Public Privacy Statement

This policy applies to the information Akiva processes in the ordinary course of business but does not refer directly to the Personal Information of employees, consultants and contractors which is the subject of a different policy.

We respect the privacy of all Data Subjects and will protect all the personal information with which we are entrusted. This policy tells you how we will process and protect your personal information.

In this notice: 

• • Clause headings are for convenience and reference only and shall not be used in the interpretation thereof

• • Any gender includes the other genders and a natural person includes a juristic person and vice versa

• • All the annexures (if any) hereto are incorporated herein and shall have the same force and effect as if they were set out in the body of this notice

• • The following words and/or expressions shall, unless the context indicates otherwise, bear the meaning assigned to them below and in POPIA

• • • Data Subject means the person to whom personal information relates
    • Child means a natural person under the age of 18 years who is not legally competent, without the assistance of a competent person, to take any action or decision in respect of any matter concerning himself. A child is afforded special protection under POPIA in relation to the lawful processing of his information
    • Competent Person is any person who is legally competent to consent to any action or decision in respect of a Child, i.e. a Child's parent or legal guardian;
    • POPIA refers to the Protection of Personal Information Act 4 of 2013;
    • GDPR refers to the General Data Protection Regulation (EU) 2016/679
    • Responsible Party means a public or private body or any other person which, alone or in conjunction with others determines the purpose of and means for processing personal information. Called Controllers in other jurisdictions (GDPR)
    • Operator means a person who is contracted to process personal information on behalf of the responsible party but is not controlled by the Responsible Party. Called Processors in other jurisdictions (GDPR)
    • Processing means any operation or activity, whether by automatic means or not, concerning personal information, including:

• The collection, receipt, recording, organisation, collation, storage, updating or modification, retrieval, alteration, consultation or use of data
• Dissemination by means of transmission, distribution or making available in any other form
• Merging, linking, restriction, degradation, erasure or destruction of information.

• • • Record means any recorded information

• Regardless of form or medium, including any of the following:

• Writing of any material
• Information produced, recorded or stored by means of any tape-recorder, computer equipment, whether hardware or software or both, or other device, and any material subsequently derived from information so produced, recorded or stored
• Label, marking or other writing that identifies or describes anything of which it forms part, or to which it is attached by any means
• Book, map, plan, graph or drawing
• Photograph, film, negative, tape or other device in which one or more visual images are embodied to be capable, with or without the aid of some other equipment, of being reproduced, in the possession or under the control of a responsible party

• Whether or not it was created by a responsible party and
• Regardless of when it came into existence.

• • • Personal Information means information relating to an identifiable, living, natural person, and where it is applicable, an identifiable, existing juristic person, including, but not limited to

• Information relating to the race, gender, sex, pregnancy, marital status, national, ethnic or social origin, colour, sexual orientation, age, physical or mental health, wellbeing, disability, religion, conscience, belief, culture, language and birth of the person.
• Information relating to the education or the medical, financial, criminal or employment history of the person
• Any identifying number, symbol, e-mail address, physical address, telephone number, location information, online identifier or other assignment to the person
• The biometric information of the person
• The personal opinions, views or preferences of the person
• Correspondence sent by the person that is implicitly or explicitly of a private or confidential nature or further correspondence that would reveal the contents of the original correspondence
• The views or opinions of another individual about the person
• The name of the person if it appears with other personal information relating to the person or if the disclosure of the name itself would reveal information about the person

• • • Special Personal Information refers to the personal information concerning the following: the religious or philosophical beliefs, race or ethnic origin, trade union membership, political persuasion, health or sex life or biometric information of a data subject.
    • De-identify means to delete any information which identifies the data subject; can be used or manipulated by a reasonably foreseeable method to identify the data subject; or can be linked by a reasonably foreseeable method to other information that identifies the data subject.
    • Consent is defined as the voluntary, specific and informed expression of will in terms of which permission is granted for the Processing of Personal Information;
    • Medical Service Providers (MSP’s) means all Medical Service providers (Doctors, Nurses, Physiotherapists, Radiologists, Surgeons etc…) as well as Private Hospitals and Clinics.

As a Data Subject, you have the following rights under POPIA:

• • Objection to the use of personal information on reasonable grounds relating to his situation

• • Notification if:
    • Information is being collected
    • Information is being used for something other than the original purpose for which consent was given
    • Information has been accessed or acquired by an unauthorised person

• • Establish whether the responsible party holds information on you, and to request access to said information
  • Request that information can be corrected, destructed or deleted
  • Refuse processing for direct marketing by unsolicited electronic communications
  • Lodge a complaint with the Information Regulator
  • Institute civil proceedings against a party who has acted unlawfully in relation to your Personal Information (Sec 99)

Akiva undertakes to adhere to the 8 Conditions for Lawful Procession of Personal Information as set out in POPIA:

• • Accountability

Akiva accepts full responsibility and accountability to responsibly manage and protect all the Personal Information we process

• • Processing Limitation

• • • Akiva will, wherever reasonably possible, collect information directly from the Data Subject, unless collection from another party is specifically permitted; the data subject has consented and the collection of information from a third party will not prejudice the data subject:

• In the case of Patient data, regarding a child or mentally incompetent adult, where a competent adult provides information on their behalf
• In the case of medical history, information will be collected from the Medical Service Provider/s
• In the case of financial information relating to their eligibility for Akiva assistance, information will be collected from the Jewish Helping Hand and Burial Society (“the Chev”)

• • • In all cases Data subjects express consent will be obtained. In the event that they are unable to consent due to their status as a minor or incompetent adult, consent will be sought from their next of kin/competent person.

