Legal

POPIA AND PAIA MANUAL

Prepared in accordance with Section 51 of the Promotion of Access to Information Act, No 2 of2000 (“PAIA”), read with and as amended by the Protection of Personal Information and/or Special Personal Information Act, No 4 of 2013 (“POPIA”)

This manual applies to information held by:

Hatzolah Medical Rescue, Johannesburg (Registration No: 2003/019932/08),who is registered as an NPC in terms of Schedule 1 of Act 71 of 2008 (NPO No: 017-450 NPO; and PBO No: 930000863).

PART A: HATZOLAH’S PRIVACY POLICY

This privacy policy sets out the basis on which any Personal Information, including Special Personal Information, is collected from you and/or that you provide to us and/or is used; stored; disclosed and processed by us. Please read the following carefully to understand our practices regarding your Personal Information and/or Special Personal Information, how we will treat it and your rights in relation to that information.

If you do not agree with this Privacy Policy, or are concerned about any aspect as it relates to your Personal Information, please cease to use our services, website or other online or digital platform(s) offered by us and kindly contact us to discuss same.

By providing your Personal Information and/or Special Personal Information to us or by using our services, website or other online or digital platform(s) you are accepting and proving us with your express consent to the practices as described or referred to in this privacy policy.

When we refer to ‘we’, ‘us’ and ‘our’, we mean Hatzolah Medical Rescue, Johannesburg NPC Registration No: 2003/019932/08.

PLEASE READ THIS PRIVACY POLICY CAREFULLY. Should we ask you to provide certain information by which you can be identified when using our website and/or services then you can be assured that it will only be used in accordance with this Privacy Policy, which may, however, change from time to time.

All of the provisions of this Privacy Policy are important, but please pay special attention to the parts that are in bold writing. These parts contain information about provisions that have special consequences for you. These parts are only intended to bring such provisions to your attention, and, where necessary, to explain their essence, nature and effect. Where explanations are given, they may be contained in a box. Such boxed explanations are aids to understanding only and are not provisions themselves. They do not limit the meaning or application of the provisions, and do not apply only to the situations and examples described in the boxes or only to similar situations or examples.

The promotion of Access to Information Act, 2000, as amended, (the “PAIA”) gives third parties the right to approach, amongst others, private bodies to request information held by them, which is required in the exercise and/ or protection of any rights. On request, the private bodies are obliged to release such information unless the PAIA expressly states that the records containing such information may or must not be released. This manual informs requestors of procedural and other requirements which a request must meet as prescribed by the PAIA, and further incorporates or addresses the requirements of the Protection of Personal Information Act, 2013 (“POPI”)

Introduction And Scope

Hatzolah Medical Rescue, Johannesburg (Registration No: 2003/019932/08) (“Hatzolah” or “we” or “us” or “our”) is a private emergency medical care provider and provides quality emergency response and pre-hospital care services, supporting both public and private hospitals in Johannesburg with our base being, 29 Durham St, Raedene, Johannesburg, 2192. Hatzolah is a responsible party in respect of your Personal Information (as defined in clause 3.1 below), and Special Personal Information (as defined in clause 4 below), which means that Hatzolah determines the purpose of and means for processing your Personal Information and/or Special Personal Information.

Hatzolah provides, amongst other things , quality emergency medical response and pre-hospital care services, a Gemach, CRU, and wellness programs (“services”)

Hatzolah is committed to protecting and respecting your privacy. We strive to ensure that our use of your Personal Information and/or Special Personal Information is lawful, reasonable, and relevant to our activities, with the ultimate goal of improving our services and your experience.

We have appointed an Information Officer who is responsible for overseeing questions in relation to the Privacy Policy. You may contact our Information Officer, Darren Kahn at darrenkahn@hatzolah.co.za to discuss this Privacy Policy or your rights under data protection legislation that is applicable to you.

This Privacy Policy describes how we will treat your Personal Information and/or Special Personal Information, whether provided by you to us, or collected by us through other means, including but not limited to when you engage with us, in your ordinary use of our services, in providing us with your products, services and/or donations, or in accessing our website (the “Website”) or through our independent diagnostics.

This Privacy Policy must, as is appropriate, be read together with Hatzolah’s Website Terms of Use (https://www. hatzolah.co.za/ ), (the “Terms”) and any other documents or agreements between you and us (the “Agreements”) that describe the manner in which we, in specific circumstances, collect or process Personal Information and/or Special Personal Information about you. This will enable you to understand the manner in which we will process your Personal Information and/or Special Personal Information. This Privacy Policy supplements such Terms and Agreements, but does not supersede them and in the event of any conflict, ambiguity or inconsistency between this Privacy Policy, the Terms and/or the Agreements, such documents shall be construed in the following order of priority:

this Privacy Policy;

the Terms;

and the Agreements.

