Who runs RizCare?

In short: RizCare Software Service. Write to support@riz.care with any question.

RizCare is operated by RizCare Software Service. When this page says "RizCare", "we" or "us", it means RizCare Software Service. We make the RizCare practice software, the website at riz.care, the practice portal at app.riz.care, and two apps for iPhone and Android: RizCare for Practices, for hospital staff, and RizCare, for patients.

If you have a question about this policy or about your own data, email support@riz.care.

We wrote this policy for Nigeria first. It follows the Nigeria Data Protection Act 2023, which we call "the Act", and the General Application and Implementation Directive 2025 that the Nigeria Data Protection Commission issued under it. When we mention a section, we mean a section of the Act.

Who is in charge of a patient's record?

In short: the hospital. We keep the record for the hospital and follow its instructions.

A hospital that uses RizCare decides why it keeps each patient's record and what goes into it. Under the Act, that makes the hospital the data controller. We hold and process the records for the hospital, only to run RizCare for that hospital, and only as it instructs us. We never use one hospital's patient records for another hospital, or for anything of our own.

If you are a patient, start with your hospital. It controls your record and can answer most questions fastest. Each hospital can publish its own privacy statement. If your hospital lets patients see their records online, you will find its statement there. Please read it alongside this page: it tells you what that hospital keeps about you, who at the hospital can see it and how to reach them.

We are in charge of a smaller set of information ourselves: accounts for hospitals and their staff, the accounts patients use to sign in to the RizCare app, sign-ups, messages sent through this website, and the records we need to run, protect and support RizCare.

What do we collect?

In short: what a hospital and its staff need to use RizCare, what the hospital records about its patients, and what you send us through the website.

About a hospital

When a hospital signs up, we ask for its name, its town, state and country, and how many practitioners work there. We also take the name, email address and phone number of the person setting it up. We keep a record of our agreement with the hospital and what it has paid us.

About the people who work there

For each member of staff we keep their name, email address, username, job and what the hospital allows them to do. We keep your password in a form nobody can read back, even us. If you set up a second step for signing in, we keep what that needs. We also keep a record of when you sign in, which devices you use RizCare on, and the changes you make to records, so the hospital can see who did what and when.

You can choose to sign in with Google or Apple. If you do, we keep two things: the ID your provider gives your account, and the email address the provider confirmed when you linked it. We only ask the provider to confirm who you are. We keep nothing else it sends. We get no access to your Google or Apple account, your email or your files.

About patients, entered by the hospital

Hospital staff enter what a medical record needs. That usually means a patient's name, date of birth, sex, phone number, email, address, folder number and household. It also means health information: notes, observations, history, allergies, prescriptions, lab requests and results, and, where a hospital uses them, pregnancy and admission records. Appointments, bills, payments and the letters a hospital sends are kept too. The Act treats health information as sensitive personal data (section 65), and so do we.

If a hospital lets patients see their records online, we also keep who has been given access to which record. That includes a parent or guardian. We keep what each person agreed to, such as appointment reminders.

In the practice app, RizCare for Practices

The practice app holds the same records as the portal, for the colleague who signed in on that phone. The records it keeps on the phone are encrypted, and nobody can open them without that colleague's password.

If a hospital switches on visit recording, a clinician can record a consultation. The app uses the microphone only while a recording is running, and only after the clinician confirms the patient was asked. The recording is kept on the phone, encrypted, until it has been sent to the hospital. We then send the audio to our AI provider to write down what was said, and keep that transcript with the patient's record. The audio itself is deleted once a note drafted from it is accepted, or seven days after it arrived, whichever comes first.

In the patient app, RizCare

To use the patient app you sign in with your own account. We keep your name, phone number and email address for it, and we send a one-time sign-in code to your email address. The app shows what your hospital chooses to share with you: your appointments, the records the hospital shares, your bills and your messages with the hospital. We keep the messages you send to your hospital with your record, and the staff your hospital puts on your conversation can read them.

If you unlock the app with Face ID, a fingerprint or your phone's passcode, your phone checks it. We never receive it.

In both apps

If an app fails, it sends a failure report to our error-reporting provider. It says what failed, on which version of the app and which kind of phone. It carries no name, no hospital and nothing from a record. The apps also check for and download updates to themselves from Expo, the service we build them with. Neither app shows advertising or tracks you across other apps.

When you visit riz.care

If you ask for a demonstration, we keep what you type into the form. That is your name, your hospital's name and your email. If you add them, it is also your phone number, town, number of practitioners and what you want to see first. If you came from a campaign link, the form also carries that link's campaign labels. We do not use analytics or advertising trackers on riz.care.

