Privacy Policy

1.1 Valomate Solutions (Pty) Ltd funds, administers and collects medical claims against the Road Accident Fund and the Compensation Fund on behalf of Medical Service Providers. We place road accident patients in private hospitals and manage the medical care of patients who hold an RAF Undertaking. We register employers with the Compensation Fund and administer their COID claims, and we administer COID awards on the instruction of attorneys.

1.2 To do this work we Process Personal Information, including the health information and identity numbers of injured patients. We are the Responsible Party for that Personal Information under POPIA.

1.3 We also comply with the National Health Act 61 of 2003, the Road Accident Fund Act 56 of 1996, COIDA, the Children's Act 38 of 2005 and PAIA in so far as they apply to the records we hold.

1.4 This Policy sets out what Personal Information we collect, on what lawful basis, how we use, share, secure and retain it, and how a Data Subject exercises their rights.

2.1 This Policy applies to all Personal Information we Process in the ordinary course of business. The Personal Information of employees, job applicants, consultants and contractors is governed by the Employee Data Privacy Policy.

2.2 This Policy binds every director, employee, consultant, contractor and Operator who Processes Personal Information for us.

3.1 POPIA gives effect to the constitutional right to privacy by regulating the Processing of Personal Information. It sets eight conditions for lawful Processing, gives Data Subjects enforceable rights, and establishes the Information Regulator to monitor and enforce compliance.

3.2 We are registered with the Information Regulator as a Responsible Party, and our Information Officer is registered with the Regulator.

4.1 We Process Personal Information lawfully, for a specific and explicitly defined purpose, in a manner that respects the Data Subject's right to privacy, and in accordance with POPIA.

4.2 This Policy is read with POPIA and its Regulations, with PAIA, and with the supplementary policies listed in clause 12.

(a) Clause headings are for convenience and do not affect interpretation.

(b) A reference to one gender includes the other genders. A reference to a natural person includes a juristic person where the context allows.

(c) Annexures form part of this document.

(d) Words defined in POPIA carry the same meaning here. The following words have the meanings given below.

(a) to be notified that Personal Information about them is being collected, and that their Personal Information has been accessed or acquired by an unauthorised person (sections 18 and 22);

(b) to establish whether we hold Personal Information about them and to request access to it (section 23);

(c) to request the correction, destruction or deletion of Personal Information (section 24);

(d) to object, on reasonable grounds relating to their particular situation, to the Processing of their Personal Information (section 11(3));

(e) to object to Processing for purposes of direct marketing (section 11(3)(b) and section 69);

(f) not to be subject to a decision based solely on automated Processing that has legal consequences for them (section 71);

(g) to submit a complaint to the Information Regulator (section 74); and

(h) to institute civil proceedings regarding an interference with the protection of their Personal Information (section 99).

7.1.1 The directors are accountable for compliance with POPIA. The Information Officer is responsible for it day to day and reports to the directors.

7.2.1 We Process Personal Information only where at least one of the following grounds in section 11 applies: the Data Subject or a Competent Person consents; the Processing is necessary to carry out actions for the conclusion or performance of a contract to which the Data Subject is party; the Processing complies with an obligation imposed by law; the Processing protects a legitimate interest of the Data Subject; or the Processing is necessary to pursue our legitimate interests or those of a third party to whom the information is supplied.

7.2.2 We collect Personal Information directly from the Data Subject where reasonably practicable. We collect it from a third party where the Data Subject or a Competent Person has consented, where the information is contained in a public record, where collection from another source does not prejudice a legitimate interest of the Data Subject, or where collection from the Data Subject would prejudice a lawful purpose of the collection or is not reasonably practicable (section 12(2)). Patient information reaches us from the treating Medical Service Provider, the referring EMS provider, the patient's attorney, the RAF or the Compensation Fund.

7.2.3 A Data Subject may withdraw consent or object to Processing at any time by following the Data Subject Request Procedure. Withdrawal does not affect Processing that took place before it, or Processing that continues on another lawful ground.

7.3.1 We collect Personal Information for the specific purposes described in clause 8. We collect only what those purposes require and what the RAF, the Compensation Fund or the treating Medical Service Provider requires for the claim.

7.3.2 We make the Data Subject aware of the purpose of collection through the Notice and Consent to Processing of Personal Information (RAF Patients), the Patient Consent Form (Undertaking), our Public Privacy Statement, the website privacy notice and the notification described in clause 7.6.

7.3.3 We keep Personal Information for no longer than the Record Retention Policy and the Record Retention Schedule allow, and then destroy or De-identify it so that it cannot be reconstructed in an intelligible form.