Your consent to the Processing of your Personal Information and/or Special Personal Information

We may collect, get, receive, record, organise, collate, store, update, change, retrieve, read, process, use and share your Personal Information and/or Special Personal Information in the ways set out in this Privacy Policy. When we do one or more of these actions with your Personal Information and/or Special Personal Information, we are “Processing” your Personal Information and/or Special Personal Information (and “process” has a corresponding meaning).

If you are concerned about any aspect of this Privacy Policy as it relates to your Personal Information and/or Special Personal Information, please do not continue to use our Website or our services, until you are able to engage with us in a manner that alleviates your concerns and aligns with this Privacy Policy.

We may, where permitted or required to do so by applicable law, process your Personal Information and/or Special Personal Information without your knowledge or permission, if sufficient grounds of justification are present, and we will do so in accordance with the further provisions of this Privacy Policy.

Who Does This Privacy Policy Apply To?

This Privacy Policy applies to the processing by us or on our behalf, and our successors-in-title, of the Personal Information and/or Special Personal Information relating to you, being a user who accesses and/or uses our Website and/or our services including but not limited to: website users, patients, suppliers, employees, consultants, volunteers, job candidates, medical practitioners, practices and suppliers (including medical practitioners, practices and health professionals providing medical services at hospitals we transfer patients to) and other data subjects that engage with us. This Privacy Policy applies regardless of the device which you use to access our Website or to engage with us, which device is capable of using, or enabled to use, the Website including, but not limited to, internet-connected mobile devices and tablets (“Access Device”).

This Privacy Policy does not apply to the processing of Personal Information and/or Special Personal Information by other third parties relating to or by means of other parties’ websites, products or services, such as websites linked to, from or advertised on the Website or through our products and services, or sites which link to or advertise the Website or our products, services and employees.

What Is Personal Information And/Or Special Personal Information?

“Personal Information and/or Special Personal Information” refers to private information about an identifiable living natural person or, where applicable, an identifiable existing juristic person, including, but not limited to:

information relating to the race, gender, sex, pregnancy, marital status, national, ethnic or social origin, colour, sexual orientation, age, physical or mental health, well-being, disability, religion, conscience, belief, culture, language and birth of the person;

information relating to the education or the medical, financial, criminal or employment history of the person;

any identifying number, symbol, e-mail address, physical address, telephone number, location information, online identifier or other particular assignment to the person;

the biometric information of the person;

the personal opinions, views or preferences of the person;

correspondence sent by the person that is implicitly or explicitly of a private or confidential nature or further correspondence that would reveal the contents of the original correspondence;

the views or opinions of another individual about the person; and

the name of the person if it appears with other personal information relating to the person or if the disclosure of the name itself would reveal information about the person.

Personal Information and/or Special Personal Information does not include information that does not identify you (including in instances where that information has been de-identified so that it does not identify a person). The Personal Information and/or Special Personal Information that we collect about you may differ on the basis of your engagement with us or the services that you receive from us or that you provide to us.

Special Personal Information

We hereby notify you that, in certain circumstances, by engaging with us, we may collect certain Special Personal Information about you. “Special Personal Information” refers to details about your religious or philosophical beliefs, race or ethnic origin, trade union membership, political persuasion, health or sex life (including medical information), biometric information or information about your criminal offences or convictions.

The processing of Special Personal Information requires higher levels of protection. We have implemented appropriate policies and safeguards, which we are required by law to maintain, to process Special Personal Information.

WHAT PERSONAL INFORMATION AND/OR SPECIAL PERSONAL INFORMATION WE MAY COLLECT AND PROCESS

While using our website or engaging with us for the provision of any of our services, you may be required to provide us with your Personal Information and/or Special Personal Information. This may happen when, for example, you send through an enquiry on a contact form on our website, you complete the pre-admission process on our website, you upload your medical information or when you use our services, especially our emergency medical services.

In certain instances, you may also be required to provide us with health information and other sensitive information that is classified by POPIA as Special Personal Information. The collection of this information from you, when required, will be necessary in order to provide you with our services.

Given the nature of the services we provide, we are also required to collect and process the Personal Information and/ or Special Personal Information of children, for example where the patient being treated by one of our paramedics is under the age of 18 years.

