Privacy Policy

Last updated 7 September 2026

Effective Date: 7th September 2026

Last Updated: 7th September 2026

1. Introduction

Welcome to Rayuvia Services ("Rayuvia," "we," "our," or "us"). We are committed to protecting the privacy, confidentiality, integrity, and security of the personal data entrusted to us and to conducting our business in a manner that is transparent, fair, and consistent with internationally recognized data protection and privacy principles.

This Privacy Policy explains how Rayuvia collects, receives, accesses, records, stores, organizes, analyses, uses, shares, transfers, retains, protects, and otherwise processes personal data in connection with the operation of the Rayuvia website, mobile applications (where applicable), digital platforms, healthcare provider directory, and all related products, services, features, communications, and technologies (collectively, the "Services").

Rayuvia operates a global digital healthcare information platform designed to assist individuals, healthcare professionals, healthcare institutions, businesses, researchers, and other stakeholders in identifying, locating, and accessing information relating to licensed healthcare providers, healthcare facilities, pharmacies, laboratories, diagnostic centres, specialist services, and other healthcare-related resources across multiple jurisdictions. As part of providing these Services, Rayuvia may process personal data relating to website visitors, registered users, healthcare professionals, representatives of healthcare organisations, business partners, service providers, job applicants, and other individuals who interact with our Services.

We recognise that privacy is a fundamental right and are committed to processing personal data lawfully, fairly, transparently, securely, and responsibly. Our privacy programme is designed to uphold internationally accepted data protection principles, including lawfulness, fairness and transparency, purpose limitation, data minimisation, accuracy, storage limitation, integrity and confidentiality, accountability, and respect for the rights and freedoms of data subjects.

This Privacy Policy has been prepared with due regard to applicable data protection and privacy legislation in the jurisdictions in which Rayuvia operates or offers its Services, including, where applicable, the Nigeria Data Protection Act, 2023 (NDPA), the United Kingdom General Data Protection Regulation (UK GDPR), the retained provisions of the EU General Data Protection Regulation (EU GDPR) where relevant, the UK Data Protection Act 2018, and other applicable international, national, federal, state, provincial, or local data protection and privacy laws. Where local legislation imposes additional or more stringent requirements, Rayuvia will comply with those requirements to the extent they apply to our processing activities.

This Privacy Policy also explains the categories of personal data we collect, the lawful bases upon which we process such data, how and why we use it, the circumstances under which we may disclose or transfer it, the safeguards we implement to protect it, the duration for which it is retained, the rights available to individuals in respect of their personal data, and the procedures for contacting us or exercising those rights.

By accessing or using the Services, creating an account, submitting information to us, communicating with us, or otherwise interacting with Rayuvia, you acknowledge that you have read and understood this Privacy Policy. Where your consent is required by applicable law, we will obtain such consent before processing your personal data for the relevant purposes. Where another lawful basis applies, your personal data will be processed in accordance with that lawful basis and the applicable legal requirements.

This Privacy Policy should be read together with our Terms of Use, Cookie Policy, Data Retention Policy, Provider Listing Policy, Data Processing Agreement (where applicable), and any other notices or policies that may be provided to you in connection with the Services.

2. Scope

This Privacy Policy applies to all individuals and entities who access, interact with, or otherwise use the services provided by Rayuvia Services, irrespective of their geographical location. It governs the collection, use, disclosure, transfer, storage, retention, and protection of personal data processed by Rayuvia in connection with its website, mobile applications (where applicable), healthcare provider directory, digital platforms, products, services, communications, and all related technologies (collectively, the "Services").

