FIRSTAI.D PRIVACY POLICY

At FirstAI.d, we believe your privacy is a vital part of your safety. This Privacy Policy explains what personal information we collect when you use the FirstAI.d platform (the "Platform"), how we use it, who we share it with, how long we keep it, and what rights you have over it. It applies to all users of the FirstAI.d website, mobile application, and all related services.

This Policy is incorporated by reference into our Terms and Conditions. By using the Platform, you consent to the practices described in this Policy. If you do not agree, you must not use the Platform.

We comply with the Nigeria Data Protection Act 2023 (NDPA 2023), the NDPA General Application and Implementation Directive (NDPA-GAID 2025), and the Nigeria Data Protection Regulation (NDPR). We are committed to the following core data protection principles in all our processing activities: lawfulness, fairness, and transparency; purpose limitation; data minimisation; accuracy; storage limitation; integrity and confidentiality; and accountability.

1. THE DATA WE COLLECT AND HOW LONG WE KEEP IT

To deliver life-saving guidance and emergency coordination through the Platform, we collect the following categories of personal data. We practise data minimisation. That is, we collect only what is necessary for the specific purpose stated, and we do not retain it beyond that purpose.

The table below sets out each category of data, the specific data points collected, our retention period, and the purpose for collection:

All retention periods are subject to any overriding legal obligation that requires us to retain data for a longer period, for example, obligations under Nigerian tax law, court orders, or regulatory directives. Where such an obligation applies, we will retain only the minimum data required and will inform you where practicable.

You may request deletion of your data at any time under Section 6. Deletion requests will be honoured within the applicable retention period, subject to any legal hold obligations.

2. LEGAL BASIS FOR PROCESSING

Under the NDPA 2023 and the NDPR, we are required to have a lawful basis for each category of data processing we carry out. Our legal bases are as follows:

• Consent: You explicitly consent to our processing of your personal data when you join the waitlist, create an account, or initiate a triage session. You may withdraw consent at any time (see Section 6).
• Vital Interests: During an active medical emergency, we may process your data (including location and symptom data) where it is necessary to protect your life or health, or the life or health of another person, and you are not in a position to give or withhold consent in that moment.
• Contractual Necessity: We process certain data to fulfil our obligations to you under the Terms and Conditions, including providing the Platform core features and facilitating ambulance dispatch and payment.
• Legitimate Interests: We process certain usage and performance data to improve the accuracy, safety, and reliability of our clinical protocols and payment systems, where our interests do not override your fundamental rights and freedoms.
• Legal Obligation: We may process and disclose your data where required to do so by Nigerian law, a binding court order, or a directive from a competent regulatory authority.
• Public Interest: We may process data where necessary to protect public health or safety, or to support the work of emergency services and public health authorities in Nigeria.

3. HOW WE USE YOUR INFORMATION

We use your personal data strictly to fulfil our mission as your emergency coordination platform. Specifically, your data is used to:

• Emergency Triage - Process your reported symptoms and trigger evidence-backed first aid instructions through the AI triage system.
• Ambulance Dispatch - Connect you to the closest Partner Hospital and coordinate dispatch of Ambulance Services using your foreground location data.
• Payment Processing - Debit Dispatch Fees from your Wallet, process refunds, and maintain transaction records for financial compliance.
• Platform Personalisation - Improve voice recognition, response accuracy, and usability based on your device type, language preference, and interaction patterns.
• Account Management - Maintain your account credentials, communication preferences, and emergency contact information.
• Safety and Fraud Prevention - Detect, investigate, and prevent fraudulent, abusive, or unsafe use of the Platform.
• Legal and Regulatory Compliance - Meet our obligations under applicable Nigerian law and respond to lawful requests from courts and regulatory authorities.

5. DATA SHARING AND DISCLOSURE

We share your personal data only in the following circumstances, and only to the minimum extent necessary for the stated purpose:

• Partner Hospitals - If you initiate ambulance dispatch, we share your real-time location and relevant symptom data with the receiving Partner Hospital to enable immediate care.
• Technology Partners - We share data with carefully selected technology partners (including Leaflet, OpenStreetMap, payment processors, and cloud hosting providers) solely to keep the Platform operational. All such partners are bound by written data processing agreements that require them to protect your data and prohibit use for any other purpose.
• Legal Obligations - We may disclose your data where required by Nigerian law, in response to a valid court order, or to protect the safety, rights, or property of FirstAI.d, its users, or the public.
• Business Transfers - In the event of a merger, acquisition, or sale of assets involving FirstAI.d, your data may be transferred to the successor entity, subject to equivalent privacy protections. We will notify you before any such transfer takes effect and give you the opportunity to request deletion of your data before the transfer.

