Data Processing Agreement
This agreement sets out how Adeva Health processes personal data — above all patient data — on behalf of a laboratory using Adeva. It forms part of the Terms of Service and is written to satisfy the Nigeria Data Protection Act, 2023 (NDPA) and the regulations of the Nigeria Data Protection Commission (NDPC). Version 2026-09-06.
1. Parties and scope
The Laboratory (the data controller) and Adeva Health (the data processor). It applies to all personal data the Laboratory and its staff enter into Adeva, or that Adeva generates about that data (audit records, notifications, reports), for as long as the Laboratory holds an account and until the data is deleted under section 10.
2. Details of the processing
| Subject matter | Operation of a laboratory information system for the Laboratory. |
|---|---|
| Duration | The term of the Laboratory’s account, plus the export window in section 10. |
| Nature and purpose | Storing, displaying, searching, reporting, exporting and transmitting (by email, on the Laboratory’s instruction) the records the Laboratory keeps to receive, test and report on specimens and to bill for its services. |
| Data subjects | Patients; their next of kin and related persons where recorded; the Laboratory’s staff; requesting clinicians where recorded. |
| Categories of data | Identity and contact details; demographics; consent records; clinical requests, specimens, results, reports and comments (health data, a sensitive category); payment and refund records; documents and images attached to results; audit records of staff actions. |
3. Instructions
We process personal data only on the Laboratory’s documented instructions. The Laboratory’s instructions are: the Terms of Service, this agreement, and the configuration and actions its staff perform in the product. Anything else needs the Laboratory’s written instruction. If we believe an instruction breaches the law we will tell the Laboratory before acting on it.
We do not use personal data for our own purposes, for product analytics on identifiable records, for training models, or for marketing.
4. Confidentiality and access
- Our staff are bound by written confidentiality obligations and are trained in handling health data.
- Our staff cannot read a Laboratory’s records in the ordinary operation of the service: every table is protected by row-level security that the application’s database role cannot bypass.
- Support access happens only through a support-access grant the Laboratory’s administrator approves in the Console. A grant is time-limited, read-only, and every request, approval, read and revocation is written to the Laboratory’s own audit trail.
5. Security measures
The technical and organisational measures we maintain are described on the Security page and include:
- tenant isolation by row-level security in PostgreSQL, enforced for every table that holds Laboratory data;
- role- and permission-based access within a Laboratory, and branch assignment that limits staff to the sites they hold;
- passwords stored as bcrypt hashes; rate-limited sign-in and signup; sessions revalidated against the database on every request;
- encryption in transit (TLS) for every connection to the product and between the product and its providers;
- an append-only audit trail of actions on records, including result amendments and critical-value acknowledgements;
- separate production, staging and development environments, with production data never copied into the others;
- backups managed by our hosting provider, with deletion propagating within its retention cycle.
We will not reduce the overall level of protection during the term.
6. Sub-processors
The Laboratory authorises the following sub-processors, each engaged under a written contract imposing data-protection obligations no less protective than this agreement:
| Sub-processor | Purpose | Region |
|---|---|---|
| Railway | Application hosting and the PostgreSQL database that holds all account and laboratory data | United States and European Union regions, as configured per environment |
| Cloudflare | Object storage for uploaded files (laboratory logos, result documents and images), DNS and edge delivery | Global network; storage in the configured region |
| Resend | Transactional email: verification, password reset, invitations and result-delivery messages | United States |
| Sentry | Error monitoring for the application; receives stack traces and request metadata, not laboratory records | United States |
We will notify the Laboratory’s administrators at least thirty days before adding or replacing a sub-processor. The Laboratory may object on reasonable data-protection grounds; if we cannot resolve the objection the Laboratory may terminate the affected service without penalty. We remain responsible for our sub-processors’ performance.
7. International transfers
Where a sub-processor stores or accesses data outside Nigeria, we rely on the mechanisms the NDPA permits — a contract with the sub-processor containing appropriate safeguards, and, where applicable, an adequacy determination by the NDPC — and we keep a record of the transfer and its basis for the Laboratory’s inspection.
8. Assistance to the Laboratory
- Data-subject requests. The product lets the Laboratory view, correct, export and delete a patient’s record itself. Requests that reach us are forwarded to the Laboratory within five working days, and we help it respond.
- Impact assessments and NDPC consultations. We provide the information about our processing that the Laboratory reasonably needs.
- Regulatory inspections. The Laboratory can export its audit trail and records to satisfy its own regulators.
9. Personal data breaches
We notify the Laboratory’s administrators without undue delay, and within 48 hours of becoming aware of a personal data breach affecting its data, with what we know: what happened, which data and how many records, the likely consequences, and what we are doing. We keep the Laboratory informed as we learn more and assist it in meeting its own notification duties to the NDPC and to data subjects.
10. Return and deletion
- During the term the Laboratory may export its data at any time from the Console and the LIS.
- After termination the data stays available for export for ninety days. It is then scheduled for deletion and permanently removed, including uploaded files, and leaves backups within the hosting provider’s retention cycle.
- We confirm deletion in writing on request, unless the law requires us to keep a copy, in which case we say so and keep only what the law requires.
11. Audit and records
We keep records of the processing we carry out for the Laboratory, our sub-processors, transfers and security measures, and make them available on request. Once a year, or after a breach, the Laboratory may audit our compliance with this agreement, on reasonable notice and confidentially, by review of documentation and written answers; an on-site audit needs our agreement on scope and timing.
12. Term and precedence
This agreement lasts as long as we process personal data for the Laboratory. Where it conflicts with the Terms of Service on the processing of personal data, this agreement prevails. It is governed by the laws of the Federal Republic of Nigeria.