Without limitation, this Privacy Policy applies to:

Visitors to the Rayuvia website and digital platforms;
Individuals who create or maintain a Rayuvia account;
Patients, prospective patients, caregivers, and other members of the public who use the Services to search for, locate, compare, or obtain information about healthcare providers, healthcare facilities, pharmacies, laboratories, diagnostic centres, specialist services, and other healthcare-related resources;
Healthcare professionals, healthcare practitioners, hospitals, clinics, pharmacies, laboratories, diagnostic centres, healthcare institutions, and other organizations whose professional or publicly available business information is listed, displayed, verified, managed, or otherwise processed through the Services;
Healthcare providers or authorized representatives who claim, verify, manage, update, or administer their profiles or listings on the Rayuvia platform;
Business partners, affiliates, service providers, consultants, contractors, vendors, advertisers, payment service providers, and other third parties who provide goods or services to, or receive services from, Rayuvia;
Individuals who communicate with Rayuvia through customer support channels, email, telephone, social media platforms, surveys, feedback forms, newsletters, marketing communications, or other correspondence;
Applicants seeking employment, consultancy, internship, partnership, or other opportunities with Rayuvia where personal data is collected during recruitment or engagement processes; and
Any other individual whose personal data is collected, received, accessed, generated, or otherwise processed by Rayuvia in connection with the operation, administration, security, improvement, or lawful provision of the Services.

This Privacy Policy applies to personal data processed by Rayuvia regardless of whether such data is collected directly from the individual, obtained from authorized third parties, received from healthcare providers or business partners, sourced from publicly available or official records, generated through users' interactions with the Services, or otherwise processed in accordance with applicable laws.

This Privacy Policy applies to all processing activities carried out by or on behalf of Rayuvia, whether undertaken manually or by automated means, and regardless of the jurisdiction in which the data subject resides or from which the Services are accessed. Where local data protection or privacy laws impose additional obligations or grant additional rights, Rayuvia will comply with those legal requirements to the extent applicable.

This Privacy Policy does not apply to third-party websites, mobile applications, products, or services that are linked to, integrated with, or accessible through the Services but are owned or controlled by independent third parties. Such third parties are solely responsible for their own privacy practices, and users are encouraged to review the privacy policies applicable to those services before providing any personal data.

3. Definitions

Without limitation, this Privacy Policy applies to:

Visitors to the Rayuvia website and digital platforms;
Individuals who create or maintain a Rayuvia account;
Patients, prospective patients, caregivers, and other members of the public who use the Services to search for, locate, compare, or obtain information about healthcare providers, healthcare facilities, pharmacies, laboratories, diagnostic centers, specialist services, and other healthcare-related resources;
Healthcare professionals, healthcare practitioners, hospitals, clinics, pharmacies, laboratories, diagnostic centers, healthcare institutions, and other organizations whose professional or publicly available business information is listed, displayed, verified, managed, or otherwise processed through the Services;
Healthcare providers or authorised representatives who claim, verify, manage, update, or administer their profiles or listings on the Rayuvia platform;
Business partners, affiliates, service providers, consultants, contractors, vendors, advertisers, payment service providers, and other third parties who provide goods or services to, or receive services from, Rayuvia;
Individuals who communicate with Rayuvia through customer support channels, email, telephone, social media platforms, surveys, feedback forms, newsletters, marketing communications, or other correspondence;
Applicants seeking employment, consultancy, internship, partnership, or other opportunities with Rayuvia where personal data is collected during recruitment or engagement processes; and
Any other individual whose personal data is collected, received, accessed, generated, or otherwise processed by Rayuvia in connection with the operation, administration, security, improvement, or lawful provision of the Services.

This Privacy Policy applies to personal data processed by Rayuvia regardless of whether such data is collected directly from the individual, obtained from authorised third parties, received from healthcare providers or business partners, sourced from publicly available or official records, generated through users' interactions with the Services, or otherwise processed in accordance with applicable law.

4. Categories of Data

The categories of Personal Data that Rayuvia Services may collect, receive, access, generate, use, disclose, store, transfer, or otherwise process depend on the nature of your interaction with our Services, the features you use, the information you choose to provide, and the legal basis upon which such processing is undertaken.

Subject to applicable law, we may process the following categories of Personal Data:

4.1 Identity Information

We may collect information that identifies or relates to an individual, including but not limited to:

Full name;
Title or professional designation;
Username or account identifier;
Professional registration or license number (where applicable);
Date of birth, where required for a specific lawful purpose;
Photograph or profile image voluntarily provided;
Digital signatures or authentication credentials where applicable.

4.2 Contact Information

We may collect contact details including:

Email address;
Telephone or mobile number;
Business or professional address;
Practice or facility location;
Postal or mailing address;
Emergency or alternative contact details where voluntarily provided.