We do not share your health data with any party not listed above without your explicit, informed, and specific consent.

6. YOUR RIGHTS AS A DATA SUBJECT

Under the NDPA 2023, the NDPA-GAID 2025, and the NDPR, you have the following rights. You may exercise any of them by contacting our Data Protection Officer using the details in Section 11. We will acknowledge your request within 72 hours and aim to resolve it fully within 30 days.

• Right of Access - You may request a copy of the personal data we hold about you, together with information about how and why it is being processed.
• Right to Rectification - You may ask us to correct any inaccurate or incomplete personal data we hold about you. We may require verification of the corrected information before updating our records.
• Right to Erasure - You may request the deletion of your account and all associated personal data at any time. We will comply unless we are required by law to retain certain records (e.g. for tax, legal reporting, or audit purposes). We will tell you if a legal hold applies.
• Right to Data Portability - You may request that your personal data be provided to you in a structured, commonly used, and machine-readable format, suitable for transfer to another service.
• Right to Withdraw Consent - Where our processing is based on your consent, you may withdraw that consent at any time by contacting us or updating your in-app settings. Withdrawal does not affect the lawfulness of processing carried out before the withdrawal, but may affect your ability to use certain features.
• Right to Object - You may object to processing carried out on the basis of legitimate interests or public interest, particularly where it affects your fundamental rights and freedoms. You may also object to any processing used for direct marketing purposes.
• Right to Object to Automated Decisions - You have the right to object to decisions made solely on the basis of automated processing that significantly affect you. See Section 4.3 for how to exercise this right.
• Right to Lodge a Complaint - If you believe that our processing of your personal data violates applicable data protection law, you have the right to lodge a complaint with the Nigeria Data Protection Commission (NDPC) at: services.ndpc.gov.ng/breach.

7. INTERNATIONAL DATA TRANSFERS

The Platform integrates with global infrastructure providers, including OpenStreetMap and payment processors, whose servers may be located outside Nigeria. Where your data is transferred to or processed in a jurisdiction outside Nigeria, we ensure that appropriate safeguards are in place to protect your data to a standard that meets or exceeds the requirements of the NDPA 2023, the NDPA-GAID 2025, and the NDPR.

Such safeguards may include contractual data protection clauses, adequacy assessments, or equivalent mechanisms recognised by the Nigeria Data Protection Commission (NDPC). We will not transfer your data to a third country without ensuring an adequate level of protection is in place, and we will document the basis for each international transfer in accordance with our NDPC compliance obligations.

We prioritise hosting and processing your data on servers located within Nigeria, in support of digital sovereignty principles, where this is technically and commercially feasible.

8. DATA SECURITY

We take the security of your personal and health data seriously. The following safeguards are in place:

• All personal data is encrypted both at rest and in transit using industry-standard encryption protocols (including SSL/TLS for data in transit).
• The Platform is designed to minimise cloud transmission of health data. Where possible, first aid protocol logic is executed locally on your device to maximise both speed and privacy, particularly in low-bandwidth environments.
• Access to personal data within FirstAI.d is restricted to personnel who require it to carry out their responsibilities, and is governed by strict internal access control policies and confidentiality obligations.
• We operate security monitoring processes to detect and respond to potential threats or unauthorised access to the Platform or user data.
• Payment data is processed through PCI-DSS compliant payment processors. We do not store full credit card details on our servers.

No method of electronic transmission or storage is 100 per cent secure. While we employ all reasonable measures to protect your data, we cannot guarantee absolute security. In the event of a personal data breach that poses a risk to your rights or freedoms, we will notify you and the NDPC as required by the NDPA 2023 - within 72 hours of becoming aware of the breach where required, and without undue delay in all cases.

9. ADDITIONAL MATTERS

10. JURISDICTION-SPECIFIC INFORMATION

FirstAI.d currently operates as an Abuja-based pilot, with plans to expand across Nigeria and eventually other African jurisdictions. The table below sets out the applicable data protection frameworks and any jurisdiction-specific notes relevant to our users:

If you use the Platform from a jurisdiction not listed above, or if you have questions about how local data protection law applies to your use of the Platform, please contact our Data Protection Officer using the details in Section 11.