When something goes wrong

If part of the website, the portal or our servers fails, an error report goes to our error-reporting provider. It says what failed, when, which request it was, and which hospital and colleague were involved, if any. It never includes what is in a record, a note, a message or anything you typed. We do not record your screen or your session.

Why do we use it?

In short: to run RizCare for your hospital, to keep it safe, to send the emails it needs, and to answer you. Never to sell or advertise.

To run RizCare for the hospital. We use the hospital's and its staff's details to do what we agreed with the hospital (section 25). We handle patient records because the hospital tells us to. The Act lets health records be kept for medical care by professionals who owe a duty of confidentiality (section 30(1)(g)), so an ordinary medical record does not depend on the patient's consent. Each hospital decides its own legal basis.
To keep RizCare and its records safe. We record sign-ins and changes, look into faults and stop misuse. This is in our interest and the hospital's, and it helps the hospital meet its own duty to control who sees health records.
To send the emails RizCare needs. That means invitations, password resets, sign-up emails and receipts. It also means the letters a hospital sends its own patients, such as appointment reminders, and only to patients who agreed to them.
To write down a visit recording, if the hospital switches this on. We send the audio of a recording to our AI provider, which writes down what was said. The transcript is only a starting point for a note, and it becomes part of a note only if a clinician accepts it.
To prepare drafts, if the hospital switches this on. When a colleague asks the assistant for a draft, we send the details from the open visit that the draft needs to our AI provider. A draft is only a suggestion. It goes into the record only if a clinician reads it and accepts it. The assistant never makes a medical decision. We do not use hospital or patient records to train AI models.
To answer you. If you contact us through the website, we use what you sent to reply and arrange a demonstration. We will not send you marketing emails unless you asked for them, and you can stop them at any time.
To obey the law. We keep or share information when Nigerian law requires it.

We do not sell personal data. We do not use it for advertising. We do not turn hospital records into data sets for other uses. And nothing in RizCare makes a decision about a person that affects their rights unless a person makes that decision.

In short: only the companies that help us run RizCare, and only what each one needs.

We use these providers. Each one gets only what its part of the work needs.

Google Cloud runs our servers, our database and our websites. It also runs Vertex AI, which the drafting assistant and visit transcription use.
Expo builds our phone apps and delivers their updates.
Apple and Google distribute the phone apps through the App Store and Google Play, under their own policies.
Resend delivers the emails RizCare sends, from addresses ending in updates.riz.care. We keep a record of each letter a hospital sends, so the hospital can check later what went out.
Sentry receives the error reports described above.
Google and Apple confirm who you are, if you choose to sign in with them.
Staff calendar apps show a colleague their own appointments, if the hospital switches on calendar links. Each appointment shows its time and, as the hospital chooses, the patient's initials, no name or their full name. Why the patient is coming, their notes and their phone number and email address stay in RizCare. Those calendars are on staff members' own phones and accounts, which neither we nor the hospital manage.
Our payment provider handles card payments when a hospital takes one from a patient. It gets the amount, a payment reference and a contact for the person paying. It never gets anything medical. You type your card details on the provider's own page, and they never reach us.

We may also share information when the law requires it. If RizCare's business is ever transferred, the new owner would have to protect your data the same way.

Where is it stored?

In short: on Google Cloud in Belgium, and on your hospital's own devices. Some providers work from other countries.

Our servers, database and websites run on Google Cloud in Belgium, in the European Union. Records a hospital keeps on its own devices, including phones, stay on those devices, encrypted, until they are shared with the rest of the hospital.

Some of the work happens in other countries. Error reports are kept in Germany. The providers that send email, deliver the apps' updates and handle Google or Apple sign-in are based in the United States. The drafting assistant and visit transcription use Google's worldwide service, so Google may handle a draft request in any country where it operates. We only send personal data out of Nigeria on the grounds section 41 of the Act allows, and only to providers that promise in their contracts to protect it.

If you are unhappy with how your data is handled, the Nigeria Data Protection Commission is your main place to complain. These are the authorities in each country where your data is handled:

Nigeria: the Nigeria Data Protection Commission, ndpc.gov.ng.
Belgium: the Data Protection Authority, dataprotectionauthority.be.
Germany and the rest of the European Union: the data protection authority of the country concerned, listed by the European Data Protection Board at edpb.europa.eu.
United States: the Federal Trade Commission, ftc.gov.

We would rather hear from you first, at support@riz.care, so we can try to put it right.

How long do we keep it?

In short: patient records for as long as the hospital uses RizCare. Everything else only as long as we need it.