We May Process Various Types Of Personal Information And/Or Special Personal Information About You, As Follows:

Identity Information, which includes information concerning your name, username or similar identifier, biometric information, marital status, title, occupation, interests, date of birth, gender, race and legal status, as well as copies of your identity documents, photographs, cctv video and audio footage, identity number, registration number and your qualifications;

Personal details, such as names, family information, ages and next of kin details;

Contact Information, which includes your billing addresses, delivery addresses, e-mail addresses and telephone numbers;

Demographical details, such as race, and age groups; Health information and other special personal information, regarding your medical treatment (historic and current), background information, pre-admission information and admission information;

Children’s personal information, in relation to children (under the age of 18) who receive services, treatment and care by us;

Financial Information, which includes financial information such as credit information, bank account details, insurance and medical aid information, financial statements, tax clearance certificates and VAT registration numbers;

Qualification information, CV’s and other personal information that may be requested throughout the recruitment process to assess and consider the job application (in relation to job applicants);

Professional body registration information and practice information, (in relation to medical practitioners and medical caregivers);

When visiting our website or accessing our Facebook page, anonymised data relating to your location and your browser type, browser version, the pages of our website that you visit, the date and time of your visit, the duration of time spent on the website pages and other applicable statistics are recorded by Google Analytics to analyse user behaviour on our website;

Technical Information, which includes your internet protocol (IP) address, your login data, browser type and version, time zone setting and location, browser plug-in types and versions, operating system and platform, and other technology on the devices you use to access the Website or to use our products and services or engage with us;

Usage Information, which includes information as to your access to and use of the Website, products and services, such as what links you went to, what content you accessed, the amount of content viewed and the order of that content, as well as the amount of time spent on the specific content and what products and services you access and use when engaging with us;

Location Information, which includes geographical information from your Access Device (which is usually based on the GPS or IP location); and

Marketing and Communications Information, which includes your preferences in respect of receiving marketing information from us and our third parties, and your communication preferences.

We may also process, collect, store and/or use aggregated data, which may include historical or statistical data (“Aggregated Data”) for any purpose, including for know-how and research purposes. Aggregated Data may be derived from your Personal Information and/or Special Personal Information but is not always considered Personal Information and/or Special Personal Information, as this data does not directly or indirectly reveal your identity. However, if we combine or connect Aggregated Data with your Personal Information and/or Special Personal Information in a manner that has the result that it can directly or indirectly identify you, we will treat the combined data as Personal Information and/or Special Personal Information, which will be managed in accordance with this Privacy Policy.

How We Collect Your Personal Information And/Or Special Personal Information

We collect your Personal Information and/or Special Personal Information in the following ways:

through direct or active interactions with you;

through automated or passive interactions with you;

from third parties and public sources; and

through CCTV footage.

Direct or active collection from you

We may require that you submit certain information:

to enable us to render provision of our services or pass on your information to allow other ambulance or medical services to assist you;

to enable you to access portions of the Website or Facebook page;

to subscribe to our publications;

to request marketing or information about our events to be sent to you;

to apply for job opportunities;

to make contact with our partners and employees;

to grant you access to our premises;

to enable you to facilitate the conclusion of an agreement with us; and

that is necessary for our fulfilment of our statutory or regulatory obligations.

We also collect Personal Information and/or Special Personal Information directly from you when you communicate directly with us, for example when you complete certain application forms (including patient histories), via e-mail, telephone calls, feedback forms, registering for and attending events, giving us your business card, through CCTV footage, site comments or forums.

Our call centres record their calls for quality control and record-keeping purposes. When you contact our call centres, the information you give us will be used to render provision of our services, investigate and resolve your query, complaint or request. Our call centres are committed to keeping your personal information safe and secure. Please take care not to provide more information than what we ask for. Never give us your banking details, credit card details or any passwords.

If you contact us, we reserve the right to retain a record of that correspondence in accordance with our Record Retention Policy and applicable data protection legislation, which may include Personal Information and/or Special Personal Information.

The Personal Information and/or Special Personal Information that we actively collect from you may include any of the Personal Information and/or Special Personal Information listed in this Privacy Policy.

Generally, the collection of Personal Information and/or Special Personal Information from you and/or any other sources referred to above is mandatory in order to achieve the purpose for which it is being collected by us (as set out below). We will notify you where the collection of certain Personal Information and/or Special Personal Information is voluntary and not mandatory. The refusal to provide us with the mandatory Personal Information and/ or Special Personal Information that we may require, may have an impact on our ability to provide you with our services or to provide you with proper treatment and care.