4.3 Account and Registration Information

Where users create an account or interact with personalized features of the Services, we may collect:

Login credentials;
Encrypted passwords;
Account preferences;
Security questions and authentication information;
Subscription details;
Account activity and history;
User profile information.

4.4 Healthcare Provider Professional Information

Where healthcare providers are listed on the Rayuvia platform, we may process professional information obtained from lawful sources, including:

Name of the healthcare professional or healthcare institution;
Professional qualifications;
Medical specialty or area of practice;
Professional license or registration status;
Practice location(s);
Hospital or clinic affiliation;
Languages spoken;
Consultation availability or business hours;
Services offered;
Professional biography;
Official business contact details;
Official website and social media links where publicly available;
Other professional information relevant to the purpose of the directory.

Such information may be obtained from healthcare providers directly, authorized representatives, official regulatory bodies, publicly available sources, healthcare institutions, or other lawful sources.

4.5 Transaction and Communication Information

We may collect information relating to your communications with Rayuvia, including:

Customer support enquiries;
Emails and correspondence;
Feedback and survey responses;
Complaint records;
Chat communications;
Requests submitted through online forms;
Records of telephone conversations where lawfully recorded.

4.6 Technical and Device Information

When you access or use the Services, we may automatically collect certain technical information, including:

Internet Protocol (IP) address;
Browser type and version;
Device identifiers;
Operating system;
Language settings;
Date and time of access;
Time zone;
Device type;
Mobile network information;
Diagnostic and crash reports;
Security and authentication logs.

4.7 Usage and Analytics Information

We may collect information relating to how users interact with the Services, including:

Pages viewed;
Search queries;
Healthcare providers or facilities viewed;
Features used;
Navigation patterns;
Clickstream data;
Session duration;
Referring websites;
User preferences;
Performance metrics;
Analytics generated through cookies and similar technologies.

4.8 Location Information

Subject to your device settings and applicable law, we may collect or infer location information, including:

Approximate geographic location derived from an IP address;
Device location where permission has been granted;
Search location selected by the user;
Location preferences used to identify nearby healthcare providers.

4.9 Cookies and Similar Technologies

We may collect information through cookies, web beacons, pixels, local storage, software development kits (SDKs), and other similar technologies, including:

Session identifiers;
Device identifiers;
Cookie preferences;
Website interaction data;
Authentication status;
Analytics information;
Personalization preferences.

Further information is available in our Cookie Policy.

4.10 Marketing and Preference Information

Where permitted by law, we may collect information regarding:

Communication preferences;
Newsletter subscriptions;
Marketing preferences;
Promotional campaign interactions;
Event registrations;
User interests and preferences.

4.11 Recruitment and Employment Information

Where individuals apply for employment, consultancy, internships, or other opportunities with Rayuvia, we may collect:

Curriculum vitae (CVs) or résumés;
Employment history;
Educational qualifications;
Professional references;
Interview notes;
Background verification information where legally permissible.

4.12 Information Obtained from Third Parties

We may receive Personal Data from third parties, including:

Healthcare providers and healthcare institutions;
Professional regulatory bodies;
Public registers and official directories;
Business partners;
Identity verification providers;
Analytics providers;
Payment service providers;
Advertising partners;
Social media platforms where users choose to interact with our Services;
Other lawful sources.

4.13 Information You Voluntarily Provide

We may process any Personal Data that you voluntarily submit to us when you:

Contact us;
Complete online forms;
Participate in surveys or research;
Submit reviews or ratings;
Request support;
Register for events;
Participate in promotions;
Communicate with us through any available channel.

4.14 Special Categories of Personal Data

Rayuvia does not intentionally collect or process Special Category or Sensitive Personal Data unless such processing is necessary for a lawful purpose, expressly authorized by applicable law, or voluntarily provided in connection with the Services.

Where the processing of Sensitive Personal Data is required, Rayuvia will implement appropriate technical, organizational, and legal safeguards and will process such data only on an appropriate lawful basis in accordance with applicable data protection laws.

