Four other people already know.

She is reading her result for the first time. It reached four other organisations before it reached her, and her clinic's privacy notice names two of them.

See it on your records How consent is recorded

One test result · five destinations

Every lit door is somebody who read it first

Asiri reads the destinations rather than asking you to recall them — and refuses to publish a notice its own register disproves.

In the notice
The reference laboratory
Agreement in force, destruction certificates arriving on schedule.
Processor
In the notice
The referring clinic
A separate controller rather than a processor, which changes the paperwork entirely.
Controller
Not in the notice
The insurer
Named nowhere. A reviewer finds this in one reading, and it needs no expertise to check.
Controller
Not in the notice
The SMS gateway
Carries the result summary in the message body, through servers outside Nigeria.
Processor · abroad
Not in the notice
The analytics warehouse
Holds a copy nobody remembered when her last access request was answered in full.
Internal

Three of five, unaccounted for

Who touches your data

Her record, field by field

Five of these eight cannot rely on a contract

Asiri classifies each field as it is read, rather than asking somebody to remember which are sensitive. The medication list is the one people miss — it discloses a condition, so it inherits the condition's protection.

Full name
Ordinary personal data
Contract is enough. Nothing here needs a consent record.
Phone number
Ordinary personal data
Needed to deliver the result, so contract covers it.
Diagnosis
Special category
Explicit consent, or a named legal permission. Nothing else will do.
Test results
Special category
Including the ones never released to the patient. Same basis, same rules.
Prescriptions
Special category
A medication list discloses a condition, so it inherits the condition’s protection.
Genetic markers
Special category
Consent must name the purpose specifically. A general research clause does not cover it.
Biometric login
Special category
Used to identify a person, which is what makes it special category rather than a convenience.
Appointment history
Ordinary — conditionally
Until the clinic name reveals the condition, and then it is not.

Three doors, and one of them is shut

Health data has no legitimate interest to fall back on

Every other industry can argue its way to a lawful basis. You cannot. Special category data needs explicit consent or a specific legal permission — and explicit means the record can name the exact wording she saw.

Open
Explicit consent, versioned
She agreed to v2 of the patient notice in March 2023, in the app, with the wording kept exactly as published. If v5 widens what you do with her results, her agreement does not stretch to cover it — and Asiri says how many people sit in that position.
Open
A specific legal permission
Public health reporting, or care in an emergency where consent cannot be obtained. Narrow, named, recorded against the activity — not a general licence to process because you happen to be a clinic.
Shut · unavailable
Legitimate interest
Not available for health data, full stop. It is the basis most companies lean on when consent is inconvenient, and reaching for it here means the processing has no lawful basis at all. That is the finding, not a technicality.

Awareness to notification

One night decides what the breach costs you

Health records raise severity on volume alone, which almost always means telling the patients as well as the Commission. The clock runs from the moment somebody was aware — not from the moment the incident was agreed to be one.

31h 08m elapsed of 72

The 72-hour clock

Mon 14:20
The misfiled results are already visible
Nobody has looked yet. The exposure has begun but the clock has not — awareness is what starts it.
Tue 09:14
A nurse notices results in the wrong patient record
This is awareness. The 72 hours start here, whatever anybody decides afterwards.
Tue 11:40
The team debates whether it counts as a breach
Two and a half hours spent deciding. The most expensive hours of any incident are these.
Wed 08:05
The Commission is notified, 23 hours in
Inside 72, with the timestamp on the trail. Late notification is its own finding, separate from the breach.
Wed 15:00
The 412 patients are told
In plain words, with what was exposed and what to do about it. This is the part that decides whether they stay.

Find out which fields are running without a basis

Connect one system. Asiri returns the special category fields, the consent record behind each one, and the exact wording each person saw.

Talk to us Patients under 18