Privacy Policy

Who We Are

Pen Atalanta Diagnostics Centre ("Pen Atalanta", "we", "us", or "our") is a dedicated digital radiological imaging facility registered in Nigeria under RC No. 2174361. We are located at Adex Bus-Stop, Lamidi Ajadi Street, Behind Total Filling Station, Monatan, Ibadan, Oyo State, Nigeria.

We provide diagnostic imaging services including Digital X-Ray, Ultrasound/Sonography, Mammography, and Electrocardiography (ECG) to patients directly and through doctor and hospital referrals.

Information We Collect

We collect only the information necessary to provide you with safe, accurate diagnostic imaging services and to comply with applicable Nigerian healthcare regulations.

Personal Identification Information

• Full name and date of birth
• Contact details: phone number, WhatsApp number, and/or address
• Next of kin or emergency contact details (where required)
• Gender and marital status (where clinically relevant)

Medical & Clinical Information

• Referral letters and clinical notes from your doctor or hospital
• Reason for the scan, presenting symptoms, and relevant medical history
• Pregnancy status (for obstetric scans and radiation safety)
• Digital imaging files produced during your scan (X-Ray, ultrasound, mammogram, ECG tracings)
• Radiology reports and diagnostic findings prepared by our specialists

Communication & Booking Information

• Messages sent to us via WhatsApp or phone call for booking or enquiries
• Appointment date, time, and service requested
• Payment records (amount paid, receipt reference, we do not store card details)

Website Information

• Browser type, device type, and general location (country/city level)
• Pages visited and time spent on our website (via anonymised analytics)

How We Use Your Information

Your information is used solely for the purposes listed below. We do not use your personal or medical data for advertising, profiling, or any commercial purpose unrelated to your care.

Sharing Your Information

We treat your medical and personal information with strict confidentiality. We do not sell, rent, or trade your information to any third party under any circumstances.

When we may share your information

• Your referring doctor or hospital: We will share your imaging results and report with the physician or facility that referred you, as this is a core part of the diagnostic service.
• With your written consent: If you request that your results be sent to an additional doctor, specialist, or family member, we will do so only with your explicit authorisation.
• Regulatory or legal requirement: If compelled by a valid Nigerian court order, law enforcement authority, or public health directive, we may be required to disclose information. We will only disclose the minimum information required by law.
• Medical emergency: If you are incapacitated and sharing information is necessary to protect your life or safety, we may share relevant clinical information with emergency medical personnel.

Data Security

We take reasonable and appropriate measures to protect your personal and medical information against unauthorised access, loss, misuse, or disclosure.

Our security measures include

• Physical access controls at our centre, patient records are not accessible to unauthorised staff
• Digital imaging files stored on secured, access-controlled systems
• Staff trained in patient data confidentiality and medical privacy obligations
• Restricted access to medical records on a need-to-know basis for clinical staff only
• Secure disposal of physical documents containing patient information

Your Rights

As a patient and data subject, you have important rights in relation to your personal information. We are committed to honouring these rights in accordance with the Nigeria Data Protection Act 2023 (NDPA) and applicable healthcare regulations.

You have the right to

1. Access: Request a copy of the personal and medical information we hold about you.
2. Correction: Ask us to correct any inaccurate or incomplete information in your records.
3. Deletion: Request that we delete your personal information, subject to our legal and clinical obligations to retain medical records.
4. Restriction: Ask us to restrict the processing of your information in certain circumstances.
5. Portability: Request that we provide your information in a portable format so you can share it with another provider.
6. Withdraw consent: Where processing is based on your consent, you may withdraw it at any time. This does not affect the lawfulness of processing before withdrawal.
7. Complain: Lodge a complaint with the Nigeria Data Protection Commission (NDPC) if you believe your rights have been violated.

To exercise any of these rights, please contact us using the details in Section 11. We will respond to all requests within 30 days.

Data Retention

We retain your medical records for as long as required by Nigerian healthcare regulations and clinical best practice. Generally:

• Adult patient records (including imaging files and reports) are retained for a minimum of 6 years from the date of your last visit.
• Records relating to obstetric or gynaecological imaging may be retained for longer periods where clinically appropriate.
• Records relating to minors are retained until the patient reaches the age of 25, or for 6 years from the date of the last scan, whichever is later.
• Booking and communication records (WhatsApp, call logs) are retained for a minimum of 2 years.
• Financial/payment records are retained for a minimum of 7 years in accordance with Nigerian tax and business regulations.

After the applicable retention period, records are securely destroyed or anonymised so that they can no longer identify you.

Website Cookies & Analytics

Our website may use limited, privacy-respecting analytics to understand how visitors use the site, so we can improve the information and user experience we provide.

• Essential cookies: Required for the website to function correctly (e.g., page navigation, security). These cannot be disabled.
• Analytics cookies: We may use anonymised, aggregate analytics (such as page views and device type). These do not identify you personally.

We do not use advertising cookies, tracking pixels, or any third-party marketing cookies on our website. No personal data is collected purely through your use of our website.

External links on our website (e.g., WhatsApp, Google Maps) are governed by the privacy policies of those third-party platforms. We encourage you to review those policies independently.

Children's Privacy

We provide imaging services to patients of all ages, including children and infants. Where a patient is under the age of 18, we require the presence and consent of a parent or legal guardian before any scan is performed.

Personal and medical information relating to minors is treated with the highest level of care and confidentiality. Records for minors are shared only with parents, legal guardians, or referring healthcare professionals, never with any other third party without explicit written consent from a parent or guardian.

Our website is not directed at children and we do not knowingly collect personal data from children through our website.

Changes to This Policy

We may update this Privacy Policy from time to time to reflect changes in our practices, regulatory requirements, or the services we offer. When we make material changes, we will update the "Last Updated" date shown at the top of this page.

We encourage you to review this policy periodically. If you have an ongoing relationship with us as a patient, we may notify you of significant changes by phone or WhatsApp. Continued use of our services after any changes take effect constitutes your acceptance of the revised policy.

Previous versions of this policy are available on request.

Contact Us

If you have any questions about this Privacy Policy, wish to exercise your data rights, or have a concern about how your information is being handled, please contact us:

We aim to acknowledge all privacy-related enquiries within 5 working days and resolve them within 30 days. If you are not satisfied with our response, you have the right to escalate your complaint to the Nigeria Data Protection Commission (NDPC) at ndpc.gov.ng.