4.15 Information We Do Not Intentionally Collect

Unless expressly stated in connection with a specific service, Rayuvia does not intentionally collect or maintain comprehensive patient medical records, diagnostic records, treatment histories, prescription records, or other confidential clinical information solely for the purpose of operating its healthcare provider directory. Where such information is processed in relation to specific services introduced in the future, Rayuvia will provide additional privacy notices and implement safeguards required by applicable law.

5. Healthcare Provider Listings

5.1 Purpose of the Directory

Rayuvia Services operates a global healthcare provider directory designed to improve public access to reliable healthcare information by enabling individuals, organizations, and other users to identify, locate, compare, and contact healthcare professionals, healthcare institutions, pharmacies, laboratories, diagnostic centres, specialist facilities, and other healthcare service providers across multiple jurisdictions.

The directory is intended solely as an informational resource to facilitate access to healthcare services and should not be construed as medical advice, professional accreditation, or a recommendation to obtain treatment from any particular healthcare provider.

5.2 Sources of Healthcare Provider Information

To maintain a comprehensive and reliable directory, Rayuvia may collect, receive, verify, organize, and display professional information relating to healthcare providers from lawful and reliable sources, including but not limited to:

Official government registers and regulatory authorities;
Professional licensing and registration bodies;
Healthcare institutions, hospitals, clinics, pharmacies, laboratories, and other healthcare organizations;
Official websites maintained by healthcare providers or healthcare institutions;
Information submitted directly by healthcare providers or their authorized representatives;
Publicly available business directories;
Public records;
Commercial information providers lawfully authorized to supply such information;
Business partners; and
Other lawful and publicly accessible sources.

Where reasonably practicable, Rayuvia endeavors to verify information obtained from third-party sources before publication. However, the availability of information from official or publicly accessible sources does not guarantee its continued accuracy or completeness.

5.3 Categories of Information Displayed

The information displayed within the directory may include, where applicable:

Name of the healthcare provider or healthcare institution;
Professional title or designation;
Medical specialty or field of practice;
Professional qualifications;
License or registration status where available;
Practice locations;
Business addresses;
Official telephone numbers;
Official email addresses;
Official websites;
Consultation availability or business hours;
Languages spoken;
Services offered;
Hospital affiliations;
Maps and geographic location information;
Publicly available professional biographies; and
Other professional or business information reasonably necessary to assist users in locating healthcare services.

Rayuvia seeks to limit the information displayed to that which is relevant, proportionate, and necessary for the legitimate operation of the directory and in accordance with applicable law.

5.4 Lawful Basis for Processing

Where Personal Data relating to identifiable healthcare professionals is processed, Rayuvia will do so only on an appropriate lawful basis under applicable data protection laws. Depending on the circumstances, this may include the pursuit of legitimate interests, compliance with legal obligations, the performance of a contract, consent where required, or any other lawful basis recognised by applicable legislation.

Where Rayuvia relies upon legitimate interests, it will seek to ensure that such interests are balanced against the rights, freedoms, and reasonable expectations of the affected individuals and will implement appropriate safeguards to protect those rights.

5.5 Accuracy and Quality of Information

Rayuvia is committed to maintaining accurate, relevant, and up-to-date information within its directory. We take reasonable steps to review, verify, and update listings periodically using reliable sources.

Notwithstanding these efforts, the healthcare sector is dynamic, and information such as practice locations, contact details, professional status, consultation hours, and services offered may change without prior notice. Accordingly, Rayuvia cannot guarantee that every listing will remain continuously accurate, complete, or current.

Users are encouraged to verify important information directly with the relevant healthcare provider before relying upon it.

5.6 Provider Verification

Where verification services are offered, Rayuvia may provide healthcare providers with an opportunity to claim, verify, update, or manage their professional profiles.

Verification by Rayuvia indicates only that reasonable steps have been taken to confirm certain professional or organizational information from available sources. It does not constitute professional certification, accreditation, licensing, endorsement, or a guarantee regarding the quality, competence, safety, ethics, or suitability of any healthcare provider or healthcare institution.

5.7 Correction, Update and Removal Requests

Rayuvia recognizes the importance of maintaining accurate professional information and respecting the rights of healthcare providers.

