Health data is the most sensitive category a Nigerian technology company will ever hold, and the Nigeria Data Protection Act 2023 gave that fact teeth. Most health technology companies are running on a privacy policy copied from a template and a database where every engineer is an administrator.

Cross-border transfer is the sharp edge — a cloud region chosen for latency becomes a compliance question nobody asked at the time.

Data protection impact assessments, lawful-basis mapping for clinical and commercial processing, retention schedules, role-based access design, audit logging, and cross-border transfer analysis.

Governance that a clinical team can actually operate: who may see what, on what basis, and how that is proven after the fact.