The Vula Platform is a tool which allows the healthcare professionals to share patient information with medical and surgical specialists in order to obtain expert advice and expedite referrals. To provide this service, the information of the patient needs to be entered into the Vula Platform by the healthcare professional (or approved administrative associate), on a case by case basis, and shared with the selected specialist(s). We act as an Operator, as the term is defined in POPIA, and process patient Personal Information and Special Personal Information on behalf of our Data Subjects (Health Practitioners), in accordance with an agreement with the aforementioned individuals, when they use the Vula Medical Referral and Chat Platform. The Patient Privacy Notice pertains to our role as an Operator who collects, processes, stores and shares patient Personal Information and Special Personal Information in the provision of this service to Health Practitioners.

Patient privacy notice

The Vula Platform, a Mobile Application (“App”) and Web Portal, established by Vula Medical (Pty) Ltd trading as Vula Medical (“Vula”) is used by a Doctor or other Healthcare Worker (“Health Practitioner”) to transfer patient information and details of the patient’s condition (the “Information”) to a medical specialist selected by the Health Practitioner because of his/her expertise (“the Specialist”).

The Vula Platform is a tool which allows the Health Practitioner to share patient Information with medical and surgical Specialists in order to obtain expert advice and expedite referrals. To provide this service, the Information of the patient needs to be entered into the Vula Platform by the Health Practitioner (or approved administrative associate), on a case by case basis, and shared with the selected Specialist(s).

Reference in this policy to “Vula”, “we”, “us”, “our” or any similar term may be construed as reference to Vula Mobile.

The end users (“Data Subjects”) as defined in the Protection of Personal Information Act No. 4 of 2013 (“POPIA) of the Vula Mobile App or Online Web Portal are typically Health Practitioners, Specialists, or people employed in an administrative role and acting on behalf of a healthcare establishment, department of health or a private healthcare practice providing a Healthcare Service to a patient.

We act as an Operator, as the term is defined in POPIA, and process patient Personal Information and Special Personal Information on behalf of our Data Subjects (Health Practitioners), in accordance with an agreement with the aforementioned individuals, when they use the Vula Medical Referral and Chat Platform. This Patient Privacy Notice pertains to our role as an Operator who collects, processes, stores and shares patient Personal Information and Special Personal Information in the provision of this service to Health Practitioners.

This Patient Privacy Notice provides information on:

• Expectations of the Health Practitioner

• Children

• Patient Information Collected

• Processing of Patient Information

• Sharing of Information

• Patient Privacy and Confidentiality

• Information Security

• Transborder Flow of Information

• Retention of Patient Information

• Electronic Communications

• Data Breaches

• Revisions to this Notice

• Privacy Queries

• Information Officer

THE ROLES IN YOUR HEALTHCARE

It is important to understand the distinct legal and operational roles performed by your Health Practitioner and by Vula Medical in relation to the collection, use, and disclosure of your Personal Information and Sensitive Information:

• Your Health Practitioner: Your Health Practitioner (for example, your general practitioner, nurse, or other treating clinician) is your primary care provider and is exclusively responsible for:

  • the clinical assessment, diagnosis, and treatment of your condition;

  • determining the necessity and appropriateness of a referral or consultation with another healthcare provider;

  • collecting your health information in accordance with clinical and legal requirements;

  • obtaining your informed consent to collect, use, and disclose your health information, including your consent to use the Vula Medical App for referral and care-coordination purposes; and

  • ensuring compliance with all professional, ethical, and statutory obligations governing the handling of your health information.

Your Health Practitioner is the primary custodian of your medical record and controls the purposes for which your information is collected and used in a clinical context.

• Vula: Vula Medical provides and operates the Vula Platform, which is a secure digital communication and referral-management tool used by healthcare practitioners. We do not provide medical or clinical services and do not make decisions about your care. We process your Personal Information and Sensitive Information solely on behalf of, and under the instructions of, your Health Practitioner for the purpose of enabling secure referral workflows, clinical communications, and care-coordination activities.

EXPECTATIONS OF THE HEALTH PRACTITIONER

Vula expects and presumes that, in accordance, with the applicable laws regulating the healthcare profession, the Health Practitioners and administrative staff concerned 

• have obtained consent to treat the patient, and further process the patient’s Personal Information and Special Personal Information, as defined in POPIA, to third parties, such as Vula;

• the Health Practitioner is allowed to collect the patient’s Information in accordance with the laws governing health care services, and will not collect any information that he/she is not empowered to collect.

Compliance with privacy law is primarily the Health Practitioner’s responsibility as they are the Responsible Party providing the medical service to the patient, and the Responsible Party who initially collected a patient’s Personal Information and Special Personal Information and obtained the patient’s consent to do so. Health Practitioners are obliged to take steps to ensure that their patients are aware of how and why any of their Information will be collected and processed and, where required, shared with Third Parties in performance of a contract, or in order to provide a service to, or treat a patient.

Health Practitioners can either explain to their patients how the Vula service works and what Information will be collected and processed, or show this Patient Privacy Notice to patients, or both. Should a patient be under the age of 18, the Health Practitioner should advise the parent or guardian that the minor is in their care and how the patient’s Information will be collected and processed.

If a Health Practitioner is unable to explain this to a patient if the patient is, for example, unconscious, mentally incapacitated, or an unaccompanied minor, then the Health Practitioner must explain and obtain consent from the patient’s guardian or a guardian appointed by the State when it is possible to do so.