Healthcare providers or their duly authorized representatives may contact Rayuvia to:

request correction of inaccurate or incomplete information;
update professional or business information;
provide additional information supporting the accuracy of a listing;
claim ownership or administrative control of a listing where applicable; or
request the removal or restriction of certain Personal Data where such request is supported by applicable law.

Each request will be assessed individually, taking into account Rayuvia's legal obligations, legitimate interests, the public interest in access to healthcare information, the accuracy of the information, and the applicable rights of the requesting individual under relevant data protection laws.

Submission of a correction or removal request does not automatically require Rayuvia to remove a listing where there is a lawful basis for retaining or publishing the information.

5.8 No Endorsement or Recommendation

The inclusion of any healthcare provider, healthcare institution, pharmacy, laboratory, diagnostic centre, specialist facility, or other organization within the Rayuvia directory shall not constitute or imply:

an endorsement by Rayuvia;
a recommendation or referral;
a guarantee of professional competence;
confirmation of treatment outcomes;
certification of qualifications beyond publicly available or verified information;
an assessment of clinical quality or standards of care; or
any representation that one provider is superior to another unless expressly identified as being based on transparent, independently verifiable, and objectively disclosed criteria.

Users remain solely responsible for exercising their own independent judgment when selecting healthcare providers or obtaining medical advice.

5.9 Public Interest and Responsible Use

Rayuvia believes that improving public access to accurate healthcare provider information promotes informed decision-making and supports access to healthcare services.

In operating the directory, Rayuvia seeks to balance the legitimate interests of maintaining a comprehensive healthcare information resource with the privacy rights, professional reputation, and legal rights of healthcare providers. Rayuvia continually reviews its data governance practices to ensure that healthcare provider listings remain transparent, fair, accurate, proportionate, and consistent with applicable data protection laws and internationally recognized privacy principles.

6. Lawful Bases

Rayuvia Services processes Personal Data only where there is a lawful basis to do so under applicable data protection and privacy laws. The lawful basis relied upon will depend on the nature of the Personal Data, the purpose for which it is processed, the relationship between Rayuvia and the Data Subject, and the legal requirements applicable in the relevant jurisdiction.

Where required by applicable law, Rayuvia will identify, document, and maintain records of the lawful basis relied upon for each category of processing activity.

The lawful bases upon which Rayuvia may process Personal Data include, but are not limited to, the following:

6.1 Consent

Rayuvia may process Personal Data where the Data Subject has freely given specific, informed, and unambiguous consent for one or more particular purposes.

Where consent is relied upon as the lawful basis for processing:

consent will be obtained through clear affirmative action;
the Data Subject may withdraw consent at any time, subject to legal or contractual limitations;
withdrawal of consent shall not affect the lawfulness of processing carried out prior to such withdrawal; and
Rayuvia will cease or modify the relevant processing activities where required by applicable law.

6.2 Performance of a Contract

Rayuvia may process Personal Data where such processing is necessary:

to enter into a contract with a Data Subject;
to perform contractual obligations;
to provide requested products or services;
to manage user accounts;
to process enquiries and customer requests;
to administer subscriptions, partnerships, or commercial relationships; or
to take steps at the request of a Data Subject prior to entering into a contract.

6.3 Compliance with Legal Obligations

Rayuvia may process Personal Data where such processing is necessary to comply with applicable legal or regulatory obligations, including obligations relating to:

corporate governance;
taxation;
financial reporting;
anti-money laundering and fraud prevention;
law enforcement requests;
court orders;
regulatory investigations;
data protection compliance;
record-keeping requirements; and
any other legal obligations imposed under applicable law.

6.4 Legitimate Interests

Where permitted by applicable law, Rayuvia may process Personal Data where such processing is necessary for the purposes of its legitimate interests or those of a third party, provided that such interests are not overridden by the rights, freedoms, or legitimate interests of the Data Subject.

