Privacy Policy

1. Who is responsible for your information

UNNO Health Group, operating The UNNO Institute, is the data controller responsible for the personal information collected to run this website and our admissions and learning services. Our contact address is Number 1 Ganges Street by Alvan Ikoku, Maitama, Abuja, Nigeria. Privacy enquiries and requests can be sent to Info@unnoinstitute.com.

This notice covers visitors, applicants, learners, instructors and people who contact us. It explains our processing; reading it or continuing to browse does not give consent to optional tracking or to a new use of sensitive information.

2. Information we collect and why

• Account and contact information: name, email, phone number, professional role and account identifiers, used for sign-in, communication and administering your account. Passwords are stored as protected hashes, rather than readable passwords.
• Admissions information: professional licences, qualifications, documents and application decisions, used to establish eligibility for restricted professional training.
• Learning records: enrolments, lesson progress, submissions, grades, practical requirements, attendance and awards, used to deliver education and maintain an accurate academic record.
• Payment records: amount, currency, status, transaction references and receipts, used to confirm payments, grant purchased access, investigate issues and meet record-keeping obligations. Our payment provider handles card or bank credentials; we do not store complete card details.
• Support and communications: enquiries, messages and relevant correspondence, used to answer requests and resolve disputes.
• Security and technical information: IP addresses, request timestamps, browser and device information, session and authentication events, used to operate the service and prevent abuse.
• Optional usage and diagnostic information: limited feature events and browser error reports, collected only when you allow the relevant category in Cookie settings. We do not send account emails, submitted answers, payment details or free-text searches to product analytics.
• Consent records: the categories you choose, notice version, a random receipt identifier and timestamps, used to remember and evidence your choices. Cookie receipts do not include your name, email, account ID or browsing history.

3. Facial verification and device passkeys

Where facial identity verification is enabled, we explain it and request the required consent before enrolment. Images are processed for a live identity check; the facial matching service does not store the submitted photograph. It stores a protected, encrypted facial template for subsequent matching, together with consent and verification records. A successful verification is time-limited and does not give anyone else access to your account.

Device passkeys are different from our camera-based facial verification. Face ID, fingerprint or a device PIN used to unlock a passkey stays with your device and its authenticator. We receive a public-key credential and sign-in proof, not your device’s fingerprint or Face ID template.

You can contact us about removing your enrolled facial template or challenging a verification outcome. If you do not want camera-based verification, or cannot complete it, contact admissions before purchase to discuss the verification requirements and available assistance. Cookie consent is not biometric consent.

4. Assessment monitoring

An assessment may require identity confirmation, fullscreen delivery, focus or tab-change monitoring, heartbeat checks and webcam evidence where the assessment rules enable them. The pre-assessment notice explains which controls apply and obtains any required consent before the attempt unlocks.

Authorised staff may review flagged events and supporting evidence. You may request a review of an assessment or identity decision. Webcam evidence is separate from the facial matching service: the current assessment system schedules webcam media for removal after 90 days and provides deletion controls subject to the assessment review process. Academic results and integrity event records may need to be kept longer for appeals and academic audit.

5. AI study assistance

If you choose to use AI Study Mate, your question, a bounded recent conversation and relevant excerpts of the lesson transcript are sent to the configured AI provider to generate an explanation. Assessment answer keys and grading data are not supplied as study context. Study assistance is unavailable during active assessments.

Do not enter patient details, identifiable clinical photographs, confidential records or other sensitive third-party information in an AI question. AI responses may be wrong and do not replace professional judgement, supervision or advice from an instructor. The service is configured not to store a hosted response history at the AI provider; the provider may still retain operational or abuse-prevention records under its own terms. We do not promise zero provider retention.

6. Our lawful reasons for processing

We process the information necessary to deliver requested services and administer our contract with you, to comply with applicable legal obligations, and for proportionate legitimate interests such as security, fraud prevention, service reliability and accurate academic records. We assess those interests against your rights.

We rely on consent for optional analytics, optional browser diagnostics, and other processing that requires it, including sensitive personal data where applicable. Specific biometric, assessment and marketing choices are requested separately. We do not treat agreement to general terms as permission for unrelated tracking or marketing. You can withdraw consent as easily as you gave it; withdrawal does not change the lawfulness of earlier processing.

7. Who may receive information

Access is limited to people and providers who need the information for a stated purpose. We do not sell your personal information or use your assessment answers or facial template for advertising.

• Admissions, instructors and authorised support or administrative staff, for eligibility checks, training delivery, assessment review and support.
• Hosting and content-delivery providers, email delivery services and our payment provider, for the services you request. Our platform uses hosted infrastructure and content delivery, payment processing such as Paystack, and configured email providers.
• The configured AI provider, such as OpenAI, when you use study assistance; providers supporting institutional reporting, such as Tinybird if configured; optional browser product analytics such as PostHog and browser diagnostics such as Sentry in accordance with the controls described here.
• Professional bodies or authorities when disclosure has a lawful basis, is necessary for a legitimate verification or misconduct process, or is legally required.
• A successor operator if our services are transferred, subject to applicable data protection obligations and appropriate notice.

