Privacy and cookies

The SWAp Coordination Office Hub (swaphub.so) is run by the SWAp Coordination Office (SCO) of the Federal Ministry of Health & Social Welfare, Nigeria. The SCO decides why and how the personal data in the Hub is used, and is the data controller for it under the Nigeria Data Protection Act 2023.

For anything about your personal data, write to scowarehouseng@gmail.com or call 0912 325 3648.

This notice covers everything at swaphub.so:

• the operations office staff and consultants sign in to: Warehouse (CEmONC equipment and MAMA incentives), Travel, Fixed assets, HR and Procurement;
• the links the office sends to people outside it: suppliers returning delivery evidence, drivers and collectors signing for loads, and state allocation officers;
• the public procurement portal, where firms register, follow tenders and bid.

Where a procurement notice or tender document says more about how bid information is handled, that document applies as well.

We collect only what each piece of work needs. Most of it you or a colleague enter; some is recorded by the Hub as you use it.

We do not use advertising or tracking, and we do not sell personal data.

We use personal data to run the programme's work and to account for it:

• to receive, store and deliver equipment and incentives to health facilities, and prove each delivery;
• to plan, approve, pay and account for official travel;
• to keep the register of the office's assets and who holds them;
• to engage and manage consultants: contracts, leave, performance and documents;
• to run open, fair and recorded public procurement;
• to keep the Hub secure, answer audits, and investigate misuse.

Our lawful basis under section 25 of the Nigeria Data Protection Act 2023 is mainly that the work is a task in the public interest carried out by a government office. For consultants, it is also the contract with them. Where a law requires a record, such as public finance, audit and procurement rules, it is a legal obligation. We ask for your consent only where nothing else applies, and you can withdraw it at any time.

Health data in leave requests is sensitive personal data. We use it only to grant and record the leave, under employment obligations. Only the office's HR administrators and coordinators can see it.

Some features use an AI model (Claude, by Anthropic) to read a document or photograph, or to draft text. Examples are reading a supplier's waybill, a delivery note, a travel receipt or a firm's certificate; describing an asset from its photograph; drafting a review; or answering a question about the records you can already see.

• The request goes to Anthropic, either through Vercel's AI Gateway or directly. Anthropic does not use it to train its models. Through the gateway it is not kept at all; sent directly, Anthropic keeps it only for a limited time for safety checks, then deletes it.
• The AI suggests; a person checks and decides. No decision about you is made by the AI alone.
• It only sees records the person using the feature is already allowed to see.

Inside the office, each person sees only what their role needs. For example, supplier balances are for warehouse managers, and leave attachments are for HR. Outside the office, we share personal data only:

• with the supplier, contractor or facility that needs it to complete a delivery (for example, the facility's contact on a delivery note);
• with the ministry, auditors and oversight bodies, when they need it for oversight or an audit;
• with the service providers below, who run parts of the Hub for us and may use the data only on our instructions;
• when the law requires it.

As the table shows, most of the Hub's data is stored in the European Union, and some is processed in the United States. We transfer personal data abroad only as Part VIII of the Nigeria Data Protection Act 2023 allows, under the providers' data protection terms, which bind them to protect it. Data in transit is encrypted.

We keep records for as long as the programme and its audits need them, and as long as public finance and procurement rules require. Personal data that is no longer needed is deleted or anonymised. We are completing a retention schedule for each kind of record and will publish it here.

Some things expire much sooner. A sign-in link works once and lasts at most seven days. The links sent to suppliers, drivers, collectors and allocation officers stop working when their job is done or when they expire.

• Everything travels over encrypted connections and is encrypted where it is stored.
• Access is by role. The database itself refuses what a role may not see, not just the screens.
• Key steps, such as signing off goods received, a dispatch or a release to a contractor, need a second person, and they are recorded.
• Links sent to people outside the office are single-purpose and expire. Only a scrambled (hashed) copy of each sign-in link is stored.
• Files uploaded to procurement are scanned for viruses before anyone opens them.

Under the Nigeria Data Protection Act 2023 you can:

• ask what personal data we hold about you, and get a copy;
• have it corrected if it is wrong or incomplete;
• ask us to delete it, or to limit how we use it, where we no longer need it or should not be using it;
• object to how we use it;
• receive the data you gave us in a common format;
• withdraw any consent you gave;
• not be subject to a decision made solely by a machine that significantly affects you.

Write to scowarehouseng@gmail.com. Say who you are and what you are asking for. We may need to confirm your identity first. We aim to reply within 30 days. Some rights are limited where we must keep a record by law, for example a signed delivery note or a bid.

If you are not satisfied with our answer, you can complain to the Nigeria Data Protection Commission at ndpc.gov.ng.

The Hub uses only the cookies and browser storage it needs to work. It has no analytics, advertising or tracking cookies. Because none of these are optional, there is no cookie banner. If we ever add an optional cookie, we will ask first.

Signing out removes the page copies, saved drafts and remembered filters from the device, so the next person to use it does not see them. Warehouse scans not yet sent are kept until they reach the server. You can also clear cookies and site data in your browser at any time; you will then be signed out, and anything not yet sent will be lost.

The Hub is for adults doing the programme's work. It is not meant for anyone under 18, and we do not knowingly collect their data.

When this notice changes, we will update the date at the top. If a change affects how your data is used in a way you would not expect, we will tell the people affected.

SWAp Coordination Office, Federal Ministry of Health & Social Welfare. Email scowarehouseng@gmail.com, telephone 0912 325 3648. The terms of using the Hub are in the terms of use.