Rayuvia's legitimate interests may include:

operating, maintaining, and improving the Rayuvia healthcare provider directory;
enabling members of the public to locate healthcare providers and healthcare facilities;
displaying professional information relating to healthcare providers obtained from lawful sources;
verifying the accuracy of healthcare provider listings;
maintaining the security, integrity, and resilience of the Services;
preventing fraud, abuse, unauthorized access, or misuse of the Services;
improving user experience and platform functionality;
conducting business analytics and service optimization;
responding to enquiries and customer support requests;
protecting Rayuvia's legal rights, property, and reputation; and
managing and developing its business operations.

Where Rayuvia relies upon legitimate interests as the lawful basis for processing, it may undertake a Legitimate Interests Assessment (LIA) or equivalent balancing exercise to ensure that the processing is necessary, proportionate, and does not unjustifiably interfere with the rights and freedoms of affected individuals.

6.5 Vital Interests

Rayuvia may process Personal Data where such processing is necessary to protect the vital interests of a Data Subject or another natural person, including circumstances involving serious threats to life, health, or personal safety where processing is authorized by applicable law.

6.6 Public Interest

Where authorized or required by applicable law, Rayuvia may process Personal Data where such processing is necessary for the performance of a task carried out in the public interest or in the exercise of official authority vested in a competent body.

Where appropriate, this may include activities that promote public access to reliable healthcare information, support public health initiatives, cooperate with competent regulatory authorities, or otherwise contribute to legitimate public interest objectives recognized by law.

6.7 Compliance with International Data Protection Principles

Where Rayuvia operates across multiple jurisdictions, the lawful basis for processing may differ depending on the applicable legal framework.

Rayuvia will determine and apply the appropriate lawful basis for each processing activity in accordance with the data protection and privacy laws applicable to the relevant jurisdiction, including any additional requirements imposed by local legislation.

6.8 Changes to the Lawful Basis

Where the purpose of processing changes, or where applicable law requires a different lawful basis, Rayuvia will identify and document the new lawful basis before continuing the relevant processing activity and, where required, will notify the Data Subject or obtain additional consent.

6.9 Accountability

Rayuvia is committed to the principle of accountability and maintains appropriate policies, procedures, records, and governance measures designed to demonstrate that Personal Data is processed lawfully, fairly, transparently, and in accordance with applicable data protection laws.

Where required by applicable law, Rayuvia may conduct Data Protection Impact Assessments (DPIAs), Legitimate Interests Assessments (LIAs), records of processing activities, and periodic compliance reviews to support its data protection programme.

7. Purposes

Rayuvia Services processes Personal Data only for specified, explicit, and legitimate purposes and does not process Personal Data in a manner that is incompatible with those purposes, except where otherwise permitted or required by applicable law.

Depending on the nature of your interaction with the Services, Rayuvia may collect, use, disclose, store, transfer, retain, or otherwise process Personal Data for one or more of the following purposes:

7.1 Provision and Operation of the Services

To establish, operate, administer, maintain, support, and improve the Rayuvia website, healthcare provider directory, mobile applications (where applicable), digital platforms, and all related products and services.

7.2 Healthcare Provider Directory Management

To create, organize, verify, maintain, update, display, and administer healthcare provider listings and related professional information, enabling users to search for, identify, compare, and access healthcare professionals, healthcare facilities, pharmacies, laboratories, diagnostic centres, specialist services, and other healthcare-related resources across multiple jurisdictions.

7.3 User Account Administration

To create, authenticate, manage, secure, and administer user accounts, verify identities where necessary, personalize user experiences, maintain account preferences, and provide access to account-specific features.

7.4 Search, Navigation and Personalization

To enable users to search for healthcare providers and healthcare services efficiently, improve search functionality, personalise content and recommendations where appropriate, remember user preferences, and enhance the overall user experience.

7.5 Customer Support and Communications

To respond to enquiries, provide customer support, investigate complaints, resolve disputes, process feedback, communicate important service updates, respond to requests, and maintain effective communication with users, healthcare providers, business partners, and other stakeholders.

7.6 Verification and Quality Assurance

To verify the accuracy and authenticity of healthcare provider information, review listing requests, maintain data quality, prevent duplicate or inaccurate listings, and improve the reliability and integrity of the directory.

7.7 Analytics, Research and Service Improvement

To analyse user behaviour, monitor platform performance, conduct statistical analysis, generate insights, develop new features, improve existing services, conduct research, evaluate user engagement, and enhance the effectiveness, accessibility, and usability of the Services.

