AMRx Hub

Privacy & Data Protection Policy

← Back

AMRx Hub

Effective Date: 22 August 2026 Last Updated: 22 August 2026

AMRx Hub (“AMRx Hub”, “we”, “us”, or “our”) operates a curated web platform for discovery of antimicrobial-resistance (AMR) resources, including links and references to third-party databases, software tools, publications, educational materials, PDFs, videos, surveillance resources, and related scientific resources. This Privacy & Data Protection Policy explains how we collect, use, disclose, retain, secure, and otherwise process personal data when you use AMRx Hub.

This Policy is intended to reflect the Nigeria Data Protection Act 2023 (NDP Act) and applicable regulatory guidance, including the Nigeria Data Protection Act General Application and Implementation Directive (GAID) 2025. It should be read together with the AMRx Hub Terms of Use and Cookie Policy.

1. Who We Are

AMRx Hub is responsible for the processing of personal data collected through the Platform to the extent that AMRx Hub determines the purposes and means of that processing. The exact legal identity of the data controller must be stated here before publication (for example, the registered company, organisation, or proprietor that legally operates AMRx Hub).

Privacy contact: amrtool344@gmail.com

Data Protection Officer / privacy contact: The same address may be used for privacy requests unless and until AMRx Hub designates a separate DPO or privacy contact.

2. Scope

This Policy applies to personal data processed through the AMRx Hub website, web application, account system, support communications, and related services. It does not govern the privacy practices of third-party websites, databases, software, videos, repositories, or other resources linked from AMRx Hub. Those services have their own policies and terms.

3. Personal Data We Collect

3.1 Account and authentication data

Name and email address provided during registration.

Authentication and account-security information, including verification status and security-related records.

Password credentials are processed for authentication; AMRx Hub should not retain passwords in readable/plain-text form.

3.2 Technical and usage data

IP address and security logs where collected by the application or infrastructure.

Browser, device, operating-system, and similar technical information.

Pages or resources accessed, timestamps, referring information, and other usage information generated through normal operation.

Cookie and similar-technology information, subject to the choices and settings described in the Cookie Policy.

3.3 Communications and information you provide

Information you provide when contacting support, submitting feedback, or communicating with AMRx Hub.

Information voluntarily provided through future features, where such features are enabled and accompanied by appropriate notices and safeguards.

AMRx Hub is currently designed not to require patient medical records or health histories for ordinary directory use. Users must not submit patient-identifying health information through features that are not expressly designed and enabled for such information.

4. Purposes of Processing

Create, verify, authenticate, secure, and administer user accounts.

Provide, maintain, and improve AMRx Hub and its directory/discovery functions.

Respond to support requests and send service, security, account, or policy notices.

Monitor security, prevent abuse, investigate incidents, and protect the integrity of the Platform.

Understand usage and performance, including through analytics where enabled and lawfully used.

Comply with legal, regulatory, court, and law-enforcement requirements where applicable.

Establish, exercise, or defend legal claims and protect the rights, property, and safety of AMRx Hub, users, or others.

5. Lawful Bases for Processing

Depending on the processing activity and applicable law, AMRx Hub may rely on one or more lawful bases recognised under the NDP Act, including consent, performance of a contract, compliance with a legal obligation, and legitimate interests where applicable and appropriately balanced against the rights and interests of data subjects. Where consent is the lawful basis, you may withdraw it, subject to any lawful reason we may have to continue processing.

Using the Platform does not by itself mean that every processing activity is based on consent. We will identify and apply the appropriate lawful basis for the relevant processing activity.

6. Data Minimisation and Accuracy

We seek to collect personal data that is adequate, relevant, and limited to what is necessary for identified purposes. You should provide accurate information and notify us when material account information needs correction.

7. Sharing and Disclosure

Service providers and processors that support hosting, email delivery, security, analytics, infrastructure, or other Platform operations, subject to appropriate contractual and confidentiality safeguards.

Authorities, courts, regulators, or other persons where disclosure is required or permitted by applicable law.

Persons or entities involved in a lawful corporate transaction, such as a merger, acquisition, restructuring, or transfer of the Platform, subject to applicable privacy requirements.

Other parties where you have provided a valid legal basis or instruction for the disclosure.

AMRx Hub does not sell personal data.

