Privacy Policy

Effective date: 1st October 2026  |  Version: 1.2.1  |  Last updated: 1st October 2026

1. Who we are and what this policy covers

HEALTH EMERGENCY INITIATIVE FOR INDIGENT PATIENTS (“HEI”, “we”, “us”, “our”) is a not-for-profit organisation registered in Nigeria, CAC Reg No: RC – 89370, with its office at 2 Ayinde Giwa St, Surulere, Lagos 100001, Lagos, Nigeria. We help vulnerable Nigerians get emergency care when every minute matters.

This Privacy Policy explains how we collect, use, share and protect your personal data when you visit https://hei.org.ng (the “Website”), donate, buy from the HEI Shop, enroll in HEI Academy courses, register for events, volunteer, apply for a job, partner with us, or otherwise deal with us.

HEI is the data controller of the personal data described in this policy. We process personal data in line with the Nigeria Data Protection Act 2023 (NDPA) and the regulations and directives of the Nigeria Data Protection Commission (NDPC). Our Data Protection Officer can be reached at: Godwin Chibuike and [email protected].

2. Personal data we collect

Information you give us

  • Contact and identity details: name, email address, phone number, postal address, organisation and job title.
  • Donation and partnership details: gift amount and frequency, payment reference and your preferences, such as giving anonymously. We do not see or store your full card number or bank login. Payments are handled by our payment partners.
  • Order details for the HEI Shop: items bought, delivery address and order history.
  • Course and training details: account username, enrolment, attendance, progress, assessment results and certificates.
  • Event details: registration information and any dietary or access needs you choose to share.
  • Volunteer and job applications: CV, work history, motivation, availability and referees.
  • Messages and submissions: enquiries, comments, survey answers, and stories, photos or videos you send us.
  • Your communication and marketing preferences.

Information collected automatically

  • IP address, device type, browser, operating system, pages visited, time spent, referring website, and approximate location derived from your IP address. We collect this through cookies and similar technologies (see section 8).

Information from others

  • Donation details that GlobalGiving or another payment platform shares with us when you give through them.
  • Information from partner hospitals, schools and agencies, where needed to verify and support beneficiaries.
  • Information you make public on social media when you tag or message us.

3. Sensitive data and children’s data

Some of the data we handle is sensitive personal data under the NDPA, in particular health information about patients and beneficiaries (for example, a child’s condition or treatment needs). We collect and use it only where we have explicit consent (or that of a parent or guardian), where it is necessary to protect someone’s vital interests, or where another lawful ground under the NDPA applies. Access is limited to staff and partners who need it to verify cases and fund care.

We work with children, including through schools, our Emergency Health Education programme and our malnutrition work. In Nigeria, a child is a person under 18. We do not knowingly collect personal data from a child through the Website without the verifiable consent of a parent or guardian. Where we collect data about children for programme delivery, we do so with parental or guardian consent, or through a school or institution acting with proper authority, and we keep it to the minimum necessary. If you believe a child has given us data without consent, contact us and we will delete it.

4. How we use your data and our lawful bases

  • Processing donations, issuing receipts and thanking you. Basis: contract, legitimate interests and legal obligation (financial records).
  • Fulfilling orders and course enrolments, delivering training and issuing certificates. Basis: contract.
  • Running and verifying programmes and supporting beneficiaries. Basis: consent, vital interests and legitimate interests. Where we report to donors and funders, we use anonymised or aggregated data wherever possible.
  • Sending updates, newsletters and fundraising appeals. Basis: consent, and legitimate interests for existing supporters where the law allows. You can opt out at any time.
  • Managing volunteers, job applicants, event attendees and partners. Basis: contract (including steps before a contract), consent and legitimate interests.
  • Responding to enquiries and moderating comments. Basis: legitimate interests.
  • Securing and improving the Website and preventing fraud. Basis: legitimate interests.
  • Meeting legal, accounting, tax and regulatory duties, including anti-money-laundering checks. Basis: legal obligation.
  • Sharing beneficiary stories, photos and videos. Basis: consent (see section 6).

5. Marketing and fundraising communications

We will contact you about our work and campaigns by email, phone, SMS or messaging apps only where you have agreed or where the law allows. Every email includes an unsubscribe link, and you can also write to [email protected] at any time. We never sell or rent your personal data to anyone.

6. Photographs, videos and beneficiary stories

Stories make our work real, and the people in them deserve control over how they are told. We publish identifiable photos, videos or stories of beneficiaries, volunteers and trainees only with their consent (or a parent’s or guardian’s consent for a child). Where safety or dignity calls for it, we change names or blur identifying details.

