Last updated 8 October 2026
Data processing agreement
In short
This agreement covers the patient and staff data your organisation stores in Biomatrix. You are the controller; we are the processor. We only act on your instructions, keep the data secure, tell you quickly if something goes wrong, and delete it when you leave.
1. Scope and roles
This Data Processing Agreement (“DPA”) forms part of the Terms of Service between Biomatrix Technologies Ltd (“Processor”) and the Customer (“Controller”). It applies to all personal data contained in Customer Data. Terms such as “personal data”, “sensitive personal data”, “processing” and “data subject” have the meanings given in the Nigeria Data Protection Act 2023 (“NDPA”) and other applicable data protection law.
2. Details of processing
| Subject matter | Provision of the Biomatrix hospital operations platform. |
|---|---|
| Duration | The subscription term, plus the export and deletion period in section 10. |
| Data subjects | Patients, next of kin, Customer staff and contractors, suppliers. |
| Categories of data | Identification and contact details; appointment and visit history; employment and rostering information; inventory and dispensing records linked to individuals. |
| Sensitive data | Health data, including clinical notes, diagnoses, prescriptions, laboratory results and attached medical documents. |
| Purpose | Hosting, storing, displaying, transmitting and backing up data to provide and support the Service. |
3. Instructions
The Processor will process personal data only on the Controller's documented instructions, which are given by these terms and by the Controller's use and configuration of the Service — for example, choosing to release a laboratory result to a patient. The Processor will inform the Controller if it believes an instruction infringes data protection law.
4. Personnel
The Processor ensures that personnel with access to personal data are bound by confidentiality, trained in data protection, and given access only where necessary for their role. Support staff access Customer Data only when needed to resolve an issue the Controller has raised, and such access is logged.
5. Security measures
The Processor maintains appropriate technical and organisational measures, including:
- encryption of data in transit and at rest;
- logical separation of each customer's data;
- role-based access control enforced server-side, with branch-level scoping;
- audit logging of access to and changes in records;
- multi-factor authentication for administrative access;
- automated, encrypted backups and tested recovery procedures;
- vulnerability management and regular security review.
6. Sub-processors
The Controller authorises the Processor to engage sub-processors to help provide the Service. The Processor maintains a list of current sub-processors, available on request, and will give at least 30 days' notice before adding or replacing one. The Controller may object on reasonable data protection grounds; if the parties cannot resolve the objection, the Controller may terminate the affected service. The Processor imposes data protection obligations on each sub-processor equivalent to this DPA and remains responsible for their performance.
7. Assistance and data subject requests
The Service provides tools for the Controller to access, correct, export and delete records. The Processor will promptly forward to the Controller any request it receives directly from a data subject and will provide reasonable assistance with requests, data protection impact assessments and consultations with the Nigeria Data Protection Commission.
8. Personal data breaches
The Processor will notify the Controller without undue delay, and in any event within 48 hours, after becoming aware of a personal data breach affecting Customer Data. The notice will describe the nature of the breach, the data and data subjects affected, the likely consequences and the measures taken or proposed. This allows the Controller to meet its own obligation to notify the Commission within 72 hours where required.
9. International transfers
The Processor will not transfer personal data outside Nigeria, or outside any hosting region agreed with the Controller, except in compliance with Part VIII of the NDPA and with appropriate safeguards in place.
10. Return and deletion
For 30 days after the end of the subscription, the Controller may export its data in a standard format. After that period, the Processor will delete Customer Data from live systems within 30 days and from backups within 90 days, unless retention is required by law. Deletion can be confirmed in writing on request.
11. Audits
The Processor will make available information reasonably necessary to demonstrate compliance with this DPA, including summaries of independent security assessments where available. Where that is not sufficient, the Controller may conduct an audit, no more than once a year, on 30 days' notice, during business hours and subject to confidentiality.
Questions about this DPA: privacy@biomatrix.ng.