Privacy and data

The rehabilitation centre is the data controller. It decides what is collected and why, it holds the consent, and the records belong to it.

Persivera Health is the data processor. We run the software and store the data on the centre’s behalf. We do not sell it, we do not share it with anyone, and we do not use it to train anything.

• Name, phone number and email, entered by the centre at discharge
• The date of discharge, the assigned therapist, and the substance recorded by the centre
• Each check in: the time, a craving score from 0 to 10, which of Hungry, Angry, Lonely and Tired applied, whether the client came close to using, and anything written in the optional note
• What the client planned to do that day, and which steps of the morning routine were completed
• Progress through courses and the Twelve Steps, and any written exercise work
• Any press of the help button, with the time and which number was shown

These limits are enforced inside the database by row level security, not by the screens. A member of staff cannot reach another therapist’s client, and Persivera cannot reach a craving score at all, even if somebody found a way around the interface.

Nobody outside that table sees anything. Family are not given access to a client’s record, and are not told when somebody stops checking in. Everyone on the programme is an adult. What they write belongs to them and to the clinician treating them, and to nobody else.

Step work written by a client is the strictest of all: no staff role can read it. A therapist sees that a step was completed and on what date, and nothing of what was written.

Nothing is recorded until the client has signed a consent at discharge, in the room, with a staff member present. The consent is read aloud and names exactly what each person can see. A copy is stored with the date and the staff member who witnessed it.

Consent can be withdrawn at any time, without giving a reason, and without affecting any other treatment the centre provides.

• A copy of everything held about them, in a readable format
• Correction of anything factually wrong
• Deletion of their records, subject to any clinical retention the centre is legally required to keep
• To stop using the platform entirely, at any time, without giving a reason
• To complain to the Nigeria Data Protection Commission, directly, without asking the centre or Persivera first

Ask the centre first, since the records belong to them. If that is not possible, write to mayowa@persivera.com and we will act on the centre’s instruction.

On managed Postgres in Frankfurt, Germany, encrypted at rest and in transit. Cross border transfer is permitted under the Nigeria Data Protection Act where appropriate safeguards are in place, which is the basis relied on here.

Access to production data is limited to Persivera Health, and every staff action that reads or changes a client record is written to an audit log with who did it and when.

For as long as the centre uses Persivera. If a centre stops, its records are exported to it in full within seven days, and every copy held by Persivera is deleted within thirty days, backups included, confirmed to the centre in writing.

A client who asks for erasure has it carried out within five working days of the centre instructing it, except for anything the centre is separately required by law to keep as a clinical record. Persivera keeps nothing after that, and nothing is retained for analysis.

The public site at persivera.com is measured with Google Analytics: which pages were opened, roughly which town the reader was in, which browser they used, and which link brought them. It sets a cookie so that a returning reader is not counted twice. That is a sales site, read by people considering the software.

A centre’s own address is not measured at all. No page a client or a member of staff opens is counted, nothing is sent to Google from it, and no analytics script is loaded there. No name, phone number, email address, check in or anything else from a record reaches Google from anywhere on this platform.

The only cookie a centre’s address sets is the one that keeps somebody signed in, which is required for the app to work at all and is readable only by the server.

Ask the centre first, then Persivera at mayowa@persivera.com. If neither answers you properly, you have the right to take it to the regulator directly, and you do not need our permission or the centre’s to do so.

The Nigeria Data Protection Commission is at ndpc.gov.ng. Complaining costs nothing and no part of a client’s treatment depends on whether they do.

Persivera is not monitored around the clock and it is not a crisis line. The help button shows the centre’s own number during its opening hours, and outside those hours it shows the national mental health line on 0800 000 2673, free, 24 hours. Anyone in immediate danger should call that number or go to the nearest hospital.

If this page changes in a way that affects what is recorded or who can see it, every centre is told before the change takes effect, and clients are asked to consent again where the law requires it.