• • • All Personal Information is processed to:
      • Protect the legitimate interest of data subject: in this case to protect their right to access quality medical care

• • • We respect the right of the Data Subject to, at any time, object or withdraw consent to any further processing and we have procedures in place for these instances

• • Purpose Specification

• • • Akiva will collect and process the absolute minimum data reasonably required in order to approve the Data Subject for financial assistance and to facilitate the successful handover to the Medical Insurance Broker (Cratos Life):

• • • • This data will be that which is stipulated by Cratos Life and Discovery Health in their application and assessment documentation.
      • This data does fall into the category of Special Personal Information, as it includes details of the Data Subjects medical treatment and medical history. This information is collected only insofar as it is required by Akiva for the verification of eligibility for financial assistance, as well as for the submission of their application to Cratos Life and Discovery.

• • • Akiva will only process Personal Information which is essential to enable us to approve them for eligibility for the funding of their medical aid premiums, and to ensure their application to Discovery is successful.

• • • The Data Subject will be made aware of the purpose of the collection through their consent form signed before the assessment commences.

• • • We shall only retain and store Personal Information for the period for which the data is required to serve its primary purpose or a legitimate interest or for the period required to comply with an applicable legal requirement, whichever is longer.

• • • • All records will be de-identified and/or destroyed at the time dictated by POPIA and other relevant governing legislation (National Health Act 61 of 2003; the Medical Schemes Act 131 of 1998; the Promotion of Access to Information Act 2 of 2000; and the Children’s Act 38 of 2005). Please see Record Retention Policy for further information.
      • Personal Information will be destroyed, deleted or de-identified as soon as is reasonably practical, preventing its reconstruction in an intelligible form.

• • Further Processing Limitation
    • Akiva will ensure that any further processing will be in accordance or compatible with the purpose for which it was originally collected, and will not take place without the express consent of the Data Subject.

• • • The Information Officer shall ensure that the information collected will not be used for any other purpose before obtaining the data subjects approval, unless the new purpose is required by law

• • • Akiva will not share any Personal Information with anyone or for any reason if not required for the finalization of the claim, or as required in terms of legislation or regulations

• • Information Quality
    • Reasonably practicable steps will be taken to ensure that the Personal Information is complete, accurate, not misleading and that the Personal Information is updated where necessary

• • • In actioning the above, Akiva will regularly review the purpose for which personal information is collected or further processed.

• •   Openness

Akiva will take reasonably practicable steps to be open and transparent on the nature, extent and reasons for processing Personal Information

To that end, we will ensure that the Data Subject is aware of:

• • • The information being collected
    • Our name and address
    • The purpose for which the information is being collected
    • Whether or not the supply of the information is voluntary or mandatory
    • The consequences of failure to provide the information
    • The right of access to and the right to rectify the information collected
    • The right to object to the processing of the information

The Information Officer shall also ensure that a person collecting personal information will be able to explain to the individual why this is being done: this will involve adequate training of all staff and MSP partners

• •   Security Safeguards

• • • Akiva will adequately safeguard and protect all Personal Information in our possession by adopting appropriate, reasonable technical organisational measures relevant to our industry.
    • We will, on an ongoing basis, continue to review our security controls and related processes to ensure that your Personal Information remains secure
    • Generally accepted standards of technology and operational security have been implemented to protect information from loss, misuse, alteration, or destruction. All our employees are trained on information security and are required to keep Personal Information confidential and only authorised persons have access to such information.
    • Any Operator processing information on behalf of Akiva will be required to sign a non-Disclosure agreement and an Operator Agreement in order to ensure:
      • Information is treated as confidential and not disclosed required by law
      • They apply the same security measures as Akiva
    • The Information Officer shall ensure that all employees, consultants and contractors have signed Non-Disclosure Agreements and have been adequately trained on the contents of this Policy, and other relevant Policies and Procedure Manuals
    • The Information Officer shall ensure that care is taken when personal information is disposed of or destroyed to prevent unauthorized parties from gaining access to it
    • Akiva will notify data subject and the Regulator of any breach of data.

• • Data Subject Participation

• • • Akiva commits to freely confirm what Personal Information we hold on Data Subjects, to update and rectify the Personal Information upon request and to keep it for no longer than required.

• • • We respect that the Data Subject may request us to:
      • Correct or delete information, which is inaccurate, irrelevant, excessive, out of date, incomplete, misleading or obtained unlawfully
      • Delete or destroy information that we are no longer authorised to retain

We will not use your Personal Information for any other purpose than that set out in this Policy, and we will take the necessary steps to secure the integrity and confidentiality of Personal Information in our possession and under our control by taking appropriate and reasonable measures to prevent loss of, damage to or unauthorised destruction of Personal Information and to prevent the unlawful access to, or processing of Personal Information.

If you have an inquiry or complaint regarding this Policy or the collection or use of your Personal Information, including any rights of access, ability to limit the use or disclosure of Personal Information, or to correct or delete inaccurate Personal Information, please email popia@akivamedical.co.za

For further information on how to lodge a complaint, please see the Akiva Complaints Policy

Access to Akiva’s full suite of Privacy Policies is available upon request from our Information Officer