Privacy policy

AH!MAZING HEALTH HUB

Privacy Policy

How we collect, use, share and protect your personal data on the Ah!mazing Health Hub marketplace

Effective date: 15th September, 2026
Scope note: This Policy covers the sportswear, gym equipment, supplements, lifestyle and healthy-eating verticals.


1. Introduction & Scope

  1. Ah!mazing Health Hub ("Company", "we", "us", "our") respects your privacy and is committed to protecting your personal data. This Privacy Policy explains how we collect, use, share, and protect personal data when you use the Ah!mazing Health Hub website, mobile application, and related services (the "Platform"), and what rights you have in respect of that data.
  2. This Policy applies to Users and Vendors across the sportswear, gym equipment, supplements, lifestyle, and healthy-eating (restaurant and meal-prep) verticals of the Platform. The Platform operates a white-labelled storefront across these verticals: products are presented to Users under the Ah!mazing Health Hub brand, and Vendor identity is not disclosed to Users. This Policy explains how that model affects the handling of your personal data, including in Section 7.
  3. This Policy should be read together with our Terms of Use, Vendor Agreement, and Return, Refund & Exchange Policy.
  4. We process personal data in accordance with the Nigeria Data Protection Act 2023 ("NDPA") and the regulations and guidance issued by the Nigeria Data Protection Commission ("NDPC"), and, where applicable, other data protection laws of jurisdictions in which we operate.

2. Data Controller

For the purposes of the NDPA, Ah!mazing Health Hub is the data controller in respect of personal data collected through the Platform. Because the Platform operates a white-labelled model (see Section 1), Vendors ordinarily receive only order-line and product details, not your name or delivery address, and act on our instructions as a processor rather than as an independent controller for that limited processing. Where a Vendor is exceptionally provided with personal data directly — for example, for a bulky item requiring the Vendor's own delivery arrangement — the Vendor acts as an independent controller for that specific processing, and this will be disclosed to you at the time of the relevant Order.

Controller name

Ah!mazing Health Hub

Web address

www.ahmazinghealthhub.com

Contact email

privacy@ahmazinghealthhub.com

Data Protection Officer

'Tomi Aman (Director, MIS)

3. Personal Data We Collect

Category

Examples

Identity & contact data

Full name, phone number, email address, delivery address

Account data

Username, password (encrypted/hashed), account preferences

Order & transaction data

Order history, items purchased, order value, payment status

Payment data

Payment method type and limited details necessary to process payment (full card details are handled by our payment processing partners and are not stored by us)

Device & usage data

IP address, device type, browser type, pages visited, app interactions

Location data

Delivery address and, where enabled, device location for delivery accuracy

Communications

Messages to customer support, reviews, and other content you submit

Vendor business data

For Vendors: business registration details, bank/payout details, product listings, and category-specific regulatory evidence (e.g., NAFDAC registration, food-handling permits)

We do not knowingly collect health, prescription, or other sensitive personal data through the verticals covered by this Policy. If a future pharmacy vertical is introduced, the handling of any health-related data will be addressed in a separate privacy notice as noted in Section 1.

4. How We Collect Personal Data

  • Directly from you, when you create an account, place an Order, contact support, or submit a review;
  • Automatically, through cookies and similar technologies as you use the Platform (see Section 12);
  • From Vendors, where necessary to process or support an Order (e.g., confirmation of stock or delivery);
  • From payment processing and logistics partners, in connection with completing and delivering an Order.

5. How We Use Personal Data

  • To create and manage your account, and to authenticate you when you log in;
  • To process, fulfil, and deliver Orders, including sharing necessary details with the relevant Vendor and delivery partner;
  • To process payments and prevent fraud;
  • To provide customer support and respond to enquiries or complaints;
  • To personalize your experience, including product recommendations and search results;
  • To send transactional communications (order confirmations, delivery updates) and, where you have consented, marketing communications;
  • To maintain the security, integrity, and proper functioning of the Platform;
  • To comply with legal, regulatory, and tax obligations, and to enforce our Terms of Use and Vendor Agreement;
  • To analyse usage trends and improve the Platform, including through aggregated or anonymised data.

6. Legal Basis for Processing

Under the NDPA, we rely on one or more of the following legal bases, depending on the purpose of processing:

  • Performance of a contract: to create your account, process Orders, and provide the Platform's services;
  • Consent: for marketing communications and certain non-essential cookies, which you may withdraw at any time;
  • Legitimate interests:  for fraud prevention, Platform security, and service improvement, balanced against your rights and interests;
  • Legal obligation:  where processing is necessary to comply with tax, regulatory, or other legal requirements.

