Privacy Policy

The Centre for Clinical Care & Clinical Research Nigeria (CCCRN) is dedicated to safeguarding the personal privacy, fundamental rights, and data dignity of every individual who interacts with our organization. This Privacy Policy delineates how CCCRN collects, processes, protects, and discloses personal and health data in strict compliance with the Nigeria Data Protection Act (NDPA 2023), the Nigeria Data Protection Regulation (NDPR), the National Code for Health Research Ethics, and applicable international privacy standards.

This policy applies to all visitors to our website, program participants, job applicants, donors, partners, and digital portal users.

1. Principles of Data Protection

In handling personal data, CCCRN adheres rigorously to the foundational data protection principles codified in Section 24 of the NDPA 2023:

• Lawfulness, Fairness & Transparency: Personal data is collected and processed with clear legal justification, in good faith, and with open disclosure to data subjects.
• Purpose Limitation: Information is collected for specified, explicit, and legitimate public health and organizational purposes and not processed in ways incompatible with those purposes.
• Data Minimization: We only collect information that is adequate, relevant, and strictly necessary for stated activities.
• Accuracy: We implement reasonable controls to ensure personal data is accurate, complete, and kept up to date.
• Storage Limitation: Personal data is retained only for the duration necessary to accomplish the intended purpose or to satisfy statutory and ethical record-keeping mandates.
• Integrity & Confidentiality: Data is safeguarded against unauthorized or unlawful processing, accidental loss, destruction, or compromise using state-of-the-art technological and organizational measures.

2. Categories of Information We Collect

A. Information You Voluntarily Provide

• General Inquiries & Feedback: Full name, email address, telephone number, organization, and the content of your message when you complete our public contact forms.
• Employment & Fellowship Applications: Curriculum vitae (CV), academic transcripts, professional medical registrations, employment history, identity verification documents, referee contact details, and applicant demographic details submitted via our Careers portal.
• Partnership & Grants Correspondence: Institutional details, designated representative information, official proposals, and contractual contact information.
• Charitable Donations: Donor name, billing address, transaction receipts, and payment references (payment card details are processed directly through PCI-DSS compliant financial gateways and are never stored on CCCRN servers).

B. Technical & Device Information Automatically Collected

• Internet Protocol (IP) address, approximate geolocation, browser type and version, operating system, referring URL, pages viewed, session duration, and crash log telemetry collected to maintain server stability and site security.

C. Clinical & Public Health Research Data

• Clinical health records, laboratory test metrics, and epidemiological observations collected in our supported facilities are processed under stringent biomedical confidentiality protocols. Public-facing platforms display only aggregated, fully anonymized, or de-identified datasets from which individual participant identities cannot be reverse-engineered.

3. Lawful Bases for Processing

In accordance with Section 25 of the NDPA 2023, CCCRN processes your personal data under one or more of the following legal grounds:

1. Consent: Where you have granted clear, explicit consent for a specific processing purpose (e.g., newsletter subscriptions, contact inquiries, application submissions).
2. Performance of a Contract: Where processing is required to execute an employment contract, grant agreement, procurement order, or institutional partnership.
3. Compliance with Legal Obligations: Where processing is mandated by Nigerian statutory laws, public health reporting frameworks, or financial auditing requirements.
4. Public Interest in Health & Epidemiology: For reasons of public interest in the area of public health, such as protecting against serious cross-border threats to health, monitoring epidemic diseases, or maintaining clinical standards of medicinal care.
5. Legitimate Interests: Where processing is necessary for the legitimate operational, administrative, or analytical needs of CCCRN, without overriding your fundamental privacy rights.

4. How We Use Collected Information

CCCRN utilizes collected personal data exclusively for lawful and legitimate purposes, including:

• Responding promptly to your public inquiries, technical support requests, and collaboration proposals.
• Evaluating credentials, conducting background and ethical credential verifications, and processing job applications.
• Managing grant implementations, monitoring clinical service delivery, and reporting verified outcomes to public health authorities and donors.
• Publishing periodic programmatic impact reports, newsletters, and scientific dissemination bulletins.
• Maintaining platform integrity, detecting and mitigating cybersecurity threats, and preventing unauthorized system intrusions.
• Meeting legal, audit, and statutory regulatory obligations under Nigerian law.

5. Information Sharing & Third-Party Disclosures

CCCRN does not sell, lease, commercialize, or trade personal data to third parties for marketing or commercial profit. We only disclose personal information under the following controlled circumstances:

• Statutory Public Health Authorities: Sharing epidemiological notifications, disease surveillance metrics, and programmatic summaries with the Federal Ministry of Health (FMOH), the Nigeria Centre for Disease Control (NCDC), and State Ministries of Health as mandated by law.
• Institutional Funding Partners: Providing verified programmatic progress metrics and audit validations to funding entities (such as CDC/PEPFAR and the Global Fund) in accordance with bilateral grant agreements.
• Vetted Service Providers: Cloud infrastructure hosting, email dispatch, and database management vendors operating under binding Data Processing Agreements (DPAs) requiring strict adherence to NDPA 2023 confidentiality and security standards.
• Legal Compulsion: When required by a valid court order, subpoena, or lawful warrant issued by a competent Nigerian court or authorized regulatory authority.

