Privacy
Policy.

1. Introduction

This Privacy Policy explains how My Space My Time (“MSMT”) collects, uses, discloses, and protects your personal and health-related information, in accordance with the Nigeria Data Protection Act, 2023 and other relevant laws. By using our platform or services, you acknowledge that you have read, understood, and agreed to the practices described in this Policy.

2. Understanding Your Health Record

Whenever you receive services through MSMT or affiliated practitioners, a record is created containing your symptoms, assessments, diagnoses, treatment plans, and outcomes. This record – commonly referred to as your medical or health record – serves as a key communication tool among the professionals involved in your care.

Understanding what information is included in your health record and how it is used helps you ensure its accuracy, accountability, and confidentiality. It also informs you of your rights when consenting to or refusing disclosure of that information.

3. Your Rights Under Nigerian Law

You have the following rights under the Nigeria Data Protection Act, 2023:

• To access and review your personal and medical information
• To request corrections or updates to your record
• To restrict or object to the processing of certain data
• To request communication by alternative means or at alternative locations
• To withdraw consent to further disclosures (except where required by law)

Requests should be made in writing to hello@msmt.com. MSMT will respond within 30 days in accordance with legal requirements. You are also entitled to receive an account of any disclosures made, subject to administrative fees.

4. MSMT’s Responsibilities

MSMT is legally obligated to:

• Maintain the confidentiality and integrity of your information
• Comply with Nigerian data protection and mental health privacy laws
• Honor your lawful requests concerning access, correction, and restriction
• Notify you in the event of any material change to our data handling practices

We reserve the right to revise this Privacy Policy at any time. Updated versions will be posted on our platform and communicated through your registered email address.

5. Use of Information for Care and Operations

Your information may be used or disclosed for the following purposes:

Treatment

To coordinate, consult, or refer your care across multiple providers, including therapists, supervisors, and specialists involved in your case.

Payment

To generate invoices or process payments via approved third-party payment platforms. This includes submitting diagnosis and treatment information to insurers or payers.

Healthcare Operations

To monitor quality of care, improve services, conduct internal reviews, manage risk, or facilitate clinical audits.

6. Specific Disclosures and Communications

Business Associates

MSMT may share information with external parties (e.g. case managers, billing providers, and legal consultants) under binding agreements that require compliance with the NDPA and MSMT’s privacy practices.

Family or Designated Contacts

Using professional discretion and where lawful, MSMT may disclose relevant information to a family member, caregiver, or authorized contact person identified by you.

Client Notifications

You may receive email-based notifications related to appointment reminders, feedback surveys, or service-related updates. MSMT does not send promotional SMS. Camera surveillance or recordings on the website are limited to platform monitoring and exclude any therapy or tele-psych sessions, which require separate consent.

7. Required Disclosures Under Nigerian Law

MSMT may be legally required to disclose your personal or medical information under the following conditions:

• Public Health Reporting: As mandated for infectious diseases, injuries, or disabilities
• Worker’s Compensation Claims: To comply with workplace health and injury laws
• Correctional Institutions: For the safety and medical welfare of incarcerated individuals
• Court Orders or Legal Subpoenas: As required by a Nigerian court of competent jurisdiction
• Law Enforcement or Government Agencies: Where a lawful order, investigation, or complaint procedure so requires

MSMT shall always ensure that such disclosures are limited to what is legally necessary and in accordance with professional ethical standards.

8. Data Retention

MSMT retains your personal and health information only as long as necessary to provide our services, meet our legal and regulatory obligations, resolve disputes, and enforce our agreements. Retention periods differ by the category of data:

• Health and medical records (session notes, assessments, diagnoses, prescriptions, treatment plans): retained for at least 5 years from the date of your last interaction with MSMT, or longer where required by Nigerian healthcare regulations or applicable laws.
• Account information (name, email, phone number, date of birth, profile photo, login credentials): retained for the duration of your account, and for up to 30 days after account deletion to allow for recovery, reversal of accidental deletions, and routine system clean-up.
• Communications with MSMT (support emails and in-app messages with administrative staff): retained for up to 2 years for quality assurance and dispute resolution.
• Payment and billing records: retained for 5 years in line with applicable tax, accounting, and anti-money-laundering regulations.
• Technical and device logs (IP addresses, session metadata, crash and error logs): retained for up to 12 months for security, fraud prevention, and operational purposes.
• Encrypted backups: data may persist in our secure backup systems for up to 90 days after primary deletion before being permanently overwritten.

Once the applicable retention period ends, the data is either securely and irreversibly deleted, or anonymized so that it can no longer be linked to you. Anonymized data may be retained for analytics, research, and service-improvement purposes.

9. Account and Data Deletion

You may request deletion of your MSMT account and the personal data we hold about you at any time. We honor your right to deletion under the Nigeria Data Protection Act, 2023, subject only to the legal retention obligations described in Section 8.

How to request deletion

You have two ways to delete your account and data:

• In the mobile app: open Profile → Delete Account and follow the on-screen prompts. You will be asked to confirm the request, and you may need to verify your identity.
• By email: send a deletion request from your registered email address to hello@msmt.com with the subject line “Account Deletion Request.” We may contact you to verify your identity before processing.

Timeline

• We acknowledge every deletion request within 5 business days.
• Active account data is removed from our production systems within 30 days of a confirmed request.
• Backup copies are overwritten within 90 days of primary deletion.

What this means for you

• You will lose access to the MSMT app and any care history visible from your account.
• Your account cannot be restored after the 30-day grace period has ended.
• You may create a new MSMT account at any time, using the same or a different email address.

If you would like a copy of your personal data before requesting deletion, you can ask for an export at hello@msmt.com under the access right described in Section 3.

10. Reporting a Concern or Complaint

If you believe your privacy rights have been violated, you may lodge a formal complaint by contacting MSMT at: hello@msmt.com

Complaints should be submitted in writing and must include a description of the concern. You may also file a report with the Nigeria Data Protection Commission (NDPC). MSMT will not retaliate against anyone who lodges a privacy-related complaint in good faith.

11. Governing Law

This Privacy Policy is governed by the laws of the Federal Republic of Nigeria. By using MSMT’s platform and services, you agree to the terms stated in this Policy.