Privacy and patient dignity.
Last updated 28 September 2026. This deployment draft should be reviewed for compliance with the Nigeria Data Protection Act and the foundation's actual practices.
Information we collect
We collect account details, campaign application information, medical evidence, donation records, messages and technical security data needed to operate the platform.
Why we use it
Information is used to verify campaigns, process and reconcile donations, prevent fraud, communicate with users, make provider payments, publish authorised updates and meet legal obligations.
Sensitive medical information
Medical documents are restricted to authorised reviewers and are not displayed publicly. Public campaigns use only the information necessary to explain the verified need and obtain support.
Sharing
Information may be shared with healthcare providers, verification partners, payment processors and lawful authorities where necessary and permitted. We do not sell personal information.
Retention and security
Records are kept only as long as needed for verification, accounting, legal compliance and public-interest reporting. We apply access controls, encryption in transit and audit logging.
Your rights
Subject to applicable law, you may request access, correction, restriction or deletion of personal information by contacting hello@smallhelp.org.
Security records and publication choices
We record sign-in attempts, timestamps, IP addresses and browser information. An optional local GeoIP database estimates location; this is not proof of residence. Security event records are normally removed after 180 days by the scheduled maintenance job. Medical evidence, accounting and audit records follow the foundation’s documented retention policy.
State of origin is private review information and must not determine funding priority. You may withdraw publication consent from your dashboard; this pauses the campaign and cancels future queued sharing. Contact support to request removal of earlier social posts or corrections to your personal information.
Automatic social sharing sends only the approved public title, image and campaign link to the foundation’s configured publishing service. Clinical reports, identity evidence and bank records are excluded.