8. Certificate verification and documents you share

Certificate verification links and QR codes allow a person with the credential link to check an award. The verification result may show the learner’s name, programme or course, award or issue date, credential identifier and validity status. Do not share a certificate link if you do not want others to see those details. The public verification service does not need to expose your payment records or assessment answers.

If you sign or download a CPD document, your signature and the information printed on it become part of that document. You control where you subsequently send it. Do not upload patient or third-party records unless an approved workflow expressly requests them and you have the necessary authority and permissions.

9. Cookies, local storage and optional services

Essential storage supports authentication, security, routing, your cookie choice, and preferences or learning services you request. Optional analytics and browser diagnostics are off until you affirmatively allow them. Session replay is disabled. Optional external previews are loaded only when you allow third-party content. UNNO-hosted learning videos remain available with essential cookies.

Choose Essential only, Accept all, or Manage preferences in the consent notice. Reopen Cookie settings anywhere on the site to change or withdraw an optional category. Declining optional tracking does not remove purchased course access, progress or the ability to sign in. Our Cookie Policy describes categories, storage, lifetimes and third-party controls.

10. International processing

Some infrastructure and service providers process information outside Nigeria. This may include hosting, content delivery, email, payment, AI and optional analytics or diagnostic services. The location depends on the provider and configuration; contact us for information about a particular service.

International transfers must use a basis and safeguards permitted by applicable data protection law, such as applicable adequacy arrangements, contractual safeguards or specific consent where required. Providers must only process information for the authorised purpose. A cookie choice does not provide blanket consent to every international transfer.

11. How long information is kept

We limit retention to the purpose for which information was collected, applicable legal duties and any necessary dispute, academic or security process. We do not keep all categories indefinitely merely because an account once existed.

• Account and admissions records: while the account, application or training relationship needs them, and afterwards only to address a documented legal, verification or dispute requirement.
• Learning and award records: for delivery, assessment review, appeals and maintaining an accurate academic or certificate-verification record. Account deletion may not erase an award or a record we are required to maintain.
• Payment and receipt records: for payment reconciliation, refunds, accounting and the applicable statutory record-keeping period.
• Facial templates: for the enrolled verification purpose until removal, reset or applicable account-erasure processing, subject to any lawful restriction. A six-hour verification lease is not the template-retention period.
• Assessment webcam media: scheduled for removal after 90 days under the current system; academic results and integrity events follow the academic-record purpose.
• Cookie choices: remembered for 180 days, unless you change them, clear storage or the consent version changes. Anonymous server consent receipts are scheduled for removal after 12 months.
• Optional analytics and diagnostic records: subject to the configured provider retention and applicable deletion requests. Contact us for the current period for a particular record.
• Backups: deleted information may remain in protected backups until those backups are replaced or expire; it is not restored to normal use merely to avoid a deletion request.

12. Your rights and requests

Under the Nigeria Data Protection Act 2023 and other applicable laws, rights may include receiving information about processing, access to your information, correction, erasure, restriction, objection, portability where applicable, withdrawal of consent and safeguards concerning significant solely automated decisions. Some rights are subject to legal conditions or necessary record-retention duties.

Email Info@unnoinstitute.com with the right you want to exercise and enough information to locate the record. We will use proportionate identity checks, explain any lawful limit or refusal, and respond within the applicable legal period. Do not email your password, complete payment-card details or unnecessary sensitive documents.

You may complain to the Nigeria Data Protection Commission at ndpc.gov.ng, or to another competent data protection authority where applicable. You do not have to give up a regulatory complaint to contact us first.

13. Security and incidents

We use measures appropriate to the information, including access controls, encrypted transport, protected authentication credentials, encrypted facial templates and restricted access to uploaded files and assessment evidence. We restrict what reaches external telemetry and disable session replay. No system can guarantee absolute security.

If an incident affects personal information, we assess it, take steps to contain and address it, and notify affected people and authorities where required by applicable law. Report a suspected account or privacy incident to Info@unnoinstitute.com.

14. Children, other websites and updates

Our professional programmes are intended for adults aged 18 or over. We do not knowingly offer professional enrolment to children. If you believe a child’s information has been supplied, contact us so we can investigate and take appropriate action.

External sites, social links, payment pages and media providers operate under their own notices. When we materially change a purpose or the optional technologies covered by your choice, we will provide an updated notice and obtain fresh consent where required. Publishing a revised policy does not silently opt you into optional processing.