Draft for review. Prepared 20 October 2026 for Dr. Busayo and a Nigerian data-protection or legal adviser to check and complete. Remove this note once approved.
Last updated: [TBC: date of approval].
This policy explains how Dr. Busayo’s website, drbusayo.com, collects and uses personal data for Mindbulb Health Clinic, Mindbulb Health Foundation and Hope and Healing Ministry. We follow the Nigeria Data Protection Act 2023 (NDPA) and, for people in the UK and European Union, the UK GDPR and EU GDPR.
Who we are
The data controller is [TBC: legal name of the business or businesses, e.g. Mindbulb Health Ltd, RC number, registered address]. If the Foundation or the Ministry is a separate legal entity, it is the controller for its own donations and partnerships: [TBC: confirm entities].
Contact us about privacy at info@drbusayo.com. [TBC: name of the Data Protection Officer, if appointed under the NDPA]
What we collect and why
- Booking a session: your name, email, phone or WhatsApp number, the service, date and time, a short reason for your visit, and the time you agreed to this policy. [TBC: add age and video or audio preference once those fields are switched on] We use this to arrange and run your appointment and to contact you about it. Legal basis: to provide the service you asked for, and your explicit consent, because the reason for your visit can reveal health information (sensitive personal data under the NDPA).
- Payments: handled by Paystack or Flutterwave on their own secure pages. We never see or store your card details. We receive confirmation of the payment, the amount and the email you used.
- Contact, speaking, volunteering, partnership and prayer forms: the details you type in are sent to our team by email so we can reply. They are not stored on this website. A prayer request can be anonymous.
- Testimonials: what you submit is saved for review and published only after you approve the final wording in writing. We use first names or initials only.
- Newsletter: your email address and the updates you chose (clinic, Foundation, ministry), to send you those updates. You can unsubscribe at any time. Legal basis: consent.
- Donations and partnership gifts: made on Paystack or Flutterwave pages. If you give your name and email on our form, we pass them to that page so you don’t have to type them twice.
We ask only for what we need. Please don’t share detailed medical history in website forms: you will discuss it privately with Dr. Busayo. Clinical notes are never kept in website forms.
Who we share it with
- Payment providers: Paystack and Flutterwave (when you pay or give).
- Our website host: [TBC: Namecheap, Inc. (servers location to confirm)], which stores the website and its database.
- Our email provider: [TBC: e.g. the domain mailbox or Brevo], which delivers form messages and booking emails.
- Video sessions: [TBC: Zoom or Google Meet], which creates the meeting link for your appointment.
- WhatsApp (Meta) if you choose to message us there, and for booking messages once those are switched on.
- YouTube (Google): pages with videos load a preview image from YouTube; the video itself loads from youtube-nocookie.com only when you press play.
We do not sell your data or use it for advertising. Some of these providers process data outside Nigeria; where they do, we rely on safeguards recognised under the NDPA and GDPR. [TBC: confirm transfer basis with adviser]
How long we keep it
- Booking records: [TBC: period required for medical records in Nigeria, e.g. as advised].
- Form emails: [TBC: e.g. 24 months], then deleted.
- Testimonials: until you ask us to remove them.
- Newsletter: until you unsubscribe.
Your rights
You can ask to see the data we hold about you, correct it, delete it, restrict or object to how we use it, receive a copy to take elsewhere, and withdraw consent at any time (this does not affect what we did before). Email info@drbusayo.com. We reply within [TBC: 30 days].
If you are unhappy with our answer you can complain to the Nigeria Data Protection Commission (ndpc.gov.ng), or, in the UK, the Information Commissioner’s Office (ico.org.uk), or your local data protection authority in the EU.
Young people
Under the NDPA a child is anyone under 18. We need a parent’s or guardian’s consent before booking a session for, or collecting data from, anyone under 18. [TBC: confirm the clinic’s process for adolescent clients]
Security
The website uses an encrypted connection (HTTPS), keeps software up to date, limits staff access and takes regular backups. No system is perfectly secure; if a breach affects you, we will tell you and the Nigeria Data Protection Commission as the law requires.
Cookies
See our cookie notice.
Changes
We will post any changes on this page and update the date at the top.