What this workflow must solve — risks and buyer needs

Wellness centres offering non‑invasive screenings face four practical risks: accidental data leaks (printed reports or unprotected files), client mistrust from ambiguous results or surprise data use, legal exposure under Nigeria’s privacy expectations and NDPR‑style rules, and operational gaps when staff change shifts. Our priority is to stop unnecessary exposure while keeping the client experience fast and transparent so you do not lose bookings or create avoidable complaints.

Who owns compliance in your centre — roles and simple responsibilities

Assign clear ownership. Small centres can combine roles; larger centres should separate them.

• Owner/Manager — final responsibility for policy, retention schedule and incident response plan.
• Compliance Lead / Senior Therapist — maintains consent templates, trains staff, signs off reports before release.
• Receptionist — does intake, obtains initial consent, records identity and contact details, prints or emails report per client choice.
• Operator / Screening Technician — conducts the screening, explains immediate results in non‑medical language, flags anything unclear to the Compliance Lead.
• IT / System Administrator — enforces encryption, backups and software licensing, manages user accounts and audit logs.

Consent essentials: what to include in a screening consent form

Keep the written consent one page. Use clear English and offer a translated version in the client’s preferred language or local dialect.

• Purpose — state the screening is a non‑invasive wellness assessment for educational and health‑management purposes only.
• Scope & Limits — explicitly say the screening does not replace clinical diagnosis or treatment by a medical professional.
• What we collect — name, contact, brief clinical context, and screening readings/report.
• How we use data — internal record keeping, follow‑up communications, anonymised service improvement (if applicable).
• Retention — state a clear retention range you adopt (see below) and how clients can request deletion or a copy.
• Opt‑out — allow refusal of non‑essential data uses and explain service impact (e.g., no follow‑up emails if opted out).
• Consent confirmation — signature, printed name, date, and a box for a staff witness or operator name.

Step‑by‑step consent workflow for an on‑site screening session

1. Booking: confirm screening type, the non‑medical nature of the service, and offer the optional pre‑visit consent form by email or WhatsApp.
2. Reception intake: check ID, collect minimal context (primary complaint or wellness goal), and ask the client to read and sign the one‑page consent. If the client requests, read it aloud in their language and note that a verbal interpreter was used.
3. Before screening: operator repeats the core points aloud (purpose, non‑diagnostic, data use) using the short verbal script below and asks for verbal confirmation, recorded in the session log.
4. Screening: perform the test. Operator documents any observation that affects interpretation (e.g., movement, missing data).
5. Results handover: give a printed or emailed PDF report and a short, non‑medical explanation. Invite questions and suggest a referral to a medical professional for clinical interpretation where appropriate.
6. Post‑session: receptionist files the signed consent form with the report, updates the electronic client record, and makes the encrypted backup for that day.

Short verbal script for operators

“This screening is a non‑invasive wellness assessment to give you information for health management. It is not a medical diagnosis or treatment. We will collect your name, contact, and the session report. May we proceed?” Record the client answer (Yes/No) in the session log.

Data collection and storage rules for screening reports

Record only what you need. Minimal fields: client full name, contact (phone or email), date of birth (or age), brief reason for visit, operator name, date/time, and the exported screening report file name.

File formats: export every report as a locked PDF and keep the signed consent as a scanned PDF. Do not rely on proprietary files that cannot be opened without specific vendor software unless you also keep a PDF export.

Retention guidance: choose and publish a retention policy — common practical practice in wellness centres is to keep records for a few years to support follow‑ups and complaints. We recommend consulting local counsel and NDPR guidance before fixing a specific period; ensure the policy is applied uniformly.

Digital workflow: safe software and file handling

• Use only licensed vendor software. Do not install unverified or unpackaged software from third parties; ask the supplier for the official installer and a checksum if available.
• Export every session to a PDF immediately after the screening and close the proprietary session.
• Store reports on a secure local server or an encrypted drive. Maintain a daily encrypted backup (external hard drive or cloud service with AES‑256 encryption and access control).
• Maintain user accounts per staff role; avoid shared generic login accounts. Ensure the administrator account is separate and protected with a strong password or 2FA where possible.

Access control and physical security for reports and devices

Limit physical access to the screening room and the PC used for exports. Keep printed reports in a locked file cabinet and shred unwanted printouts. Devices should auto‑lock after a short idle time. If a report is emailed, send it as a password‑protected PDF and share the password verbally or via SMS to the client’s phone only.

Client handover and record‑release: communicating results without medical claims

When you hand a report to a client:

• Use plain language: explain the report is an assessment, not a diagnosis.
• Avoid clinical recommendations unless you have a qualified clinician on staff authorised to do so; instead, suggest clients discuss findings with their medical provider for diagnosis or treatment.
• Offer printed guidance: a one‑page “Next steps” sheet (see template below) that tells clients how to get a copy of records, request deletion, or ask for clarification.

Data breach checklist and client notification template

Immediate actions (first 24 hours):

• Isolate the affected system or device.
• Preserve logs and note time/date of discovery.
• Change passwords and suspend any compromised user accounts.
• Notify the Compliance Lead and the Owner/Manager.
• Assess which client records were exposed.

Client notification template (use clinic letterhead, adapt language):

Subject: Notice about your personal data held by [Clinic name]

Dear [Client name],

We are writing to inform you of a recent security incident affecting some client records. On [date] we discovered [brief description of incident]. We believe the following information relating to you was exposed: [list fields, e.g., name, contact, report].

We have taken steps to contain the incident and are reviewing our systems. If you have questions or would like a copy of your record or to request deletion, please contact [Compliance Lead name] at [email/phone].

Sincerely,
[Owner/Manager name], [Clinic name]

Training checklist and simple SOP for staff

Daily start checklist (reception & operator):

• Verify scheduled clients and confirm consent forms prepared.
• Boot the screening PC, confirm software license and PDF export works.
• Check encrypted backup drive is connected and available.

Consent checks:

• Receptionist confirms signed consent before directing client to screening.
• Operator reads the short script and marks verbal confirmation on the session log.

Incident reporting:

• All staff must report data incidents immediately to the Compliance Lead; keep a written incident log.
• Monthly internal audit: random check of five recent reports for correct consent, correct file export and storage location.

Template files and scripts to use at reception

Consent short script (reception): “We will take a brief non‑invasive screening and collect a report to help you manage wellness. This is not a medical diagnosis. Please read and sign this one‑page consent. Do you have any questions?”

Data‑use summary (one paragraph to hand to clients): “We keep your name, contact and the screening report to provide follow‑up services and to improve our services. You can request a copy or ask us to delete your record at any time.”

Audit checklist (one page)

• Signed consent present and dated for each audited report.
• PDF export exists and opens on a neutral device.
• Report emailed only with password protection when applicable.
• Backups present and encrypted.
• Access logs show no shared generic accounts.

Next step — if you want a ready‑to‑use consent pack and SOP adapted to your clinic floor plan, email us at lucy@quantumanalyzer.ng or WhatsApp/phone +8613510907401. We can prepare a template consent form, staff scripts in a Nigerian language you request, and a one‑page retention policy draft for your review. Pricing and configuration are available on inquiry.

Disclaimer: The screening services and reports discussed here are for health‑management and educational purposes and are not a substitute for professional medical diagnosis or treatment. We do not promise diagnostic or therapeutic outcomes. Please consult a qualified medical professional for clinical decisions.

This content is provided for learning, information sharing and professional communication only. It is not medical advice and is not a basis for treatment or diagnosis. Confirm suitability, operation and purchasing requirements against the product manual, local regulations and qualified professional guidance.