Privacy Policy

MediSecure AI is a federated-learning medical diagnosis research platform built as the final year project (CSC 492) of a Caritas University computer science student. This policy describes how personal data is handled across the platform's training, inference, and account workflows.

The platform is designed to comply with the Nigeria Data Protection Regulation 2019 and the Nigeria Data Protection Act 2023 (NDPA), which together form the primary data-protection framework for Nigerian healthcare research.

Patient chest X-ray images and clinical source data never leave the source hospital. The federated ResNet-50 model visits the data; the data does not travel to a central server. This is a property of the federated architecture, not a contractual promise.

• No patient names, MRNs, dates of birth, or addresses are stored.
• No DICOM patient-identifying headers are transmitted.
• No imaging pixel data is centralised at any point.

Only the following artefacts cross hospital boundaries:

• DP-SGD protected weight updates (model gradients only — never raw images).
• Gaussian noise N(0, σ²C²I) added to each gradient before transmission.
• Gradient clipping to L2 norm C = 1.0.
• Transport over mutual TLS 1.3 with X.509 certificates signed by the platform's private Certificate Authority.

The active Moderate Privacy configuration provides (ε=5.13, δ=10⁻⁵)-DP over 50 training rounds, as measured by the Renyi DP accountant in Opacus 1.3. An adversary intercepting all gradient updates cannot determine any individual's participation to more than e^ε ≈ 169× baseline certainty.

For deployments that require stronger privacy guarantees, the system administrator may switch to the High Privacy configuration (ε target 1.0) at the cost of ~3% AUC-ROC.

We store your name, email, role, and institution only for authentication and audit logging. No health information from your account is shared with third parties. Diagnostic case records (provider and patient) are scoped strictly to the originating provider and patient.

Under the Nigeria Data Protection Act 2023, you have the right to:

• Request access to personal data held about you.
• Request correction of inaccurate data.
• Request deletion of account data (subject to legal audit retention requirements).
• Object to processing or withdraw consent where processing is based on consent.

To exercise any of these rights, contact privacy@medisecure.ng.

For privacy inquiries, contact privacy@medisecure.ng or write to the Data Protection Officer, Department of Computer Science, Caritas University, Amorji-Nike, Enugu, Nigeria.