7.4.1 We use Personal Information for a purpose other than the original purpose only where the further purpose is compatible with it, the Data Subject consents, the information is contained in a public record, further Processing is required by law or in legal proceedings, or the Regulator has granted an exemption.

7.4.2 We do not sell Personal Information and we do not use it for direct marketing.

7.5.1 We take reasonable steps to keep Personal Information complete, accurate, not misleading and up to date. Patient details are verified against the identity document and the treating Medical Service Provider's records. We correct information on request in terms of the Data Subject Request Procedure.

7.6.1 We maintain the PAIA Manual required by section 51 of PAIA and section 17 of POPIA.

7.6.2 Before we collect Personal Information from a Data Subject, or as soon as reasonably practicable after we collect it from another source, we tell the Data Subject or the Competent Person: what information we collect; our name and address; the purpose of collection; whether supply is voluntary or mandatory and the consequences of not supplying it; the law that requires the collection, where one does; that we will share the information with the RAF, the Compensation Fund, the Medical Service Providers involved in the Matter, and the patient's attorney; whether the information will be stored outside South Africa; and their rights of access, correction, objection and complaint. The Notice and Consent to Processing of Personal Information (RAF Patients) and the Patient Consent Form (Undertaking) carry this notification.

7.6.3 Where notification is not reasonably practicable, for example where a patient is unconscious and no Competent Person can be reached, we record the reason and give the notification as soon as we can (section 18(4)).

7.7.1 We secure the integrity and confidentiality of Personal Information in our possession or under our control through appropriate, reasonable technical and organisational measures. We identify reasonably foreseeable internal and external risks, establish and maintain safeguards against them, verify that the safeguards work, and update them when new risks appear.

7.7.2 Physical measures include: premises inside a gated estate with 24-hour security guards, sensors and cameras; armed response; a security gate at the office entrance; and no hard-copy records. Paper we receive is scanned into the Matter file and shredded.

7.7.3 Technical measures include: password and multi-factor authentication on every account, device and system, governed by the Password Policy; encryption of every laptop; up-to-date antivirus and endpoint protection; automatic software updates; email warnings on messages from outside the company; backups of VCM and OneDrive under our control; a data recovery plan; and the controls in the Information Security Policy and the IT Change Management Policy.

7.7.4 Organisational measures include: access to Personal Information limited to the people who need it for the Matter; a signed non-disclosure agreement from every director, employee, consultant and contractor before access is granted; POPIA training at induction and every 12 months; the Clean Desk Policy; and the Employee Exit Policy.

7.7.5 An Operator Processes Personal Information for us only under a written contract that requires it to Process the information only with our knowledge or authorisation, to treat it as confidential, to maintain security measures at least equal to ours, and to notify us immediately of any Security Compromise (sections 20 and 21). Our Operator Register lists every Operator and the contract that governs it.

7.7.6 Where there are reasonable grounds to believe that Personal Information has been accessed or acquired by an unauthorised person, we notify the Information Regulator and the affected Data Subjects as soon as reasonably possible, in the manner set out in the Incident Response Policy and Procedure (section 22).

7.8.1 We confirm, free of charge, whether we hold Personal Information about a Data Subject. We give access to the record, correct or delete information that is inaccurate, irrelevant, excessive, out of date, incomplete, misleading or unlawfully obtained, and destroy or delete information we are no longer authorised to keep, on request and within the time limits in the Data Subject Request Procedure.

8.1.1 We Process the Personal Information of patients in order to: fund and case-manage private hospital treatment of road accident patients; submit and collect the Medical Service Provider's supplier claim against the RAF; manage the medical care of patients who hold an RAF Undertaking and claim the costs from the RAF; administer COID claims for injured employees on behalf of their employers, and COID awards on behalf of attorneys; verify the patient's identity; respond to queries from the patient, the Competent Person, the Medical Service Provider, the attorney, the RAF or the Compensation Fund; and comply with the law and with lawful requests from the Regulator, a court or a public body.

8.1.2 The Personal Information we Process about a patient is limited to what the RAF, the Compensation Fund or the treating Medical Service Provider requires for the Matter. It may include:

8.1.3 Health information is Special Personal Information. We Process it on the following grounds: consent of the patient or a Competent Person (section 27(1)(a)); the Processing is necessary for the establishment, exercise or defence of a right or obligation in law, being the supplier claim, the Undertaking claim or the COID claim (section 27(1)(b)); and, where the patient is a Child, consent of a Competent Person or the establishment of a right in law (section 35(1)(a) and (b)).

