unrelated users.

Users must not attempt to access records outside their authority, share another person’s information without permission, or use the platform for unauthorised purposes.

10. Sharing and Disclosure of Information

RenalTrack does not intend to sell personal or health information as part of its core screening and monitoring service.

Personal information may be disclosed only where appropriate and necessary, including:

To authorised healthcare personnel involved in a legitimate screening or follow-up process.
To an organisation administering a screening programme, where authorised and lawful.
To technical or hosting providers whose services are necessary to operate the platform, subject to appropriate safeguards.
To regulators, courts, law enforcement agencies or other competent authorities where disclosure is legally required or otherwise lawfully permitted.
Where the individual has provided valid consent for a specific disclosure.
Where disclosure is necessary for another lawful purpose permitted by applicable data protection law.

We will seek to limit disclosures to the information reasonably necessary for the relevant purpose.

Where a third party processes information on behalf of RenalTrack, appropriate contractual, confidentiality and data protection arrangements should be established.

RenalTrack does not promise that information will never be disclosed. Some disclosures may be necessary to operate the service, meet legal obligations or protect legitimate rights.

11. Data Storage and Hosting

RenalTrack operates as a web-based platform built on WordPress, with product functionality implemented through a custom plugin and shortcode-based features.

Personal information may be stored in the platform’s database and associated hosting infrastructure. Depending on the features used, relevant information may also be present in authorised backups, server logs or other necessary operational records.

The actual storage location and any international data transfers depend on the hosting provider and services configured for the deployed website.

Where a hosting or service provider processes personal information outside Nigeria, applicable requirements concerning international transfers of personal data must be assessed and followed.

RenalTrack will not claim that all information is stored exclusively in Nigeria unless this has been verified for the actual deployment.

12. Data Security

RenalTrack recognises the importance of protecting personal information, particularly health-related records.

Appropriate safeguards should be implemented and maintained in proportion to the sensitivity of the information and the risks associated with its processing. These may include:

Password-protected user accounts.
Role-based access restrictions.
Restricted access to patient records.
Secure website connections using HTTPS.
Appropriate protection of stored data and system credentials.
Timely software and plugin updates.
Appropriate backup and recovery procedures.
Monitoring of relevant technical errors and security events.
Procedures for handling suspected data breaches.

Security depends on the actual configuration, maintenance and operation of the website, its hosting environment and its plugins. The presence of a security feature does not guarantee that every risk has been eliminated.

We therefore do not represent RenalTrack as immune to cyberattacks, data loss or unauthorised access, nor do we claim a security certification that has not been independently established.

Users must protect their login credentials, use authorised devices and report suspected unauthorised access promptly.

13. Data Retention

RenalTrack will retain personal information only for as long as reasonably necessary for the purpose for which it was collected, subject to applicable legal, regulatory, clinical, research or programme requirements.

Retention periods may depend on:

The purpose and status of the screening programme.
The need to maintain a participant’s screening history.
Applicable legal or regulatory obligations.
The resolution of complaints, disputes or security incidents.
Legitimate requirements for backup and disaster recovery.

RenalTrack does not establish a universal retention period for all patient records under this policy. The responsible programme or data controller should define and document appropriate retention periods for each category of information.

When information is no longer required, it should be securely deleted, anonymised or otherwise disposed of in accordance with applicable law and documented retention procedures.

Backups may retain information for a limited additional period under the applicable backup cycle.

14. Your Privacy Rights

Subject to applicable law and any lawful limitations, individuals may have the right to:

Be informed: Understand how their personal information is collected and used.
Access: Request access to their personal information.
Rectification: Request correction of inaccurate or incomplete information.
Erasure: Request deletion of personal information where the legal conditions are satisfied.
Restriction: Request that certain processing activities be restricted where the law permits.
Object: Object to particular processing activities where a right to object applies.
Withdraw consent: Withdraw consent where processing relies on consent.
Data portability: Request a copy of eligible information in a suitable format where the right applies.
Complain: Lodge a complaint with the relevant data protection authority.

These rights are not absolute in every circumstance. For example, certain records may need to be retained to comply with a legal obligation or meet another lawful requirement.

To exercise a privacy right, contact the RenalTrack privacy contact identified in Section 23. We may need to verify your identity or authority before responding to a request.

We will handle requests in accordance with applicable law and the relevant response deadlines.

15. Health Information and Medical Limitations

RenalTrack supports the recording and monitoring of selected urine-test screening results. It is not intended to provide a definitive diagnosis of kidney disease or any other medical condition.

A urine-strip screening result may be affected by the test product, sample collection, timing, handling, testing procedure and other factors.

For this reason:

Results must be recorded according to the applicable test-strip instructions.
Interpretations must use the relevant approved manufacturer reference chart or other appropriately validated reference.
Unverified thresholds or colour ranges must not be presented as clinically validated.
Screening results should be interpreted within the limitations of the screening method.
Abnormal, concerning or uncertain findings should be discussed with an appropriately qualified healthcare professional.
Participants should not delay urgent medical care because of information displayed on the platform.

RenalTrack’s monitoring records do not replace professional assessment, laboratory confirmation or clinical judgement.

16. Cookies and Similar Technologies

The website may use cookies or similar technologies required to maintain user sessions, support authentication, remember necessary preferences and protect website functionality.

Depending on the services enabled, additional cookies may be used for analytics or other purposes.

