Information processed
The service processes account identifiers, email, profile and organisation details, workspace membership, product and formulation records, review notes, stability results, batches, paired codes, agreement acknowledgments and action receipts. Verification records include the scanned code, outcome, timestamp and a voluntarily supplied purchase location.
Do not submit patient names, medical histories or other patient-identifiable data. Typed signatures and reviewer identifiers are personal data even in a business workspace.
Purposes and visibility
Information is used to operate accounts and workspaces, perform scoped reviews, maintain integrity records and support verification. Workspace members and authorised oversight users can access records allowed by their permissions. Public code checks can show registered product and batch information, approved composition, manufacturer workspace, reviewer identifier and approval fingerprint; do not put trade secrets or unnecessary personal details in records intended for that disclosure.
Purchase-location reports are visible to authorised oversight users. The current reporting form does not require GPS. Public scanning does not create a signed-in account.
Infrastructure and international processing
Cloud infrastructure and connected services process information to provide the service; formulation information sent to the assistant is processed by the configured AI service. Do not send patient-identifiable or unnecessary sensitive information to it.
A verified subprocessor list, hosting locations, controller/processor allocation, contractual safeguards and lawful international-transfer arrangements must be documented before production expansion. This notice does not assert that all processing is confined to Nigeria or the United States.
Retention, security and rights
Agreement and action records are kept in the current service to support accountability and are not editable by ordinary users. A final retention schedule and deletion/closure procedure must be agreed with counsel and customers; no fixed retention period is promised here. Export the records required by your own policies.
Depending on applicable law, you may have rights to information, access, correction, deletion, objection or other requests. Raise requests with your Assay-A onboarding representative. Some audit records may need to be retained where a lawful obligation applies. Nigerian personal-data obligations, including the Nigeria Data Protection Act 2023, require a specific assessment rather than a blanket compliance claim.
Your rights by jurisdiction
Nigeria (Nigeria Data Protection Act 2023): you may request information, access, rectification, erasure, restriction, data portability, object to processing and withdraw consent, and you may complain to the Nigeria Data Protection Commission.
United Kingdom (UK GDPR and Data Protection Act 2018): you have rights of access, rectification, erasure, restriction, portability and objection, and may complain to the Information Commissioner’s Office. Account processing relies on contract performance; integrity records on legitimate interests and legal obligations; optional communications on consent.
United States (including California CCPA/CPRA and other state privacy laws): you may request to know, access, correct and delete personal information. Assay-A does not sell personal information or share it for cross-context behavioural advertising, and does not discriminate against anyone exercising these rights.
International transfers: Assay-A Healthtech Software Services LLC is a US company (registration pending) and information may be processed in the United States and other countries where service providers operate. Transfers are to be covered by appropriate safeguards such as contractual clauses. Optional consents can be withdrawn at any time without affecting earlier lawful processing. Final controller contact details and a data-protection contact are pending counsel review.
Cookies and browser storage
Browser storage is used to maintain your signed-in session. This notice does not grant consent to optional advertising or tracking. Any optional tracking requires its own disclosure and applicable consent controls.