Passive collection from your Access Device when browsing our Website

We may passively collect certain of your Personal Information from the Access Device that you use to access and navigate the Website, by way of various technological applications, for instance, using server logs to collect and maintain log information.

We also use cookies and anonymous identifiers which enable our computer system to recognise you when you next visit the Website to distinguish you from other users and to improve our service to you, and which can be used to enhance the content of the Website and make it more user-friendly, as well as to give you a more personalised experience.

A cookie is a small piece of data (an alphanumeric identifier) which our computer system transfers to your Access Device through your web browser when you visit the Website and which is stored in your web browser. When you visit the Website again, the cookie allows the site to recognise your browser. Cookies may store user preferences and other information.

You may disable the use of cookies by configuring your browser to refuse all cookies or to indicate when a cookie is being sent. However, please note that some parts of the Website will not function properly if you refuse cookies and you may not be able to enjoy all of the features and functionality of the Website.

The Personal Information that we passively collect from your Access Device may include your Identity Information, your Contact Information, your Technical Information, your Profile Information, your Usage Information, your Location Information and your Marketing and Communications Information, or any other Personal Information which you permit us, from time to time, to passively collect from your Access Device.

Collection from third parties and public sources

In certain circumstances we may also collect your Personal Information and/or Special Personal Information from other sources, such as when you are being treated by us. In these circumstances we may, for example, collect your personal information, including your health information, from your family member, friend, your medical aid scheme (including the scheme administrator) or any third-party medical insurer you have contracted with, and other medical practitioners and allied health professionals involved in your treatment and care.

We receive Personal Information and/or Special Personal Information about you from various third parties including recruitment agencies, suppliers of background checks services and publicly available sources.

CCTV

We collect Personal Information and/or Special Personal Information about you through CCTV cameras installed at our premises and/or on our vehicles for safety, health and security reasons.

How We Use Your Personal Information And/Or Special Personal Information

We use your Personal Information and/or Special Personal Information for the following purposes:

To attempt and/or to render services to you;

To process any other enquiry that you may make with us, whether through our website, or directly with us;

To assess any medical treatment, you may require;

To provide you with appropriate treatment and care and to enable treating medical practitioners, medical practices and other medical persons involved in your treatment and care, to provide you with appropriate treatment and care. In providing you with appropriate treatment and care it is important to note that some of your Personal Information and/or Special Personal Information, including where necessary your health information, will be displayed in our ambulances and provided to third-party hospitals, treatment facilities and or medical practitioners who will take-over your care from us. While we will take all reasonably practical steps to minimise the personal and health information displayed in our ambulances, the personal and health information that is displayed on these information boards is critical, essential and necessary for your treatment and care;

To process any claim that may be made on your behalf through your medical aid scheme (including the scheme administrator) or any third party medical insurer you have contracted with;

To process any medical claim that may be made by us with the Road Accident Fund (under the Road Accident Fund Act) or the Compensation Fund (under the Compensation for Occupational Injuries and Diseases Act) or any other similar body, in relation to your treatment and care;

To comply with all legislative and legal requirements placed on us, which may include, but not be limited to, legislative reporting and document retention periods and where the law requires that information regarding certain diseases be notified to the authorities;

To conclude or perform a contract with you, or to take any take steps linked to or necessary for the conclusion or performance of a contract with you;

Internal record keeping;

improve our services;

for safety and security reasons,

to contact you for market research purposes. We may contact you by email, phone, fax or mail;

to contact you regarding current or new fundraising initiatives or request for donations and community outreach (provided you have consented to receiving such marketing material);

to inform you of new features, special offers and promotional competitions (provided you have consented to receiving such marketing material);

to improve your experience on our Website by, inter alia, monitoring statistical non-personal browsing habits, and to transact with us;

to comply with our statutory obligations, including patient identification and verification as part of our obligations, and screening patients and visitors’ health when accessing our premises to comply with Covid-19 regulations and protocols;

to conduct the recruitment and hiring processes, which includes conducting criminal record and credit checks (where appropriate), the capturing of a job applicant’s details and providing status updates to job applicants;

in relation to supplier information, to create supplier profiles on our systems, pay suppliers, and for general supplier administration;

To improve our services, the quality of our care, the quality of the medical technology that we have available, and to manage our relationship with you, for example by asking for your feedback on the services and quality of care you received from us or through the completion of a customer service satisfaction survey;

To perform general administrative, operational, management and performance functions and activities relating to the operation and running of our business and of our website, and for the purposes of managing our legal and operational affairs;

to retain and make information available to you on the Website;

to maintain and update our respective databases;