Patient records stay for as long as the hospital uses RizCare, and the hospital decides how long it keeps them. We do not delete anything from a record in day-to-day work. A correction is added beside what it corrects. When a hospital stops using RizCare, we agree with it how its records are handed back and then removed, unless the law says we must keep them.
Staff accounts stay while the hospital keeps that person on its team. The record of what each person did stays with the hospital's records, because it is part of their history.
Letters sent through RizCare stay with the record they belong to, for the same time.
Visit recordings. The audio is deleted once a note drafted from it is accepted, or seven days after it arrived, whichever comes first. The transcript stays with the patient's record.
Patient app accounts stay until you delete yours. Deleting it removes your name, phone number and email address from the account, as deleting your account explains. Your hospital keeps your medical record.
Sign-ups that never confirm their email address are removed after a set period.
Sign-in sessions end when they expire, and are then removed.
Website enquiries stay while we are in touch with you. Ask us and we will remove yours.
Error reports are kept by our error-reporting provider for a limited time, and then deleted.

How do we keep it safe?

In short: records are encrypted, each hospital is kept apart, and every change is tied to the person who made it.

Records kept on a device are encrypted. Nobody can open them without the colleague's password.
Everything sent between your device and our servers is encrypted.
No hospital can reach another hospital's records.
Each colleague sees and does only what the hospital allows. Anyone can add a second step to signing in.
Nobody can quietly change a signed note. A correction is a new entry, and both stay readable.
Medical and payment work is not deleted in day-to-day use. That includes work that was refused when it was sent.
Every change to a record is saved against the person who made it.

If a data breach puts people at risk, we will tell the Nigeria Data Protection Commission within 72 hours of finding out, and tell the people affected, as section 40 of the Act and the Directive require. If the breach touches a hospital's patient records, we will tell the hospital straight away so it can do what the law asks of it.

What are your rights, and how do you use them?

In short: you can ask to see, fix, move or remove your data, and you can complain to the Commission. Email us to start.

Sections 34 to 38 of the Act let you ask us to:

tell you whether we hold data about you, and give you a copy;
fix data that is wrong or incomplete;
delete data we no longer have a good reason to keep;
limit how we use your data, or stop using it where we rely on our own interests;
give you your data in a common electronic format, or send it to someone else;
stop relying on your consent, where consent is what we rely on.

You can also complain to the Nigeria Data Protection Commission at any time.

To use any of these rights, email support@riz.care. We may ask you to prove who you are first. We will reply as quickly as we can. If a right does not apply, we will tell you why. Medical records have limits: a hospital may need to keep one, and a correction is added to the record instead of replacing what was written.

If you are a patient, ask your hospital first, because it controls your record. If you write to us instead, we will pass your request to the hospital and help it answer.

Some things you can do yourself, straight away:

A patient with online access can withdraw it in one step.
A patient can delete their RizCare account from the patient app or the portal. Deleting your account says how, including if you no longer have the app.
A member of staff can sign out, and remove their account and its records from a device.
A hospital can switch the drafting assistant off.
Anyone can remove the RizCare app from their device, like any other app.

Do we use cookies?

In short: not on riz.care. The portal uses one cookie to keep you signed in, and nothing for tracking.

The website at riz.care sets no cookies. If you arrive from a campaign link, your browser holds that link's campaign labels until you close the tab, so a demonstration request can say which campaign brought you.

The practice portal at app.riz.care sets one cookie. It keeps you signed in, it is only sent to our servers, and scripts on the page cannot read it. The portal also keeps the hospital's records and any unsent work in your browser's storage, encrypted, so the team can keep working when the internet drops. It keeps a copy of its own files too, so it opens without a connection. It sets no advertising or tracking cookies.

If you sign in with Google or Apple, their sign-in window may set its own cookies, under their own policies.

What about children?

In short: hospitals record children's care. A parent or guardian acts for the child, through the hospital.

Hospitals care for children, so patient records include children's data. The hospital enters and controls it, like any other patient record. If a hospital offers online access, a parent or guardian can be given access to a child's records. That applies to a child under 13, or under 18 where the hospital allows it. A parent or guardian acts for a child, through the hospital.

Staff accounts are for adults who work at a hospital. A hospital can give a patient their own access to the patient app, including a teenager, and a parent or guardian uses their own account to see a younger child's records. The website, the software and the apps are not aimed at children.

How will we tell you about changes?

In short: we update this page, and we email hospitals before a change that affects their data.

When what we do changes, we update this page and the date at the top of it. If a change affects how a hospital's data is handled, we email the hospital before it takes effect.