SabiCare365 Limited

1. Introduction

SabiCare365 Limited ("SabiCare365," "we," "us," or "our") is committed to protecting the privacy and personal information of its users. We collect, process, and store personal data in compliance with the Nigeria Data Protection Act 2023 (NDPA), the regulations and guidelines of the Nigeria Data Protection Commission (NDPC), and other applicable Nigerian laws.

SabiCare365 operates a cross-border care coordination platform connecting Nigerian diaspora Family Subscribers with verified professional caregivers who provide in-home care to elderly Care Recipients in Nigeria. This Policy describes the personal information we handle in delivering that service and the choices you have.

2. Consent and Lawful Basis

Where processing is based on consent, SabiCare365 will inform the data subject of the purpose for obtaining their consent before collecting their personal data, and will rely on the data subject's unequivocal consent to process the data. Consent may be given via a ticked checkbox on our electronic platforms, by signature on physical documents, or by any other acceptable means.

Where a data subject provides personal information about a third party (for example, a Family Subscriber providing information about a Care Recipient), SabiCare365 requires confirmation that the data subject is authorised to act on that third party's behalf.

A data subject may withdraw consent at any time by contacting legal@sabicare365.com. Withdrawal does not affect the lawfulness of processing carried out before the withdrawal. For minors or persons lacking the capacity to consent, SabiCare365 relies on the consent or authority of their parent, legal guardian, or authorised representative, except where processing is necessary to protect the vital interests of that person or is otherwise permitted by law.

3. How We Use Personal Data

Personal data obtained with the consent of the data subject will not be used in any manner other than the purpose for which it was obtained, except with further consent or as permitted by law. SabiCare365 may use or process personal data for the following care-coordination purposes:

• Creating and managing user accounts, and authenticating users on the Platform;
• Matching Family Subscribers and Care Recipients with suitable verified Caregivers;
• Scheduling, delivering, and documenting Shifts, including Care Logs, vitals, medication records, and incident reports;
• Verifying Caregiver attendance through GPS check-in and check-out during active Shifts;
• Processing subscription billing, wallet funding, and weekly Caregiver payouts;
• Sending care-related notifications, alerts, and escalation communications;
• Verifying Caregiver identity, licences, and certifications to safeguard Care Recipients;
• Assessing, improving, and developing our services, using anonymised or de-identified data where practicable;
• Fulfilling legal or regulatory obligations and protecting SabiCare365, its users, and Care Recipients against fraud and abuse;
• Maintaining audit, compliance, and historical care records, and resolving disputes.

4. How We Collect Personal Data

SabiCare365 collects personal information directly from data subjects and, where necessary, from authorised third parties. Collection methods include:

4.1 Direct Collection

• Registration and onboarding forms for Family Subscribers and Caregivers;
• Care Recipient profile information provided by Family Subscribers;
• Caregiver verification and certification documents;
• Care Logs, incident reports, vitals, and observations submitted through the Platform;
• GPS check-in and check-out data captured during active Shifts;
• Payment, wallet, and bank account details for billing and payouts;
• Enquiry, feedback, and support communications, including recorded support calls where applicable;
• Electronic means such as emails and in-app messages.

4.2 Third-Party Sources

• Family Members authorised by a Family Subscriber to assist with care coordination;
• Identity and background verification providers used to vet Caregivers;
• Payment and financial service providers that facilitate billing and payouts.

Where data is obtained from a third-party source, consent will be obtained from the data subject where required by law.

5. Cookies

SabiCare365's websites use cookies to understand how visitors use the site and to improve their experience. Where required, visitors are given the option to accept or decline non-essential cookies during their browsing session, through a clear dialogue in plain language. Records of consent are kept securely as evidence that consent was received. Visitors can also manage cookies through their browser settings.

6. Marketing

• SabiCare365 will obtain the data subject's consent, where required, before using their personal information for marketing, and provides marketing communications that are relevant to users' needs and usage patterns;
• Data subjects may unsubscribe at any time by following the unsubscribe instructions in any marketing email or by contacting SabiCare365 using the details in this Policy;
• SabiCare365 may run marketing campaigns on social media and digital advertising based on general demographics and interests. Individual personal information is not used for these campaigns. To avoid seeing such campaigns, data subjects should adjust the preference, cookie, and browser settings within the relevant platform.

7. Disclosure of Personal Data

7.1 Disclosures to Employees

SabiCare365 employees access personal data strictly on a "need to know" basis in order to perform their roles. SabiCare365 regularly reviews who has access to its systems and data.

7.2 Disclosures to Third Parties

SabiCare365 may disclose personal information to the following categories of third parties, only to the extent necessary for the relevant purpose, and subject to appropriate confidentiality obligations:

• Service providers and sub-processors that support the Platform (for example, cloud hosting, payment processing, communications, and analytics providers);
• Identity and background verification providers used to vet Caregivers;
• Financial institutions that facilitate subscription billing and Caregiver payouts;
• Professional advisers, such as lawyers and auditors;
• Regulators and government agencies, where required by law;
• Emergency and medical services, where necessary to protect the vital interests of a Care Recipient;
• Persons authorised by the data subject to act on their behalf;
• Selected third parties in connection with a sale, merger, or transfer of the business, subject to appropriate safeguards.

Any third party receiving personal information will be informed of its confidential nature and directed to keep it strictly confidential.

8. Data Retention

SabiCare365 maintains a documented retention policy governing the different categories of information it processes. Personal information is retained only for as long as necessary for the purposes described in this Policy and to meet legal, regulatory, and legitimate business requirements, after which it is securely deleted or anonymised. In certain instances, SabiCare365 minimises or de-identifies personal data for statistical or analytical activities, in accordance with applicable data protection laws.

9. Your Rights

In accordance with the NDPA, data subjects have the following rights in respect of their personal information:

• Right to access: to obtain a copy of the personal information SabiCare365 holds about them.
• Right to rectification: to request correction of inaccurate or incomplete information.
• Right to erasure: to request deletion of their information in certain circumstances, subject to legal and regulatory retention obligations.
• Right to restriction of processing: to request that SabiCare365 restrict processing in defined circumstances.
• Right to data portability: to request transfer of information they provided to another party.
• Right to object: to object to processing for marketing or, in certain cases, on grounds relating to their situation.
• Right to lodge a complaint: to complain to SabiCare365 and to the Nigeria Data Protection Commission.

Data subjects may exercise these rights by submitting a written request to legal@sabicare365.com. SabiCare365 will acknowledge receipt and respond within the timeframe required by applicable law. Where SabiCare365 cannot comply — for example, because of a legal or regulatory obligation — it will explain why.

10. Social Media Platforms

Data subjects may choose to engage with blogs, forums, or other social media platforms operated by SabiCare365 to share content. SabiCare365 is not responsible for personal information that a data subject chooses to share on such platforms and that is subsequently used or appropriated by another user. Data subjects should review the privacy statements of those services before using them.

11. Contact Us

For any questions, requests, or complaints regarding this Privacy Policy or your personal data, please contact:

• Data Protection Officer: legal@sabicare365.com
• Privacy Enquiries: legal@sabicare365.com
• Regulator (Nigeria): Nigeria Data Protection Commission — www.ndpc.gov.ng