Legal

Privacy Policy

Last updated: 12 September 2026

Steryl Health Ltd ("Steryl", "we", "us") operates a healthcare supply and inventory platform used by hospitals, diagnostic centres, pharmacies, manufacturers and distributors. This policy explains what personal information we collect, why we collect it, and the choices you have.

We are the data controller for the information described here. Our processing is governed by the Nigeria Data Protection Act and the regulations issued by the Nigeria Data Protection Commission (NDPC).

1. Information we collect

Information you give us

Account and organisation details — name, work email, phone number, organisation name, and licence or accreditation numbers supplied during registration.
Operational records — products, batches, stock levels, orders, approvals, shipments and the departments you create inside your workspace.
Support content — the subject, description and attachments of any ticket or message you send us.
Verification documents — regulatory licences and supporting documents submitted for organisation verification.

Information we collect automatically

Technical data — IP address, browser and device type, and the pages you visit.
Usage data — actions taken in the platform, recorded so that stock movements and administrative changes can be audited.
Session data — a cookie that keeps you signed in, and one that protects forms against cross-site request forgery.

Information about patients

Steryl is a supply-chain and inventory system. It is not designed to hold patient medical records, and you should not enter patient-identifiable clinical data into it. Where a customer chooses to store such data, they do so as the controller of that data and Steryl acts only on their instructions.

2. How we use your information

To create and administer your account and your organisation's workspace.
To verify the licences and regulatory standing of organisations joining the platform.
To operate the platform's core functions — inventory, ordering, approvals, shipments and label verification.
To provide support, respond to enquiries, and handle password reset and account recovery requests.
To keep an audit trail of administrative and stock actions, so that activity can be reviewed.
To maintain the security and integrity of the platform and detect misuse.
To meet our legal and regulatory obligations.
To send service messages such as security notices and material changes to these terms.

3. Legal basis for processing

We rely on the following bases, as provided for under Nigerian data protection law:

Performance of a contract — to provide the platform your organisation has signed up for.
Legal obligation — for record-keeping, tax and regulatory compliance.
Legitimate interests — to secure the platform, prevent fraud and misuse, and keep auditable records. We balance these against your rights.
Consent — for anything optional, such as marketing communications. You can withdraw consent at any time.
Vital interests — where necessary to protect someone's health, for example in a product recall or safety notice.

4. Sharing your information

We do not sell personal information. We share it only in these circumstances:

Within your organisation — administrators of your organisation can see the accounts and activity belonging to your organisation.
With the counterparties to a transaction — for example, a distributor sees the order your organisation places, and the details needed to fulfil and deliver it.
With service providers — hosting, database and infrastructure providers who process data on our behalf under contract, including our cloud database and application hosting providers.
For legal reasons — where required by law, regulation, court order, or a request from a competent authority.
In a business transfer — if the business is reorganised, merged or sold, information may transfer as part of that transaction, subject to this policy.

5. Public batch verification

Every Steryl label carries a QR code that resolves to a public verification page. That page shows the batch number, product, manufacturer and expiry date so that anyone — including a patient — can confirm authenticity. It deliberately does not display customer identities, order details, pricing or quantities, and it does not reveal who purchased the batch.

6. How long we keep information

We keep account and operational records for as long as your organisation's account is active. After closure we retain records for a further period where required for legal, tax, regulatory or audit purposes, and then delete or anonymise them. Audit logs are retained because their purpose is to preserve a reliable history of what happened to regulated stock.

7. Security

Passwords are stored as salted hashes, never in plain text.
Data is transmitted over encrypted connections and held in an encrypted managed database.
Access within Steryl is restricted to personnel who need it, and administrative actions on the platform are logged.
We keep security patches current and monitor for unauthorised access.

No system is perfectly secure. If you believe your account has been compromised, contact us immediately at security@sterylhealth.com.

8. Your rights

Subject to certain limits, you have the right to:

Be informed about how your data is used — this policy is part of that.
Access the personal information we hold about you.
Correct information that is inaccurate or incomplete.
Delete information where we no longer have a lawful reason to keep it.
Restrict or object to certain processing, including processing based on legitimate interests.
Portability — receive the information you provided in a structured, commonly used format.
Withdraw consent at any time where processing is based on consent.
Complain to the Nigeria Data Protection Commission if you are unhappy with our response.

Many of these rights can be exercised directly from within the platform. For anything else, email privacy@sterylhealth.com. We aim to respond within 30 days.

9. Cookies

We use a small number of cookies that are necessary for the platform to work: a session cookie that keeps you signed in, a "remember me" cookie if you ask us to, and a security token that protects submitted forms. We do not use third-party advertising or cross-site tracking cookies.

10. Children

The platform is intended for use by healthcare professionals and organisations. It is not directed at children, and we do not knowingly collect information from anyone under 18.

11. International transfers

Our infrastructure providers may store data in data centres outside Nigeria. Where information is transferred internationally, we require appropriate safeguards and contractual protections consistent with Nigerian data protection law.

12. Changes to this policy

We may update this policy as the platform and the law evolve. Material changes will be notified to organisation administrators, and the "last updated" date at the top will change. Continuing to use the platform after an update means you accept the revised policy.

13. Contact us

Steryl Health Ltd
Lagos, Nigeria
Privacy: privacy@sterylhealth.com
Security: security@sterylhealth.com
General: hello@sterylhealth.com
Phone: +234 706 716 4507

You can also reach us through the contact form.