Last updated: 1 April 2026
1. Who we are
Second Cure Labs Ltd ("Second Cure", "we", "us", "our") is a Nigerian health and wellness company that provides Tirzepatide assessment, ordering, delivery coordination, and support services. We are registered in Lagos, Nigeria.
Our registered address is: Second Cure Labs Ltd, Lagos, Nigeria.
For privacy-related enquiries, please use the support channel shared in your account or order communications.
2. What data we collect
We collect and process the following categories of personal data:
2.1 Identity and contact data
- Full name and date of birth
- Email address, phone number, delivery address
- Government-issued identification (where required for identity verification)
2.2 Health and medical data
- Weight, height, BMI, and body measurements
- Medical history, current medications, and allergies
- Pre-existing conditions and contraindications
- Treatment progress data (weight tracking, symptom reports, adherence)
- Assessment notes, order decisions, and support history
- Photographs (if submitted for assessment or support)
2.3 Technical and usage data
- IP address, browser type, device information
- Pages visited, time on site, referral source
- Cookies and similar tracking technologies
2.4 Payment data
- Transaction records, payment method details (processed securely by our payment partner, Paystack)
- We do not store full card numbers on our servers
3. How we use your data
We use your personal data for the following purposes:
- Treatment services: To assess your eligibility, process your order, support your treatment, and help manage dose progression
- Medication fulfilment: To prepare, verify, and deliver your medication via cold-chain logistics
- Communication: To send treatment updates, check-in reminders, safety alerts, and support responses via WhatsApp, SMS, email, and phone
- Service improvement: To analyse anonymised and aggregated data to improve our platform, fulfilment, and support experience
- Legal compliance: To comply with applicable laws, payment requirements, fraud checks, and lawful requests from authorities
- Safety monitoring: To review, investigate, and respond to reported side effects or product issues
4. Legal basis for processing (NDPC compliance)
Under the Nigeria Data Protection Commission (NDPC) framework (formerly NDPR/NDPA), we process your data on the following legal bases:
- Consent: You provide explicit consent when completing our assessment and agreeing to our terms of service. For health data, we obtain specific consent for the processing of sensitive personal data.
- Contractual necessity: Processing is necessary to fulfil our service agreement with you.
- Legal obligation: We may be required to maintain records, investigate fraud, or respond to lawful requests.
- Vital interests: In emergency situations, we may process data to protect your life or health.
- Legitimate interest: For fraud prevention, platform security, and service improvement, where these do not override your rights.
You may withdraw your consent at any time by using the support channel shared in your account or order communications. Withdrawal of consent does not affect the lawfulness of processing carried out before withdrawal.
5. Data sharing
We do not sell your personal data to third parties. We share your data only in the following circumstances:
- Review and fulfilment partners: If your order requires review, fulfilment, or follow-up support, relevant health data may be shared with the person or partner handling that step.
- Pharmacy or fulfilment partners: Necessary order and delivery information may be shared for medication preparation and dispatch.
- Cold-chain logistics: Delivery address and contact information is shared with our logistics partner for medication delivery.
- Payment processors: Payment information is processed by Paystack, a PCI-DSS compliant payment processor.
- Authorities: We may share data with regulators, law enforcement, or other authorities when required by law or to respond to a safety issue.
- Service providers: We use cloud infrastructure and communication tools (WhatsApp Business API, email services) that may process data on our behalf, subject to data processing agreements.
6. Data retention
We retain your data for the following periods:
- Health and clinical records: 10 years from your last interaction, as required by Nigerian medical record-keeping regulations.
- Account data: For the duration of your account plus 2 years after account closure.
- Payment records: 7 years for tax and audit compliance.
- Marketing data: Until you withdraw consent or unsubscribe.
- Technical logs: 12 months for security and troubleshooting.
7. Data security
We implement appropriate technical and organisational measures to protect your personal data, including:
- Encryption of data in transit (TLS 1.3) and at rest (AES-256)
- Role-based access controls for clinical and operational staff
- Regular security assessments and penetration testing
- Secure cloud infrastructure with data residency considerations
- Staff training on data protection and confidentiality
- Incident response procedures for data breaches
8. Your rights
Under the NDPC framework, you have the following rights:
- Right of access: You can request a copy of the personal data we hold about you.
- Right to rectification: You can request correction of inaccurate or incomplete data.
- Right to erasure: You can request deletion of your data, subject to legal retention requirements.
- Right to restrict processing: You can request that we limit how we use your data.
- Right to data portability: You can request your data in a structured, machine-readable format.
- Right to object: You can object to processing based on legitimate interest or for marketing purposes.
- Right to withdraw consent: You can withdraw consent at any time.
To exercise any of these rights, use the support channel shared in your account or order communications. We will respond within 30 days.
9. Cookies
We use essential cookies to enable core website functionality and analytics cookies to understand how visitors interact with our platform. You can manage cookie preferences through your browser settings. For details, see our cookie notice on the platform.
10. Children's data
Our services are not intended for individuals under the age of 18. We do not knowingly collect personal data from children. If we become aware that we have collected data from a person under 18, we will delete it promptly.
11. International data transfers
Your data is primarily stored and processed in Nigeria. Where we use service providers that process data outside Nigeria, we ensure appropriate safeguards are in place, including contractual clauses that provide an adequate level of data protection in compliance with NDPC requirements.
12. Changes to this policy
We may update this privacy policy from time to time. Material changes will be communicated via email or a notice on our platform. The "Last updated" date at the top indicates the most recent revision.
13. Contact information
For questions, complaints, or data requests:
Second Cure Privacy Support
Second Cure Labs Ltd
Use the support channel shared in your account or order communications.
If you are not satisfied with our response, you have the right to lodge a complaint with the Nigeria Data Protection Commission (NDPC) at ndpc.gov.ng.