8.1.4 We collect a patient's race only where the RAF or the Compensation Fund requires it on the claim form, and for no other purpose (section 29(a)).

8.1.5 We use identity numbers to verify identity and to identify the patient to the RAF, the Compensation Fund and the Medical Service Provider. We do not link identity numbers with information held by other responsible parties for any other purpose, and prior authorisation under section 57 is therefore not required.

8.2.1 We Process the following information about Medical Service Providers and their staff in order to contract with them, fund and collect their claims, pay them, and respond to their queries: entity name and registration number; practice number; names, telephone numbers and email addresses of contact persons at head office and at each hospital, clinic or branch; physical and postal addresses; bank details; and invoices, statements and claim documents.

8.3.1 We Process the names, entity details, registration numbers, contact details and instructions of employers who engage us for COID registration and claims, attorneys who instruct us on COID awards or refer Undertaking patients, and state facilities that refer patients, in order to carry out the instruction, report on progress and invoice for our services.

8.4.1 A person who submits an enquiry on valomatesolutions.co.za gives us their name, contact details and the audience they belong to, and a short description of what they need. We use this only to respond to the enquiry. We do not ask for health information on the website. Where an enquiry becomes a Matter, the enquiry joins the Matter file. Where it does not, we delete it 12 months after our last contact with the enquirer.

8.5.1 We Process the contact and banking details of our suppliers in order to procure and pay for goods and services, as described in the Financial Data Policy.

9.1 We store Personal Information in VCM, which we own and host on our own hardware, in Microsoft 365 email and OneDrive, and on encrypted company laptops.

9.2 Only directors, employees and Operators who need the information for a Matter or for a business function have access to it, and only to the extent they need it. Access rights are set per user and reviewed when a person's role changes and when they leave.

9.3 We hold no hard-copy records. Paper we receive is scanned into the Matter file and shredded.

9.4 VCM and OneDrive are backed up under our control. The Information Security Policy governs backups, recovery and system security.

9.5 We keep a Security Compromise Register of every security incident, whether or not it is notifiable.

10.1 We share a patient's Personal Information, including health information, only with the parties to the Matter: the RAF or the Compensation Fund, in order to submit and collect the claim; the Medical Service Providers treating the patient; the patient's attorney, where one is instructed; and the employer, in a COID Matter, to the extent the claim requires. Each recipient is a Responsible Party in its own right for the information it receives.

10.2 We disclose Personal Information to any other person only where the Data Subject or a Competent Person has consented, the law or a court requires it, or disclosure is necessary to establish, exercise or defend a right in law.

10.3 Our Operators are Microsoft (email and OneDrive), our external IT support provider, and our payroll, accounting and audit providers. Each is bound as described in clause 7.7.5.

10.4 VCM and its data are hosted on our own hardware in South Africa. Microsoft 365 and OneDrive data are stored in Microsoft's South African data centres under Microsoft's data protection terms. We do not transfer Personal Information outside South Africa. Where a transfer becomes necessary, we make it only on a ground in section 72 and, for Special Personal Information or the information of a Child going to a country without adequate protection, only with the prior authorisation of the Regulator (section 57(1)(d)).

10.5 We do not use WhatsApp to send health information to anyone other than the Medical Service Provider treating the patient, and only as the WhatsApp Policy allows.

11.1 The directors have designated the Information Officer under section 55 of POPIA and section 17 of PAIA, and have registered the designation with the Information Regulator. The Information Officer:

(a) encourages and monitors compliance with the conditions for lawful Processing;

(b) maintains this Policy, the Public Privacy Statement, the PAIA Manual and the supplementary policies, and makes them available on request and, where required, on our website;

(c) maintains the Processing Activities Register, the Operator Register, the Security Compromise Register, the Data Subject Request Register and the Complaints Register;

(d) conducts a privacy impact assessment before we adopt a new system, process or category of Processing;

(e) handles data subject requests and complaints within the statutory time limits;

(f) approves Operator contracts and monitors Operator compliance;

(g) manages Security Compromises and notifies the Regulator and Data Subjects;

(h) arranges POPIA training at induction and every 12 months, and keeps the Training Register;

(i) submits the annual PAIA report to the Regulator; and

(j) co-operates with the Regulator in any investigation or assessment.

13.1 Every director, employee, consultant and contractor receives POPIA training at induction and every 12 months thereafter. The Information Officer records attendance in the Training Register.

13.2 Every employment contract and every consultancy or contractor agreement contains confidentiality and POPIA clauses. Every person signs acceptance of this Policy and the supplementary policies that apply to their role.