Where reasonably practicable, such analytics will be conducted using aggregated, anonymized, or pseudonymized data.

7.8 Security, Fraud Prevention and Platform Integrity

To safeguard the confidentiality, integrity, availability, and security of the Services; detect, investigate, and prevent fraud, cyberattacks, unauthorized access, identity theft, malicious activity, misuse of the platform, and other unlawful or prohibited activities; and maintain appropriate audit trails and security logs.

7.9 Legal and Regulatory Compliance

To comply with applicable laws, regulations, court orders, regulatory requirements, industry standards, law enforcement requests, data protection obligations, financial reporting obligations, and other legal or regulatory responsibilities applicable to Rayuvia in the jurisdictions in which it operates.

7.10 Business Operations and Administration

To administer Rayuvia's internal business operations, corporate governance, financial management, auditing, risk management, compliance programs, insurance, record keeping, business planning, and organizational administration.

7.11 Marketing and Business Development

Where permitted by applicable law, to communicate information about Rayuvia's products, services, features, updates, events, newsletters, educational content, surveys, promotions, and other marketing communications, subject to users' communication preferences and applicable legal requirements.

Individuals may opt out of receiving marketing communications at any time in accordance with applicable law.

7.12 Recruitment and Human Resources

To process employment applications, assess candidates, conduct recruitment activities, verify qualifications where legally permissible, administer employment-related processes, and manage relationships with employees, consultants, contractors, and applicants.

7.13 International Business Operations

To facilitate the operation of Rayuvia's global business, including cross-border data management, international customer support, compliance with applicable legal obligations, collaboration with affiliates, service providers, and business partners, and the secure transfer of Personal Data where appropriate safeguards have been implemented.

7.14 Business Continuity, Risk Management and Corporate Transactions

To maintain business continuity, disaster recovery, system resilience, backup and restoration processes, risk management activities, internal investigations, legal claims, mergers, acquisitions, restructurings, investments, financing transactions, or the transfer of assets, subject to appropriate safeguards and applicable legal requirements.

7.15 Protection of Rights and Legitimate Interests

To establish, exercise, or defend legal claims; protect the rights, property, safety, reputation, and legitimate interests of Rayuvia, its users, healthcare providers, employees, contractors, and third parties; enforce our Terms of Use and other contractual arrangements; and investigate or respond to actual or suspected violations of applicable law or our policies.

7.16 Other Compatible Purposes

Rayuvia may process Personal Data for other purposes that are compatible with the original purpose for which the data was collected, or where otherwise authorized or required by applicable law. Where required, Rayuvia will notify the Data Subject of such additional purposes or obtain consent before undertaking the relevant processing.

In all cases, Rayuvia is committed to ensuring that Personal Data is processed only to the extent necessary, proportionate, and appropriate for the identified purpose, in accordance with the principles of lawfulness, fairness, transparency, purpose limitation, data minimization, accuracy, storage limitation, integrity, confidentiality, and accountability under applicable data protection laws.

8. International Transfers

Where Personal Data is transferred across national borders, including to countries that may not provide the same level of data protection as the country in which the data was originally collected, Rayuvia will ensure that such transfers are carried out in accordance with applicable data protection laws.

Where required, Rayuvia implements appropriate safeguards to protect Personal Data, including, where applicable, reliance on adequacy decisions, Standard Contractual Clauses (SCCs), Binding Corporate Rules (BCRs), approved codes of conduct, certification mechanisms, or any other lawful cross-border transfer mechanism recognized under applicable law. These safeguards are supplemented, where appropriate, by suitable technical and organizational measures designed to ensure that Personal Data remains secure, confidential, and protected against unauthorized access, disclosure, alteration, loss, or misuse throughout the transfer and subsequent processing.

9. Data Retention

Rayuvia retains Personal Data only for as long as is necessary to fulfil the purposes for which it was collected and processed, including the provision of the Services, compliance with legal, regulatory, tax, accounting, and reporting obligations, the establishment, exercise, or defence of legal claims, dispute resolution, fraud prevention, security monitoring, and the enforcement of our contractual rights, Terms of Use, and other applicable agreements.