7. Sharing Your Personal Data

We share personal data only as necessary for the purposes described in this Policy, and with the following categories of recipients:

Recipient

Purpose

Vendors

Order-line and product details necessary to prepare an Order for collection. Because the Platform operates a white-labelled model (see Section 1), Vendors do not typically receive your name or delivery address — collection from the Vendor and delivery to you are handled separately by our logistics partners, so that Vendor and customer identities are not exposed to one another

Payment processors

To process payment for Orders

Logistics & delivery partners

To collect Orders from Vendors, repackage them in Ah!mazing Health Hub branding, and deliver them to the address you provide

Cloud hosting & IT service providers

To store and process data securely on our behalf

Professional advisers & regulators

Where necessary for legal, audit, or regulatory compliance, including the NDPC

Successors in a business transaction

In connection with a merger, acquisition, or sale of assets, subject to equivalent protections

We do not sell personal data to third parties. Vendors and other recipients who receive personal data from us are contractually and/or legally required to use it only for the purpose for which it was shared and to handle it in accordance with applicable data protection law.

8. Data Retention

  • Account data is retained for as long as your account remains active, and for a reasonable period thereafter to comply with legal, tax, or dispute-resolution requirements.
  • Order and transaction records are retained for the period required by applicable tax and consumer-protection law.
  • Vendor business and compliance records are retained for the duration of the Vendor's participation on the Platform and for a reasonable period thereafter.
  • Where you close your account or request erasure under Section 11, we will delete or anonymize personal data that is no longer required to be retained for legal or legitimate business purposes.

9. Data Security

  1. We implement reasonable technical and organizational measures designed to protect personal data against unauthorized access, alteration, disclosure, or destruction, including encryption of data in transit, access controls, and regular security review of our systems.
  2. Payment card details are processed by PCI-DSS-compliant payment processing partners and are not stored in full on our systems.
  3. No method of transmission or storage is completely secure. While we take reasonable steps to protect your data, we cannot guarantee absolute security.
  4. In the event of a personal data breach likely to result in a risk to your rights and freedoms, we will notify the NDPC and affected individuals in accordance with the NDPA's breach notification requirements.

10. Cross-Border Data Transfers

  1. Where personal data is transferred outside Nigeria (for example, to a cloud hosting provider with servers in another country), we will ensure that such transfer complies with the NDPA's requirements for cross-border data transfer, including, where applicable, verifying that the recipient jurisdiction has an adequate level of data protection or that appropriate safeguards (such as contractual clauses) are in place.

11. Your Rights

Subject to applicable law and any relevant exceptions, you have the right to:

  • Access the personal data we hold about you;
  • Request correction of inaccurate or incomplete personal data;
  • Request erasure of your personal data, subject to our legal and legitimate retention requirements;
  • Object to, or request restriction of, certain processing, including direct marketing;
  • Request a copy of your personal data in a portable format, where technically feasible;
  • Withdraw consent at any time, where processing is based on consent, without affecting the lawfulness of processing carried out before withdrawal;
  • Lodge a complaint with the Nigeria Data Protection Commission (NDPC) if you believe your data protection rights have been infringed.
  1. To exercise any of these rights, please contact us using the details in Section 16. We will respond within the time-frame required under the NDPA.

12. Cookies & Tracking Technologies

  1. We use cookies and similar technologies to operate the Platform, remember your preferences, understand how the Platform is used, and, where you consent, to deliver relevant marketing.
  2. Essential cookies necessary for the Platform to function (e.g., maintaining your login session or shopping cart) do not require consent. Non-essential cookies, such as analytics and marketing cookies, are used only with your consent, which you may manage through the Platform's cookie settings or your browser settings.
  3. You may disable cookies through your browser settings; doing so may affect the functionality of certain features of the Platform.

13. Children's Privacy

The Platform is not directed to, and we do not knowingly collect personal data from, individuals under 18 years of age. If we become aware that we have inadvertently collected personal data from a minor, we will take reasonable steps to delete such data promptly.

14. Third-Party Links

The Platform may contain links to third-party websites or services, including Vendor social media pages. This Policy does not apply to those third-party sites, and we encourage you to review their privacy policies before providing any personal data.

15. Changes to This Policy

  1. We may update this Policy from time to time to reflect changes in our practices, the Platform, or applicable law. Material changes will be notified to Users through the Platform or by email in advance of taking effect.
  2. The version in effect at the time you use the Platform governs our processing of your personal data at that time.

16. Contact Us & Data Protection Officer

If you have questions about this Policy, wish to exercise your rights under Section 11, or wish to raise a concern about how we handle your personal data, please contact us at:

Ah!mazing Health Hub Data Protection
Email: privacy@ahmazinghealthhub.com
Web Address: www.ahmazinghealthhub.com
Phone: +2347034531603

If you are not satisfied with our response, you may lodge a complaint with the Nigeria Data Protection Commission (NDPC) at www.ndpc.gov.ng.