Who We Are

Zivoko is a pharmacist-led healthcare access platform operating at www.zivoko.ng. We provide access to HIV prevention medications, including PEP and oral PrEP, alongside injectable PrEP options (CAB-LA and lenacapavir) as they become available, as well as HIV self-testing options and sexual health support, through a coordinated network of pharmacy and logistics partners across Nigeria.

Because we operate in the healthcare space and handle sensitive personal and health-related information, we take your privacy seriously. This policy is governed by the Nigeria Data Protection Act (NDPA) 2023 and applies to all users of our website and services.

What Data We Collect

We collect information in the following categories:

Personal identification data

• Full name, phone number, and delivery address provided at checkout.
• Email address, where provided for order confirmation or support.

Health-related data

• Medication orders, including the type of HIV prevention medication or sexual health product ordered.
• Risk assessment responses submitted voluntarily through our platform or via WhatsApp consultation.
• Information shared during pharmacist verification for prescription-required medications.

Transaction and delivery data

• Order history, payment method type (not full card details), and transaction references.
• Delivery address and logistics tracking information.

Technical and usage data

• IP address, browser type, and device information collected automatically when you visit our website.
• Pages viewed and interactions recorded through standard web analytics tools.
• Cookies, as described in Section 6 below.

Communication data

• Messages sent to us via WhatsApp, email, or our website contact form.
• Comments left on our website, including your name, email, and IP address.

How We Use Your Data

We use your data only for the purposes listed below:

• Fulfilling your order: processing, verifying, and delivering your medication or product.
• Pharmacist verification: confirming suitability for prescription-required medications such as PEP and PrEP.
• Post-delivery support: sending dosing guidance, missed dose advice, side effect information, and follow-up testing reminders via WhatsApp where applicable.
• Customer support: responding to queries, complaints, and return or refund requests.
• Legal and regulatory compliance: maintaining records as required under Nigerian pharmaceutical and data protection law.
• Service improvement: understanding how our platform is used to improve content, coverage, and user experience. This uses aggregated, anonymised data only.
• Spam prevention: IP addresses and browser data are used to detect and prevent fraudulent activity.

We do not use your data for unsolicited marketing without your explicit consent.

Who We Share Your Data With

We share your data only where necessary to deliver our services. The categories of third parties are:

• Pharmacy partners: licensed pharmacy partners in our network receive relevant order and health data to dispense and verify your medication safely.
• Logistics and courier partners: your name, phone number, and delivery address are shared with our delivery partners to complete your order.
• Payment processors: your transaction is processed through a secure payment gateway. We do not store your full card details. Payment processors are bound by their own PCI-DSS compliant privacy policies.
• WhatsApp (Meta): communications conducted via WhatsApp are subject to Meta’s privacy policy. We recommend reviewing it at whatsapp.com/legal/privacy-policy.
• Gravatar (Automattic): if you leave a comment on our site, an anonymised hash of your email may be sent to Gravatar to check for a profile picture. Gravatar’s privacy policy is available at automattic.com/privacy.
• Spam detection services: visitor comments may be checked through an automated spam detection service.

Sensitive Health Information

By using Zivoko’s services, you may voluntarily share information related to your health status, HIV risk, or sexual health. We treat this with the highest level of care and confidentiality.

• Health data is used solely to provide safe, appropriate care and to fulfil your order.
• It is accessible only to the pharmacist or clinician handling your order, and is not shared beyond what is operationally necessary.
• All staff and pharmacy partners handling sensitive data are bound by confidentiality obligations.
• We do not reference the nature of your order on your packaging, delivery label, or any external-facing communication.

Cookies

Cookies are small files stored on your device that help our website function and remember your preferences. We use the following types:

• Comment cookies: if you leave a comment on our site, you may opt in to saving your name, email, and website in cookies for convenience. These last for one year.
• Session cookies: a temporary cookie is set when you visit our login page to check whether your browser accepts cookies. It contains no personal data and is discarded when you close your browser.
• Login cookies: if you log in to our site, cookies are set to save your login information and display preferences. Login cookies last two days, and screen option cookies last one year. Selecting “Remember Me” extends login persistence to two weeks. Logging out removes all login cookies.
• Editorial cookies: if you edit or publish content on our site, a cookie is saved containing the post ID of the article edited. It contains no personal data and expires after one day.

You can control cookie settings through your browser. Disabling cookies may affect some features of the website.

Embedded Content from Other Websites

Pages on this site may include embedded content such as videos, images, or articles from other websites. Embedded content behaves as if you had visited those websites directly. They may collect data about you, use cookies, and monitor your interaction with that content, particularly if you have an account and are logged in to those platforms.

Media Uploads

If you upload images to this website, please ensure they do not contain embedded location data (EXIF GPS). Visitors to the website can download and extract location data from any images published on the site.

How Long We Retain Your Data

• Order and health records: retained for a minimum of five years to comply with Nigerian pharmaceutical regulations and for audit purposes.
• Comments: retained indefinitely to support moderation and to recognise returning commenters automatically.
• User profile data: retained for as long as your account exists. You may request deletion at any time (see Section 10).
• WhatsApp communications: retained for as long as necessary to support your care and resolve any disputes, after which they are deleted.
• Technical and analytics data: retained in aggregated, anonymised form for service improvement purposes.

Your Rights

Under the Nigeria Data Protection Act (NDPA) 2023, you have the following rights regarding your personal data:

• Right of access: you can request a copy of the personal data we hold about you.
• Right to rectification: you can request correction of inaccurate or incomplete data.
• Right to erasure: you can request deletion of your personal data, except where we are legally required to retain it.
• Right to data portability: you can request an export of your personal data in a readable format.
• Right to object: you can object to the processing of your data for specific purposes, including direct marketing.
• Right to withdraw consent: where processing is based on consent, you may withdraw it at any time without affecting the lawfulness of prior processing.

To exercise any of these rights, please contact us using the details in Section 12. We will respond within 30 days.

Data Security

We implement appropriate technical and organisational measures to protect your data against unauthorised access, loss, or disclosure. These include:

• Secure HTTPS encryption across our website.
• Access controls limiting who within our team can view sensitive health and order data.
• Confidentiality obligations for all staff and third-party partners handling personal data.
• Use of PCI-DSS compliant payment processors. We do not store card details on our servers.

In the event of a data breach that affects your rights, we will notify you and the relevant regulatory authority as required by the NDPA 2023.

Contact & Data Queries

For any questions about this privacy policy, to exercise your data rights, or to raise a concern about how your data has been handled, please contact us: