Termes and conditions
1.Introduction
At Nouvelle Clinique Du Bon Pasteur Ltée thereafter referred to as “Clinique Du Bon Pasteur’’, we are committed to protecting and respecting your data protection and privacy rights. We respect and value the privacy of all of our service users and only process personal data in ways described herein. All personal data gathered will be processed in accordance with our obligations, the provisions of the Data Protection Act 2017 and all other application Data Protection regulations.
This Privacy Policy describes how the Clinic processes your personal data, and how, in doing so, we comply with our legal obligations.
2.Who are we?
Clinique Du Bon Pasteur is a privately-owned clinic which provides healthcare and treatment services in Mauritius. Clinique Du Bon Pasteur is registered with the Data Protection Commissioner as Controller and is situated at Dr Thomy Pitot St, Beau Bassin-Rose Hill. The business registration number of the Clinic is C07025266.
3.Queries and complaints
If you have any questions about this privacy policy and our privacy practices, including any requests to exercise your legal rights, please contact our Data Protection Officer:
Name: Aurelie Sevene (SmarTree Consulting Ltd)
Address: Digital House, Arsenal Road, Calebasses, Mauritius
Email address: aurelie.sevene@smartreeconsulting.com
Phone number: [230] 52527501
You have the right to make a complaint relating to the processing of your personal data at any time to the Data Protection Commissioner, the supervisory authority for data protection issues. You also have the option of lodging a complaint with us concerning the processing of your personal data. The complaint must be made in writing, addressed to our Data Protection Officer.
4.What personal data do we collect?
As a patient of the Clinic, you are asked to give information about yourself. The processing of your data is necessary to enable us to provide you with adequate care and treatment. We keep your personal data, together with details of your care, to allow continuity of your care and adequate treatment. The personal data which we process (in paper and electronically) includes:
- Your full name, date of birth, gender, address, phone number, and email address
- Your next of kin contact details (full name, address, phone number, and email address)
- Full name, date of birth, gender, address, phone number, and email address of the responsible party for children
- Medical test results, symptoms and diagnoses
- Insurance membership number
- Notes and reports about your health and any treatment you have received or need, including clinic and operational visits and medicines administered.
- In the performance of our duties and in order to enable us to provide you with adequate care and treatment, we may also process sensitive personal data which includes:
- Information relating to your physical or mental health or condition;
- Information relating to your sexual orientation, practices or preferences;
- Information relating to your genetic data.
If you are a child, we will not process your personal data without the consent of your parent or guardian.
If we are not authorised to process your personal data, we may not be able to provide you any or with a full health assessment or care and treatment (as applicable).
Similarly, if you are only willing to share limited/no information, we may not be able to provide you with any, or with a full health assessment or the full range of care and treatment (as applicable).
5.How is the data being used?
The information about you is processed for the purpose of your health assessment, treatment and/or care, including tests or assessments and medical examinations. We will also process your information for payment purposes, including billing, invoicing and settlement of your account with us.
We may use your phone number (or email address where you have provided it to us) to contact you in advance of and after your admission or appointment for reasons connected with your health assessment, care or treatment.
| Purpose/Activity | Lawful basis for processing including basis of legitimate interest |
|---|---|
| To register and create the patient account and patient file Contacting you and resolving queries | Performance of a contract (provision of health care or treatment) To protect your vital interests. |
| Providing health assessment services, care and/or treatment | Performance of a contract (provision of health care or treatment) To protect your vital interests. |
| Contacting other healthcare professionals (e.g. doctors or laboratories) about your care and updating others (such as your emergency contact) | Performance of a contract (provision of health care or treatment) To protect your vital interests. |
| Manage payments, fees and charges Collect and recover money owed to us | Performance of a contract (payment for provision of health care or treatment) Necessary for our legitimate interests (to recover debts due to us from patients, bodies covering the treatment on behalf of the patient or insurers) |
| To administer and protect our business (including maintenance of patient records, accounting records, analysis of financial results, external and internal audit requirements and legal obligations) | Performance of a contract (provision of health care or treatment) Necessary for our legitimate interests (for running our business, provision of administration and IT services, network security, to prevent fraud and in the context of a business reorganisation exercise) Necessary to comply with a legal obligation |
| To communicate the other services offered by the Clinic, current offers, or updates. | Consent |
| Direct marketing | Consent |
7. How do you keep my data secure and confidential?
We are committed to ensuring that your information is adequately secure with us and with the third parties to whom the data is disclosed. We have a number of security precautions in place to prevent the unauthorised access, unlawful disclosure, loss, misuse, alteration or destruction of your information.
All staff working for Clinique Du Bon Pasteur have a legal duty to keep information about you confidential and all staff are trained in information security and confidentiality. The Clinic has strict information security policies and procedures in place to ensure that your information (whether held in paper or electronic format) is at all times processed in a secure and fair manner.
8.To whom will the data be disclosed?
The Clinic, for the purpose of providing adequate care and treatment, will share your personal information with those involved in your health assessment, care or treatment for medical purposes and other members of staff involved in the delivery of your care as required (such as our housekeeping and administrative teams).
We may share your personal information with third parties who are involved in your health assessment, care or treatment for the purpose of providing adequate care and treatment and in order to fulfil the legal basis such as performance of the contract between yourself and the Clinic and/or the protection of your vital interests. As such in addition to employed staff of the Clinic, there are a number of visiting doctors and other medical professionals (e.g. laboratories and radiology) who are not employed by us but who deliver medical services to our patients. We ensure that there are strict confidentiality requirements and data protection clauses binding the said professionals when administering care to patients at the Clinic.
Furthermore, we may share your personal data with external third parties, namely (a) insurers (for settlement of the treatment covered) (ii) service providers based in Mauritius acting as processors who provide IT and system administration services (iii) professional advisers based in Mauritius including lawyers, bankers and auditors (iv) the Mauritius Revenue Authority, regulators and other authorities based in Mauritius who require reporting of processing activities in certain circumstances. We require all third parties to respect the security of your personal data and to treat it in accordance with the law. We do not allow our third-party service providers to use your personal data for their own purposes and only permit them to process your personal data for specified purposes and in accordance with our instructions.
We limit access to your personal data to those employees, agents, contractors and other third parties who have benefitted from the appropriate training and are authorised to process your personal data. They will only process your personal data on our instructions and they are subject to a duty of confidentiality.
9. For how long will your data be retained?
Your personal data shall not be retained for a period longer than necessary for the purposes highlighted at clauses 5 and 6 above.
Your personal data will not be kept once the purpose for keeping the same has lapsed. Once this is the case, we will take all reasonable steps to destroy, or erase the personal data from our systems.
10.What are your legal rights?
You have the following rights under data protection laws in relation to your personal data. If you wish to exercise any of these rights, please contact our Data Protection Officer by email, phone, or by letter.
- Request access to your personal data (commonly known as a “data subject access request”). This includes details of what information we hold about you and a copy of that information. The information will be provided free of charge and, unless there are grounds for extending the statutory deadline, the information will be provided to you within one month of receipt of your request. If we have reasonable doubts with regards to the identity of the person making the request, we may require the provision of additional information to confirm the identity of the data subject.
- Request rectification of your personal data. This enables you to have any incomplete or inaccurate data we hold about you completed or corrected, though we may need to verify the accuracy of the new data you provide to us.
- Request erasure of your personal data. This enables you to ask us to delete or remove personal data where:
- if the processing of your personal data is subject to your consent, you withdraw your consent;
- you object to the processing of your personal data.
We reserve our right to reject your request in circumstances, for instance, whereby there are other legal grounds for the processing of your personal data and/or there are overriding legitimate grounds for the processing of your personal data and/or, where it is necessary to keep your information for the purposes of establishing, making or defending legal claims.
- Request restriction of processing of your personal data. This enables you to ask us to suspend the processing of your personal data in the following scenarios:
You contest the accuracy of personal data, in which case, the processing will be restricted for a period enabling us to verify the accuracy of the data.
Where the processing is unlawful, but you do not want us to erase it.
Where you need us to hold the data even if we no longer require it as you need it to establish, exercise or defend legal claims.
You have objected to our use of your data, but we need to verify whether we have overriding legitimate grounds to use it.
- Withdraw consent at any time where we are relying on consent to process your personal data. However, this will not affect the lawfulness of any processing carried out before you withdraw your consent. If you withdraw your consent, we may not be able to provide certain or any services to you. We will advise you if this is the case at the time you withdraw your consent.
Request for disclosure and/or confirmation that your personal data is being processed will normally be entertained free of charge. However, we may charge a reasonable fee if your request is manifestly excessive. Alternatively, we may refuse to comply with your request in these circumstances.
Please note that upon a request being made, we will generally also ask for confirmation of your identity and may need further information from you in order to locate the information, in which case the time period starts from the date we have that detail.
Any request, whether entertained favourably or unfavourably, will normally be entertained within one month, you will be informed accordingly in writing. The delay of one month may be extended where necessary.
Please note that in some cases we may not be able to comply fully with your request, such as in circumstances wherein your request also involves the disclosure of personal data relating to someone else or where confidentiality needs to be maintained.
11.Revisions
We may from time to time make changes to this Privacy Policy to reflect changes in our legal or regulatory obligations or in the manner in which we deal with your personal information. We will, where appropriate, communicate any revised version of this Privacy Policy. Any changes to this Privacy Policy will be effective from the time they are communicated, provided that any change that relates to the purpose of processing your personal information will not apply to you, where your consent is required to such collection, use or disclosure, until we have obtained your consent to such change. This Privacy Policy was last reviewed [September 2021].