Privacy Policy

RadFAQS ("we," "us," "our") is a Nigerian radiology directory and scan-booking platform. We help patients find diagnostic centers, request bookings, and prepare for imaging. This policy explains what information we collect, why we collect it, and how we keep it safe.

For privacy questions or to exercise your data rights, contact us at privacy@radfaqs.com.

We collect the following categories of information:

• Contact details: the name, email address, and phone number you provide when you make a request. Patients do not create an account. Partner centers and authorised staff have accounts holding a name, email, and role.
• Health and clinical information: the details you enter on a request card — date of birth, sex, allergies, current medications, clinical indication or symptoms, urgency, side of body, and referring-doctor details — plus an optional referral document (PDF or image) you may choose to upload when booking a scan or asking for scan guide call support. We do not collect or store diagnostic imaging (X-Ray, CT, MRI, ultrasound) for interpretation.
• Payment information: we do not store full card numbers. Payments are processed by Paystack; we retain a payment reference, the amount, and the transaction status.
• Usage information: pages visited, IP address, device and browser type, and similar technical logs used to understand aggregate usage and keep the service reliable and secure. Our analytics setup does not record form contents or session replays.
• Communications: booking-chat messages, messages you send our support team, and email or WhatsApp notifications you receive.
• Referral photos you send to BeamAI: if you upload a photo of a referral to our BeamAI assistant to have it explained, the image is sent to a third-party AI provider (OpenAI) to read the text, then used to generate the plain-language explanation shown back to you. This upload is processed in memory and is not saved to our systems.
• Beam-assisted booking replies: an authorised center team member may ask Beam to prepare a draft reply to your latest booking question. Direct contact details are removed first, but the remaining text may still include health information. The text is sent to our AI provider only to prepare that draft, and the center team member must review it before anything is sent to you.

We use your information only for the purposes you would expect:

• To deliver the booking or scan guide call service you requested.
• To share your request-card details with the diagnostic center handling your booking, and with our authorised operations team.
• To send you transactional notifications (booking received, report ready, call scheduling, payment confirmation) by email or WhatsApp.
• To process payments and provide refunds.
• To improve safety, debug issues, and prevent fraud or abuse.
• To comply with legal obligations.

We do not sell your personal data, and we do not use your medical imaging or clinical history to train AI models without your explicit, separate consent.

We process personal data in line with the Nigeria Data Protection Act 2023 and other applicable Nigerian privacy requirements. The lawful bases we rely on are:

• Consent: when you upload a referral or clinical context, you give us explicit consent to share it with the diagnostic center fulfilling your request.
• Contract: to deliver the service you requested.
• Legitimate interest: to keep the platform secure and to detect fraud.
• Legal obligation: to retain records where the law requires.

• Radiographers: if you book a scan guide call, the assigned radiographer sees the referral wording, question, and contact details needed to complete that guidance call.
• Diagnostic centers: if you book through a partner center, we share the contact, scan, clinical and referral details needed for that center to review and arrange your request.
• Service providers: vetted technology partners that help us operate the platform — including cloud hosting, database and file storage, payment processing, transactional email and messaging, and the limited AI features you can choose to use. We share only the data each partner needs to perform its function.
• Legal authorities: when required by law or a valid court order.

Each service provider is bound by a contract that limits their use of your data to providing the service we engaged them for.

We take reasonable technical and organisational measures to protect your data, including encryption in transit (HTTPS), encryption at rest for stored files, role-based access controls, and short-lived signed URLs for access to medical imaging.

No system is perfectly secure. If we discover a breach affecting your personal data, we will notify you and the relevant authority in line with the Nigeria Data Protection Act 2023.

• Completed or closed bookings: booking-chat messages, uploaded referral files and direct patient or clinical identifiers are removed after 90 days. We retain a limited operational and payment record where needed for accounting, fraud prevention or legal obligations.
• Active bookings: contact, clinical and referral details are kept while the center and RadFAQS are arranging or supporting the booking. You may request deletion, subject to any record we must legally retain.
• Payment records: retained for at least 6 years as required by tax and accounting law.

Under the Nigeria Data Protection Act 2023, you may have the right to:

• Access the personal data we hold about you.
• Correct inaccurate data.
• Request deletion of your data, subject to legal retention rules.
• Object to or restrict certain processing.
• Withdraw consent at any time, where consent is the lawful basis.
• Lodge a complaint with the Nigeria Data Protection Commission (NDPC).

To exercise any of these rights, email privacy@radfaqs.com from the email address you used to make your request.

RadFAQS is not directed at children under 13. Where a child's scan is uploaded, it must be done by a parent or legal guardian who provides consent on the child's behalf.

Some of our service providers operate infrastructure outside Nigeria. Where personal data is transferred outside Nigeria, we ensure adequate safeguards through contractual commitments from those providers.

We use essential cookies to keep authorised users signed in and limited first-party analytics storage to understand aggregate page usage. We do not use advertising cookies, record session replays, or capture the contents of medical and booking forms.

We may update this policy as the service evolves. The "Last updated" date at the top of this page tells you when. Material changes will be communicated by email or in-app notice before they take effect.

Questions, requests, or complaints: privacy@radfaqs.com.