8. International and Cross-Border Transfers

Some service providers or infrastructure used by AMRx Hub may process personal data outside Nigeria. Where personal data is transferred across borders, AMRx Hub will apply the requirements of the NDP Act and applicable NDPC guidance, including applicable safeguards, adequacy mechanisms, contractual protections, or other lawful transfer mechanisms. The actual providers and transfer locations should be kept current as the Platform's infrastructure changes.

9. Cookies and Similar Technologies

AMRx Hub may use essential cookies and similar technologies for authentication, security, session management, and core functionality. Where non-essential analytics, preference, advertising, or similar technologies are used, AMRx Hub will provide the notices and consent or preference mechanisms required by applicable law. Details are provided in the separate Cookie Policy.

The previous statement that Google Analytics is necessarily used has been removed from this Policy unless it is actually enabled in production. The Platform should only name a specific analytics provider when that provider is genuinely in use.

10. Data Security

We implement reasonable technical and organisational measures appropriate to the risks of processing personal data, which may include access controls, secure authentication, encryption in transit, logging, backups, vulnerability management, and other safeguards appropriate to the Platform. No internet-based service can guarantee absolute security.

Where a personal-data breach occurs, AMRx Hub will assess and respond to it in accordance with applicable law and its incident-response procedures. Where the NDP Act requires notification to the Nigeria Data Protection Commission or affected data subjects, AMRx Hub will make the required notifications within the applicable statutory timeframe.

11. Data Retention

We retain personal data only for as long as reasonably necessary for the purposes for which it was collected, to meet applicable legal or regulatory obligations, to resolve disputes, enforce agreements, maintain security, or otherwise as permitted by law. Retention periods should be defined in AMRx Hub's internal retention schedule and should correspond to actual system behaviour.

We have removed the previous blanket statement that support/contact logs will always be retained for “2–3 years”. A specific period should not be promised unless AMRx Hub has adopted and can operationally follow that retention period.

12. Your Data Protection Rights

Request access to personal data held about you, subject to applicable law and verification requirements.

Request correction or rectification of inaccurate or incomplete personal data.

Request erasure where applicable.

Request restriction of processing where applicable.

Object to certain processing where applicable.

Request data portability where the legal requirements for portability are met.

Withdraw consent where processing relies on consent.

Exercise any other rights available under applicable Nigerian data-protection law.

Requests may be made to amrtool344@gmail.com. We may need to verify your identity and may be unable to fulfil a request where an applicable legal exception or the rights of another person prevent disclosure. We will respond within the timeframe required by applicable law.

13. Health and Sensitive Personal Data

AMRx Hub does not require patient health records for its ordinary resource-discovery function. Users must not submit identifiable patient records, clinical records, or other sensitive personal data through a feature unless AMRx Hub expressly enables that feature and provides an appropriate legal, technical, and organisational framework for it.

The Platform provides scientific and educational resources and is not a healthcare provider. Information available through AMRx Hub is not a substitute for professional medical or clinical advice.

14. Third-Party Resources

AMRx Hub links to third-party resources that it does not control. When you leave AMRx Hub or interact with an external resource, that third party may collect information under its own privacy policy and terms. AMRx Hub does not assume responsibility for third-party privacy practices.

15. Children's Privacy

AMRx Hub is intended for users who can lawfully use the Platform and form any required contractual relationship. If AMRx Hub knowingly collects personal data from a child in circumstances requiring additional protections, it will apply the safeguards required by applicable law. The age requirements for accounts are stated in the Terms of Use.

16. Changes to this Policy

We may update this Policy when the Platform, its processing activities, or applicable law changes. The latest version will display its effective date. Where a change is material and applicable law requires notice or consent, we will provide the appropriate notice or obtain the required consent.

17. Contact and Complaints

For privacy or data-protection questions, requests, or complaints, contact amrtool344@gmail.com. You may also have the right to lodge a complaint with the Nigeria Data Protection Commission or another competent authority under applicable law.

18. Publication and Compliance Note

This Policy is intended as AMRx Hub's public privacy notice. Before publication, AMRx Hub should confirm the legal identity of its data controller, its actual hosting/email/analytics providers, its actual cookies, retention schedule, cross-border processing arrangements, and any applicable NDPC registration or compliance obligations.