Where non-essential cookies or tracking technologies require consent, the website should obtain the appropriate consent before using them.

Users may manage cookies through their browser settings. Disabling certain cookies may prevent login or other website features from working correctly.

The actual cookies used by RenalTrack depend on the active WordPress theme, plugins, hosting configuration and any third-party integrations. A separate cookie notice may be provided where appropriate.

17. Third-Party Services and External Links

RenalTrack may rely on third-party services to support website hosting, infrastructure, email delivery, security, backups or other operational requirements.

These providers may process limited personal information where necessary to provide their services.

Where applicable, we will seek to use providers with appropriate privacy and security safeguards and establish suitable contractual arrangements.

The RenalTrack website may also contain links to external websites. We are not responsible for the privacy practices of independently operated websites. Users should review the privacy policies of those services before submitting personal information.

The identity of third-party providers and the information they process may change as the platform develops.

18. Children’s Privacy

RenalTrack should collect or process a child’s personal information only where there is an appropriate lawful basis and the necessary consent, authorisation and safeguards required by applicable law.

Where a screening programme involves children, the responsible organisation must establish appropriate procedures for parental or guardian involvement where required, age-appropriate information and the protection of the child’s interests.

RenalTrack should not knowingly collect children’s information for an unrelated purpose or permit unauthorised access to children’s screening records.

If you believe that a child’s personal information has been collected or disclosed improperly, please contact us using the details in Section 23.

19. Research, Statistics and Future Uses

RenalTrack may be developed to support aggregate reporting, programme evaluation or research-related activities.

Any use of identifiable or pseudonymised health information for research, publication, commercial analysis or another secondary purpose must have an appropriate lawful basis and comply with applicable consent, confidentiality, ethics and data protection requirements.

Where appropriate, aggregate or anonymised information may be used to understand screening activity, assess programme performance or improve the service.

Information is not necessarily anonymous merely because names have been removed. Data that can reasonably be linked to an individual must continue to receive appropriate protection.

This policy does not authorise unrestricted research use, public disclosure of identifiable screening records or the sale of patient-level health information.

20. Data Breaches and Privacy Incidents

A personal data breach may involve the accidental or unlawful destruction, loss, alteration, unauthorised disclosure of or access to personal information.

If a suspected breach affects RenalTrack, appropriate steps should be taken to:

Assess and contain the incident.
Protect affected accounts and records.
Determine the type and extent of information involved.
Document the incident and the response.
Notify affected individuals and the relevant authority where required by applicable law.
Take reasonable steps to reduce harm and prevent recurrence.

Users who suspect that an account or patient record has been accessed improperly should report the incident promptly through the designated contact channel.

Any notification will be handled in accordance with applicable legal requirements and the circumstances of the incident.

21. Your Responsibilities as a User

Anyone using RenalTrack to handle personal information must:

Use the platform only for authorised purposes.
Access only the records necessary for their assigned duties.
Keep login credentials confidential.
Enter information accurately and responsibly.
Obtain or confirm the necessary consent or other lawful authority before recording personal health information.
Avoid disclosing patient records through unauthorised messaging, email, screenshots or other channels.
Report suspected errors, unauthorised access or privacy incidents.
Follow applicable professional, organisational and legal confidentiality requirements.

Pharmacists, community health workers and programme administrators remain responsible for complying with the professional and legal obligations applicable to their roles.

22. Changes to This Privacy Policy

We may update this Privacy Policy as RenalTrack develops, new features are introduced, our data-processing practices change or applicable legal requirements are revised.

The latest version will be published on the RenalTrack website with its updated date.

Where a material change affects how personal information is processed, we will provide additional notice or obtain fresh consent where required by applicable law.

Users should periodically review this policy to understand the current privacy practices of the platform.

23. Contact and Privacy Enquiries

For questions about this Privacy Policy, requests concerning personal information, or concerns about the handling of screening records, please contact:

Platform: RenalTrack
Organisation / Data Controller: [Insert the full legal name of the responsible organisation]
Privacy Contact: [Insert the designated privacy officer or responsible contact]
Email: [Insert the official RenalTrack privacy email address]
Website: [Insert the official RenalTrack website URL]
Postal Address: [Insert the organisation’s official contact address, where applicable]

Please do not include unnecessary medical details or sensitive patient information in an ordinary email. Where a request concerns a particular screening record, we may provide an appropriate process for verifying identity and handling the request securely.

If you are dissatisfied with how your personal information has been handled, you may also have the right to complain to the relevant data protection authority.

24. Applicable Law

This Privacy Policy is intended to operate in accordance with applicable data protection and privacy laws, including the Nigeria Data Protection Act 2023, where applicable, and any other laws that apply to the relevant processing activities.

The specific legal obligations applicable to RenalTrack will depend on the identity and role of the responsible data controller or processor, the nature of the processing, the individuals concerned and the circumstances in which the service operates.

Nothing in this policy is intended to remove or restrict a privacy right that cannot lawfully be waived.

25. Our Commitment

RenalTrack is being developed to support responsible screening, organised health records and the monitoring of selected urine-test results over time.

We recognise that trust is essential when health information is involved. Our commitment is to communicate clearly about our data practices, restrict access to authorised purposes, handle information responsibly and continue improving the platform’s privacy and security safeguards as it develops.

RenalTrack — A monitoring tool, not a medical diagnosis.

Your privacy matters. Your information deserves responsible handling.