The applicable retention period depends on the nature of the Personal Data, the purpose of processing, applicable legal and regulatory requirements, contractual obligations, and our legitimate business needs. Where different categories of Personal Data are subject to different retention requirements, Rayuvia applies the retention period appropriate to each category.

Rayuvia maintains and periodically reviews a documented data retention and disposal schedule that specifies the retention periods applicable to different categories of Personal Data and the criteria used to determine those periods. Personal Data that is no longer required for the purposes for which it was collected, and for which there is no continuing legal or legitimate basis for retention, will be securely deleted, anonymized, or irreversibly destroyed using appropriate technical and organizational measures, unless continued retention is required or permitted by applicable law.

Where technically feasible and appropriate, Personal Data may be anonymized for statistical, research, analytical, service improvement, or other lawful business purposes. Data that has been irreversibly anonymized so that it can no longer identify an individual is not considered Personal Data and may be retained for longer periods in accordance with applicable law.

Upon expiry of the applicable retention period, Rayuvia will ensure that Personal Data is securely disposed of in a manner that protects its confidentiality, integrity, and availability throughout its lifecycle and prevents unauthorized access, disclosure, recovery, or misuse.

10. Security

Rayuvia is committed to protecting the confidentiality, integrity, availability, and resilience of the Personal Data it processes. We implement and maintain appropriate technical, organizational, physical, and administrative security measures designed to protect Personal Data against accidental or unlawful destruction, loss, alteration, unauthorized disclosure, unauthorized access, misuse, or any other form of unlawful processing, taking into account the nature, scope, context, and purposes of the processing, as well as the risks to the rights and freedoms of individuals.

Our security programme includes, where appropriate and proportionate to the risks involved, measures such as:

encryption of Personal Data in transit and, where appropriate, at rest;
pseudonymization, data minimization, and privacy-by-design and privacy-by-default principles;
role-based access controls, authentication mechanisms, and least-privilege access management;
continuous monitoring, security logging, audit trails, and system activity monitoring;
vulnerability assessments, penetration testing, security patch management, and remediation of identified vulnerabilities;
network, endpoint, application, and infrastructure security controls, including firewalls, intrusion detection and prevention mechanisms, and malware protection;
regular data backups, disaster recovery procedures, business continuity planning, and resilience testing;
secure software development, change management, configuration management, and periodic security reviews;
confidentiality obligations for employees, contractors, consultants, and other authorized personnel, supported by ongoing privacy and information security awareness training;
due diligence, contractual safeguards, and periodic assessments of third-party service providers, vendors, processors, and business partners that process Personal Data on our behalf;
incident detection, investigation, containment, response, recovery, and post-incident review procedures; and
periodic evaluation and continuous improvement of our information security and privacy management practices to address evolving threats, technologies, legal requirements, and industry standards.

Access to Personal Data is restricted to authorized personnel and third parties who require such access to perform their legitimate business, contractual, or legal responsibilities and who are subject to appropriate confidentiality and security obligations.

Where Rayuvia engages third-party service providers or processors, we take reasonable steps to ensure that they implement appropriate technical and organizational measures to safeguard Personal Data and process it only in accordance with our documented instructions, contractual obligations, and applicable data protection laws.

Although Rayuvia employs appropriate safeguards to protect Personal Data, no method of electronic transmission, storage, or processing can be guaranteed to be completely secure. Accordingly, while we strive to protect Personal Data using commercially reasonable and industry-recognized security measures, we cannot guarantee its absolute security.

11. Contact

Rayuvia is an online healthcare directory and digital platform accessible through rayuvia.com. For any questions, requests, concerns, or complaints concerning this Privacy Policy or Rayuvia’s collection, use, disclosure, retention, security, or other processing of Personal Data, individuals may contact Rayuvia through the contact details provided below.

Website: rayuvia.com

Privacy Contact: rayuviaservices@gmail.com

12. Changes

Policy may be updated periodically with revised effective dates.

Schedule A – Data Retention Framework

Maintain documented retention periods for account data, enquiry records, logs, provider listings, contracts and legal records.