Privacy Policy - GDPR & NDPR Compliance

Introduction

OJG Herbal ("we," "us," "our") is committed to protecting your privacy and personal data in accordance with:

GDPR - General Data Protection Regulation (EU) 2016/679
NDPR - Nigeria Data Protection Regulation 2019

This policy explains how we collect, use, store, and protect your personal information when you use our website and services.

Data Controller

OJG Herbal Health Assessment
Email: [email protected]
Data Protection Officer: [email protected]

Information We Collect

Personal Information You Provide:

Name and email address
Phone number
Health assessment responses (symptoms, medical history)
Payment information (processed securely via Flutterwave)
Communication preferences

Sensitive Personal Data:

Our health assessments may collect sensitive data about your:

Menstrual health and reproductive information (PCOS assessment)
Weight and body measurements
Skin conditions and health history
Lifestyle and dietary habits

We process this sensitive data only with your explicit consent for the purpose of providing personalized health recommendations.

Automatically Collected Data:

IP address and device information
Browser type and version
Pages visited and time spent
Cookies and similar tracking technologies

How We Use Your Information

We process your personal data for the following purposes:

Health Assessment: To generate personalized health plans and recommendations based on your responses
Service Delivery: To provide access to your member area, meal plans, and tracking tools
Payment Processing: To process payments securely through Flutterwave
Communication: To send you important updates about your plan and respond to inquiries
Improvement: To analyze usage and improve our services (with your consent)
Legal Compliance: To comply with applicable laws and regulations

Legal Basis for Processing (GDPR)

Consent

You have given explicit consent for processing your personal and sensitive data for health assessments and personalized recommendations.

Contract Performance

Processing is necessary to fulfill our contract when you purchase our health programs.

Legal Obligation

Processing required to comply with legal obligations (tax, accounting, consumer rights).

Your Data Protection Rights

Under GDPR and NDPR, you have the following rights:

Right to Access

Request a copy of your personal data

Right to Rectification

Correct inaccurate or incomplete data

Right to Erasure

Request deletion of your data ("right to be forgotten")

Right to Restrict Processing

Limit how we use your data

Right to Data Portability

Receive your data in a structured, machine-readable format

Right to Object

Object to certain processing activities

Right to Withdraw Consent

Withdraw consent at any time

Right to Lodge Complaint

File complaint with supervisory authority

To exercise these rights, contact us at [email protected]

How We Share Your Information

We do NOT sell your personal data. We only share data with:

Service Providers: Trusted third parties who help us operate (hosting, payment processing via Flutterwave, email delivery)
Legal Authorities: When required by law or to protect rights
Business Transfers: In connection with merger or sale (with notice)

Data Retention

We retain your personal data only as long as necessary:

Active customers: Duration of your plan plus 2 years
Assessment data: 2 years from last interaction
Payment records: 7 years (legal requirement)
Consent records: 3 years (NDPR requirement)

After these periods, data is anonymized or securely deleted.

Cookies and Tracking

We use cookies and similar technologies to enhance your experience:

Essential: Required for website functionality (login, security)
Analytics: Help us understand website usage (with your consent)