You can withdraw consent for future use by contacting us. We will then remove the material from channels we control, but we cannot recall material already printed, or shared or reposted by others. Photography may take place at HEI events, and notices at the venue will say so.

7. Information shared on social media and embedded content

Our Website links to or embeds content from platforms such as YouTube, Flickr, LinkedIn, Instagram, Facebook and X. These platforms may set their own cookies and collect data about you under their own privacy policies. We do not control them.

8. Cookies and similar technologies

We use cookies, which are small files stored on your device, to make the Website work and to understand how it is used.

  • Strictly necessary: keep you signed in, remember your shopping cart and course session, and protect the Website from abuse.
  • Functional: remember your preferences and learning progress.
  • Analytics: help us understand which pages are useful [Google Analytics].
  • Attribution: our shop records which source brought a visitor to an order, so we can see what is working.

We also use services such as Cloudflare, which helps secure and speed up the Website, and Google Fonts, which displays our typefaces and receives your IP address in the process.

You can control cookies through your browser settings and through our cookie prefences option. Blocking some cookies may stop the cart, login or course pages from working. We ask for your consent before setting non-essential cookies.

9. Who we share your data with

We share personal data only where necessary and only with:

  • Service providers acting on our instructions, under written agreements: web hosting and security (including Cloudflare), our website developer and maintainer, email and newsletter tools, analytics tools, payment processors (Paystack and interswitch) and delivery partners for shop orders.
  • GlobalGiving. If you donate through GlobalGiving, you leave our Website. GlobalGiving collects and processes your data under its own privacy policy and shares with us the information needed to thank and report to you. We are not responsible for its practices.
  • Partner hospitals, schools, government agencies and implementing partners, limited to what is needed to deliver care and programmes.
  • Professional advisers, auditors, banks and insurers.
  • Regulators, courts and law enforcement where required by law.
  • Funders and partners, in anonymised or aggregated form unless you have consented to more.
  • A successor organisation, if HEI’s programmes are ever merged or transferred, on the same privacy terms.

10. Transfers outside Nigeria

Some of our providers are based outside Nigeria, for example GlobalGiving in the United States and cloud, email and analytics providers. We transfer personal data abroad only where the destination offers adequate protection, or where we have put safeguards in place, such as contracts, or where you have consented, as the NDPA requires.

11. How long we keep your data

We keep personal data only as long as needed for the purposes above, then delete or anonymise it. Typical periods:

  • Donation, order and financial records: at least five years after the end of the relevant financial year.
  • Course, training and certification records: for as long as needed to verify certification, plus 5 years.
  • Beneficiary case files: for the programme and audit period, then [5] years.
  • Unsuccessful volunteer and job applications: 12 months after the process ends, unless you ask us to keep them longer.
  • Newsletter subscriptions: until you unsubscribe.
  • Website logs: up to 12 months.
  • Photos and videos: until you withdraw consent or the content is retired.

12. Security and data breaches

We use appropriate technical and organisational measures, including encrypted connections (HTTPS), access controls, regular backups, staff training and checks on our suppliers. No system is completely secure, so we cannot guarantee absolute security. If a breach is likely to put your rights at risk, we will notify the NDPC within 72 hours of becoming aware of it, and we will tell affected individuals without undue delay where the risk is high.

13. Your rights

Under the NDPA you have the right to:

  • be informed about how we use your data;
  • access your data and receive a copy;
  • have inaccurate data corrected;
  • have your data deleted, where the law allows;
  • restrict our use of your data;
  • object to processing, including an absolute right to object to direct marketing;
  • receive your data in a portable format, where it applies;
  • withdraw consent at any time, without affecting earlier lawful use; and
  • not be subject to a decision based solely on automated processing that significantly affects you. We do not make such decisions.

To use any right, email [email protected]. We may ask you to verify your identity. We usually respond within one month and normally do not charge a fee.

14. Complaints

If you are unhappy with how we handle your data, please contact our DPO first so we can put it right. You also have the right to complain to the Nigeria Data Protection Commission (www.ndpc.gov.ng).

15. Changes to this policy

We may update this policy from time to time. The “Last updated” date above shows the current version. If we make a material change, we will tell you through the Website or by email.

16. Contact us

Health Emergency Initiative
2 Ayinde Giwa St, Surulere, Lagos 100001, Lagos – Nigeria
Email: [email protected]

Phone: 0706 398 5777

Data Protection Officer: Godwin Chibuike – [email protected]