Who handles your information
OWERRI JAYCARE HOSPITAL LIMITED operates Jaycare Hospital, this website and the Jaycare patient app. Our operating address is 5 Nkwerre Street, Works Layout, Owerri, Imo State, Nigeria. This policy covers these digital services and explains how app account information differs from hospital records used to provide care.
Contact admin@jaycarehospital.com for privacy questions, access or correction requests, or help deleting an app account.
Information you provide and access
- Account details: name, email, phone number, sign-in credentials and information provided during registration or identity verification. Passwords are stored as protected hashes, not readable passwords.
- Care information: appointments, records released by the hospital, prescriptions, test results, bills, receipts and health-plan applications you access or submit through the app.
- Family access: your relationship to another patient and verification needed to authorise access. Creating an account does not automatically grant access to anyone’s medical record.
- Website enquiries and applications: contact details, appointment preferences, messages and recruitment information you choose to submit.
- Service information: sign-in sessions, security and access logs, device notification tokens and, when enabled, crash diagnostics.
Why we use information
We use information to provide requested care and account services, verify identity and access, arrange appointments, process payments and coverage requests, deliver service messages, investigate faults and protect accounts. Hospital records also support clinical governance, accounting and applicable record-keeping obligations.
- Access to records is limited to authorised patients, representatives and staff.
- We do not sell your personal information or use your health records for advertising.
- Do not send diagnoses, test results, passwords or identity documents through general website enquiries or ordinary privacy-request emails.
Google and Apple sign-in
If you choose Google sign-in, we use the account identifier, email and basic profile details returned by Google to sign you in. We do not request access to your Gmail messages, contacts or Drive files.
Where Apple sign-in is available, Apple supplies an account identifier and may supply your name and email. You can choose Apple’s private relay email address. Jaycare retains a protected Apple credential so access can be revoked when the app account is deleted. Your Google or Apple password is never provided to Jaycare.
A matching email address alone does not authorise access to hospital records or automatically merge app accounts.
Device permissions and your choices
- Notifications are optional. If enabled, the app registers a device token for service alerts. You can turn them off in the app or device settings.
- App lock uses your device’s biometric or passcode authentication. Jaycare does not receive your fingerprint, facial template or device passcode.
- Video consultations open a consultation service in your browser, which may request camera and microphone permission. Review that service’s notice before joining.
- Sharing a receipt creates a PDF that you choose to send or save. Copies saved to Files, email or another app remain under your control and are not removed by deleting your Jaycare account.
Service providers and disclosures
Authorised staff and service providers receive information needed to deliver their part of the service. Providers can process information outside Nigeria; the location and retention of their systems can differ from ours. We may also disclose information when required by law or necessary to protect safety.
- Google and Apple support the sign-in methods you choose.
- Paystack handles payment checkout. Jaycare keeps transaction references, amounts and payment status for billing and reconciliation; payment credentials entered into the provider’s checkout are handled by that provider.
- Expo, Apple Push Notification service and Firebase Cloud Messaging deliver enabled notifications using device tokens and notification payloads.
- Firebase Crashlytics, when enabled in a distributed app build, processes crash reports, app/device details and installation identifiers. These diagnostics are not anonymous. We limit JavaScript reports to technical categories and stack information and do not intentionally add patient records to diagnostics.
- Our hosting, storage and email providers support accounts, records, service messages and website operation. External consultation and messaging services have their own privacy notices.
Security and retention
We use authenticated access, access controls, protected connections and security logs to help protect information. No online service can guarantee absolute security. Keep your device and sign-in details secure and tell us if you suspect unauthorised access.
App account data is kept while needed to provide the account and is removed or anonymised through the deletion process described below. Hospital medical records, billing records, coverage decisions and necessary security/audit records are retained separately for clinical, legal, accounting and safeguarding purposes. Deleting the app account does not erase those records.
Policy approved by Dr Chinyere Obi, Medical Director; privacy reviewer: Dr Chinyere Obi, Chief Medical Director (CMD). Approval date: 14 October 2026.
A legal hold suspends deletion of the affected records beyond their normal retention period during ongoing treatment, a complaint or dispute, litigation, an NDPC or other regulatory investigation, an insurer or HMO audit, or a clinical research protocol requiring longer retention. Only the compliance or legal lead may lift the hold, in writing.
A hold concerns the affected records; retaining hospital records does not by itself prevent deletion of an app account. Contact the hospital to ask which records are retained and why, or to request a review.
- Adult medical records: 10 years from the last episode of care (last treatment or discharge).
- Children’s medical records: until age 25 or 10 years after the last treatment, whichever is later.
- Deceased patients’ records: 10 years after death. Where clinical retention rules overlap, the later expiry date applies.
- Billing, invoices and payment records: 6 years after the end of the financial year of the transaction. The hospital’s financial year ends on 31 December.
- Account-verification records and security/audit logs: 2 years after the event. Medical-record access logs are retained for the same period as the corresponding medical record.
- Backups: deleted data may remain for up to 35 days (a 30-day rolling cycle plus a buffer), then expires. A restore must not bring deleted data back into live use; deletion must be reapplied before restored data becomes available.
Delete your app account
In the Jaycare app, open Account → Privacy & security → Delete my account. The app shows the scheduled deletion date and lets you cancel before deletion is completed.
You can also request deletion without installing or signing in to the app. Use our account-deletion page to email the hospital. We verify that you control the account before scheduling deletion and confirm the date and how to cancel.
Deletion removes or anonymises app profile and sign-in details, clears sessions and registered devices, and revokes that account’s family access. Pending account-linking requests are cancelled. Hospital care, billing and necessary audit records are retained separately. Deletion does not cancel appointments, resolve outstanding bills or erase another patient’s account.
Website and external links
Website delivery can generate technical logs such as IP address, browser and requested pages. Essential browser storage may be used to keep services working. Maps, payment pages, messaging links and other external services may process information when you use them; check their notices and browser controls.
The patient app does not include an advertising SDK. Crash reporting is distinct from advertising and has the diagnostic data uses described above.
Requests, family access and updates
You may ask to access or correct your information, request deletion or restriction where appropriate, or withdraw consent for optional services. We may need to verify your identity and explain any records that cannot be erased. Contact the hospital if you believe information has been handled incorrectly.
Parents, guardians and other representatives must have appropriate authority to access another patient’s information. The hospital verifies that authority; sharing a surname, phone number or email is not sufficient.
We update this policy when our services or information practices change. The date above identifies the latest revision.