Every few weeks somebody building a telemedicine product in Nigeria asks me the same question: where do I get the telemedicine licence? The honest answer is that there is no single document called a telemedicine licence. What exists instead is a stack of obligations — professional, corporate, data-protection and, if you touch medicines, pharmaceutical — and a review process that reads your service description far more carefully than your pitch deck. This is a practitioner's account of what that stack looks like and what reviewers actually probe.

I write this as a physician who is registered to practise in Nigeria and who has built and run the technology behind remote consultation and medicine-access services. That combination matters here, because most of the friction in these applications sits exactly where clinical accountability meets product design. Nothing below is legal advice; regulations and guidance are revised, so verify the current instruments and fees with each regulator before you file.

The first question is not about technology

The first thing a reviewer wants to establish is who is clinically accountable for a consultation delivered over a screen. Nigerian medical regulation is built around the registered practitioner, not the platform. The Medical and Dental Council of Nigeria (MDCN) licenses doctors and dentists and publishes the Code of Medical Ethics in Nigeria, which is the instrument that governs how a consultation may be conducted, including remotely. Nursing, pharmacy, laboratory science and radiography each have their own council with their own scope-of-practice rules.

The practical consequence: your platform does not practise medicine. Named, currently registered practitioners do, each holding a valid annual practising licence, each working within their own scope. An application that describes 'our AI triages the patient and issues a prescription' will stall. An application that describes 'a registered practitioner with an active practising licence conducts the consultation, and the software presents structured history and decision support' will not.

Prepare, for every clinician on the platform: full name as registered, MDCN (or relevant council) folio or registration number, evidence of a current practising licence, specialty and scope, and the consultation types they are authorised to deliver. Keep this as a live register, not a launch-day snapshot — expiry dates are the single most common compliance gap I see.

Then the corporate and facility layer

A telemedicine service is a health service, and health services are supervised. In Nigeria that supervision is layered: federal policy direction from the Federal Ministry of Health and Social Welfare, and licensing and inspection of health facilities largely by state ministries of health. If your service has any physical footprint — a consultation room, a sample-collection point, a clinician hub, a pharmacy counter — that footprint is registered and inspected where it sits, most often in Lagos, the FCT or wherever you incorporate your first site.

So assemble the corporate layer first, because everything else references it:

- CAC incorporation documents and, where a health objects clause is expected, the memorandum showing it.

- Tax identification and, in some states, evidence of local business registration.

- The state health facility registration or licence for each physical site, with the supervising practitioner named.

- A clear organogram showing who holds clinical governance authority, distinct from commercial leadership.

Reviewers look for one specific thing in that organogram: a clinical lead who can overrule a product or growth decision. If your structure cannot show that, expect questions.

Data protection is now a substantive review, not a formality

The Nigeria Data Protection Act 2023 created the Nigeria Data Protection Commission and made health data a special category requiring a heightened basis for processing. If you process personal data at any meaningful scale, you are likely a data controller of major importance, which brings registration with the Commission and an obligation to appoint a data protection officer and file compliance returns.

This is the part of the stack most telemedicine applications underprepare. What is actually asked for:

- A lawful basis for each processing purpose — consultation, billing, quality review, analytics — not one blanket consent covering everything.

- A record of processing activities: what data, from whom, held where, for how long, shared with whom.

- Data residency and cross-border transfer position. If your database or backups sit outside Nigeria, say so and document the transfer safeguard rather than hoping nobody opens the hosting section.

- A data protection impact assessment for remote consultation, recording and any secondary use of clinical data.

- A breach detection and notification procedure with named owners and stated timelines.

- Retention and deletion schedules for consultation notes, recordings, images and chat transcripts.

A practical note from building these systems: the cheapest way to pass this section is to reduce what you collect. Every field you do not capture is a field you do not have to justify, secure, localise, retain and delete. Recording consultations by default is the decision most often reversed after a compliance review.

If you prescribe or dispense, add the pharmaceutical layer

The moment your service issues a prescription that is fulfilled, you have entered the remit of the Pharmacy Council of Nigeria for premises and pharmacist supervision, and of NAFDAC for the products themselves and for anything that counts as advertising a regulated product. Controlled substances carry a separate and much stricter regime; the sensible position for a new remote service is to exclude them explicitly in your own clinical protocol and say so in the application.

What reviewers examine: how a prescription is authenticated to a named prescriber, how it is transmitted so that it cannot be altered in transit, how dispensing is supervised by a registered pharmacist, and how you prevent one prescription being fulfilled repeatedly. If you are also making health claims in your marketing, expect the advertising rules to be read against your live website, not your submitted copy.

Clinical protocols are the document that carries the application

Beyond registrations, the substance of a telemedicine review is your clinical protocol. Write it before you file, and write it as an operating document rather than a policy artefact. The sections that get scrutinised:

- Scope and exclusions: which presentations are appropriate for remote care, and which must be referred in person. Be explicit about paediatrics, obstetrics, mental health crises and anything requiring physical examination.

- Patient identity verification, including how you confirm you are speaking to the person whose record you are writing into.

- Consent to remote consultation, and separately to any recording.

- Escalation and emergency pathway: what happens when a remote consultation reveals a red flag, including how the patient reaches physical care and who follows up.

- Documentation standard: what must be in the note for the consultation to be defensible months later.

- Continuity: how a longitudinal record is maintained across clinicians and channels, and how a referral letter reaches a physical facility.

- Quality assurance: case review sampling, complaint handling, adverse event reporting.

- Clinical indemnity cover for practitioners delivering care through the platform.

What tends to sink an application

From the files I have seen and worked on, the recurring failures are boringly consistent. A platform described as making clinical decisions. Practising licences expired at the point of review. No named clinical governance lead. Consultations recorded without a stated basis or retention period. Data hosted abroad with no transfer position. A marketing site making therapeutic claims the clinical protocol does not support. And a service description that changed between the pitch and the filing, so the technical annex and the clinical annex describe two different products.

None of these are technology problems. They are coherence problems — the application says one thing, the running product says another, and reviewers read both.

A sequence that works

- Incorporate, and settle the clinical governance structure and named clinical lead.

- Verify and register every practitioner's council registration and current practising licence, in a live register with expiry monitoring.

- Register any physical site with the relevant state ministry of health.

- Write the clinical protocol, including exclusions and the emergency pathway, and design the product to match it.

- Complete the data protection work: lawful bases, record of processing, impact assessment, DPO, residency position, retention schedule, breach procedure; register with the NDPC where required.

- Add the pharmacy and NAFDAC layer only if you prescribe, dispense or advertise regulated products.

- Align marketing copy to the clinical protocol before you file, because the live site is part of the evidence.

- Then engage the regulators, with the service description identical across every annex.

The reason this order works is that each step produces the document the next step references. Founders who start with the regulator and work backwards spend months rewriting; founders who build the evidence first usually find the filing itself is uneventful.

This article is general information about a regulatory process and is not medical or legal advice. Confirm current requirements, instruments and fees directly with the MDCN, your state ministry of health, the Nigeria Data Protection Commission, the Pharmacy Council of Nigeria and NAFDAC before relying on any of it.