6. Information Security & Technical Safeguards

CCCRN employs defense-in-depth technical, physical, and organizational safeguards to protect your personal information against unauthorized access, loss, alteration, or disclosure:

• Data Encryption: TLS 1.3 cryptographic encryption for all web communications and data transmissions; AES-256 encryption for data at rest on enterprise databases.
• Access Governance: Granular Role-Based Access Controls (RBAC), multi-factor authentication (MFA) for administrative staff, and automated audit trails tracking all record modifications.
• Network Defense: Cloud firewalls, continuous intrusion detection and prevention systems (IDS/IPS), regular security patching, and independent vulnerability assessments.
• Staff Capacity Building: Regular mandatory data privacy, ethics, and cyber-hygiene training for all healthcare providers, researchers, and administrative personnel.

7. Cookies & Tracking Technologies

Our website utilizes standard session cookies and anonymous analytical tokens to optimize user navigation, remember interface preferences, and analyze aggregate visitor traffic patterns.

• Essential Cookies: Necessary for core website functionality, security authentication, and session persistence.
• Analytical Cookies: Used to evaluate aggregate traffic volumes and identify popular pages, helping us enhance user experience (e.g., Google Analytics with IP anonymization).
• You may adjust your browser settings to decline or delete cookies at any time; however, certain interactive platform functions may be impaired as a result.

8. Data Retention & Responsible Disposal

Personal data is retained only for the duration necessary to fulfill the specific purposes for which it was gathered, or as mandated by statutory, regulatory, clinical trial, and donor retention standards.

• General contact inquiries are retained for up to twelve (12) months following resolution.
• Unsuccessful employment applications are archived securely for up to twelve (12) months before permanent, irreversible deletion.
• Institutional research records and audit-related financial documentation are preserved in accordance with ethical committee approvals and donor grant specifications (typically 5 to 7 years), followed by certified cryptographic shredding.

9. Your Rights as a Data Subject (NDPA 2023)

Under the Nigeria Data Protection Act 2023, you are endowed with fundamental rights concerning your personal data, which you may exercise at any time without fee or prejudice:

1. Right of Access: You have the right to request confirmation of whether we process your personal data and to obtain a copy of such data.
2. Right to Rectification: You may request the correction of incomplete, out-of-date, or inaccurate personal information.
3. Right to Erasure (Right to be Forgotten): You have the right to request the deletion of your personal data where retention is no longer legally justified.
4. Right to Restrict Processing: You may request that we temporarily suspend processing of your data under specific statutory conditions.
5. Right to Data Portability: You may request a structured, commonly used, and machine-readable copy of your data for transfer to another controller.
6. Right to Object: You may object to data processing based on legitimate interests or direct communications.
7. Right to Withdraw Consent: Where processing is founded on consent, you may withdraw your consent at any time without impacting prior lawful processing.

To exercise any of these rights, please submit a written request to our Data Protection Officer at dpo@cccrnigeria.org. We will respond within thirty (30) days as stipulated by the NDPA.

10. Children & Pediatric Health Privacy

Protecting the privacy of children is of paramount importance to CCCRN. Our public website is not directed at children under the age of 13. In our community healthcare and pediatric HIV/TB interventions, any processing of children's health or identification data is conducted strictly with documented parental or legal guardian consent and overseen by accredited Health Research Ethics Committees.

11. Cross-Border Data Transfers

Whenever personal or research data is transferred outside Nigeria (e.g., to international collaborating universities, specialized laboratory testing centers, or secure multi-region cloud services), CCCRN ensures that:

• The recipient jurisdiction guarantees an adequate level of data protection as recognized by the Nigeria Data Protection Commission (NDPC); or
• The transfer is governed by Standard Contractual Clauses (SCCs), binding corporate rules, or explicit participant consent under approved institutional ethical protocols.

12. Updates to this Privacy Policy

CCCRN reserves the right to amend or update this Privacy Policy periodically to reflect evolving legal mandates, regulatory guidelines from the NDPC, or organizational operational enhancements. Any modifications will be posted promptly on this page with an updated "Effective Date". We encourage you to review this policy periodically.

13. Data Protection Officer (DPO) Contact Details

If you have questions, concerns, complaints, or inquiries regarding this Privacy Policy or CCCRN's data handling practices, please contact our designated Data Protection Officer:

• Designation: Data Protection & Compliance Officer
• Organization: Centre for Clinical Care & Clinical Research Nigeria (CCCRN)
• Headquarters: Plot 590, Cadastral Zone B02, Durumi District, Abuja, FCT, Nigeria
• Direct DPO Email: dpo@cccrnigeria.org
• General Inquiries: info@cccrnigeria.org
• Telephone: +234 9 291 5440
• Supervisory Authority: If you believe that your privacy rights have been infringed, you also maintain the right to lodge a formal complaint with the Nigeria Data Protection Commission (NDPC) at https://ndpc.gov.ng.