It is not mandatory for the patient to supply the Information requested by the Health Practitioner in order to enter it into the Vula Platform. However, if the patient does not supply this information, the Health Practitioner cannot use the Vula Platform to obtain further assistance from, or refer a patient to a Specialist.

CHILDREN

Vula processes Personal Information and Special Personal Information of patients for healthcare purposes and, from time to time, this may include Special Personal Information relating to children under the age of 18 years old. Health Practitioners warrant and undertake that they have obtained the necessary consent for the processing of special information from the parent or guardian where the patient is under the age of 18 years, and indemnify Vula to the fullest extent permitted by law in this regard. Vula reserves the right to request, at any time, that a Health Practitioner furnishes us with evidence of such consent having been obtained from a parent or guardian.

If it is not reasonably practicable for the Health Practitioner to explain this to a parent or guardian due to the minor being unaccompanied and parent or guardian unreachable, then the Health Practitioner must receive consent from the guardian appointed to care for the child by the State.

PATIENT INFORMATION COLLECTED

Patient Information collected, by [the Health Practitioner or Vula] will be restricted to the following:

• Name and Surname

• Contact Information (phone number and/or email address)

• Physical Address (if applicable)

• Age or Date of Birth

• Gender

• Weight and/or height (if applicable)

• ID Number or Hospital/Practice Folder Number (unique identifier to the patient)

• Medical Aid Number (if applicable)

• Location

• Basic Health Information

• Medical History

• Comorbidities, existing conditions and current treatments

• Family History or relative specific related information

• Information related to the patient’s current medical condition including assessment, diagnosis and treatment

• Images including photographs of physical ailment, x-rays, diagnostic reports or results, or other where required

• Admission forms that may include a patient’s (or guardian’s) signature

• Chat correspondence related to the patient during the referral process

• Audio recordings of voice calls between Health Practitioners discussing the patient, and transcripts generated from those recordings

We do not collect information directly from you. All Personal Information and Sensitive Information that we handle is provided to us by your Health Practitioner, who inputs the information into the Vula Platform after obtaining your informed consent to do so. Your Health Practitioner is responsible for determining what information is necessary and appropriate for your referral and care-coordination purposes.

The patient Information collected by the Health Practitioner is transferred securely within the Vula Platform to a Specialist to obtain advice which may lead to a more accurate diagnosis or treatment. It may also lead to the Specialist recommending a follow-up appointment with him/herself or another Health Practitioner. The Information may potentially be transferred to multiple Specialists using the Vula Platform in order to further advise, treat or follow up with patients.

We do not collect more information than is reasonably necessary to support the secure transmission of information between your Health Practitioner and the specialist(s) involved in your care.

VOICE CALLS BETWEEN HEALTH PRACTITIONERS

The Vula Platform allows a Health Practitioner to speak to a Specialist by voice call in order to discuss a referral. Where such a call takes place, it may be recorded and a written transcript may be generated from the recording, so that there is an accurate record of the clinical discussion about the patient.

The Health Practitioner chooses whether to place a recorded call or an ordinary call, and the person being called is asked to agree to the recording before it begins. Where that person cannot be asked directly, the Health Practitioner is responsible for informing them. Consent to the recording and transcription of discussions concerning a patient is dealt with at the time the referral is created.

The transcript is generated automatically and cannot be edited. It is saved as generated and is marked as automatically generated and not verified. The audio recording is retained and is the primary record of the discussion. Where a Health Practitioner considers a transcript to be inaccurate, the correction is added to the referral as a separate note. A patient may also ask for the correction of their Information in the manner described under “Access and Correction of Patient Information” below.

The recording and the transcript are treated in the same way as the other Information relating to the referral, including images, and are retained as part of the clinical record. Voice calls are carried by a third party real-time communications provider, which processes the audio on our behalf and on our instructions, and transcription may be performed by that provider or by a third party transcription provider.

ACCESS AND CORRECTION OF PATIENT INFORMATION

Your Health Practitioner is the primary custodian of your official medical record and holds clinical responsibility for the integrity and completeness of your health information. Accordingly, any request to access or correct your clinical information should be directed to your Health Practitioner in the first instance.

You may also request access to, or correction of, the Personal Information that Vula holds in connection with your use of the Vula Platform. Such requests may be submitted to our Information Officer using the contact details below. We will respond to requests for access or correction, subject to any applicable exemptions under the applicable act. Where access is refused, we will provide written reasons and advise you of further avenues available to you.

PROCESSING OF PATIENT INFORMATION

Vula processes patient Personal Information and Special Personal Information in accordance with applicable data protection and privacy laws in the jurisdictions in which the Vula Platform operates. This includes compliance with the POPIA in South Africa, as well as any equivalent or successor legislation, regulations, or binding privacy principles applicable in other jurisdictions.

Under POPIA, the lawful processing of Personal Information is subject to a set of core data protection principles (the “Processing Conditions”), which include, among others, accountability, purpose limitation, data minimisation, information quality, transparency, security safeguards, and data subject participation. Vula is committed to complying with these principles and with equivalent principles imposed under applicable foreign privacy laws. Health Practitioners and Specialists using the Vula Platform are likewise expected to comply with all applicable data protection obligations in their respective jurisdictions.

The patient Personal Information and Special Personal Information processed through the Vula Platform, and the manner in which such information is processed, are limited to what is reasonably necessary to enable secure clinical communication, facilitate referrals, support patient care, improve the functionality of the Vula Platform, and comply with Vula’s legal and regulatory obligations.

All Health Practitioners and Specialists made available on the Vula Platform are subject to verification and approval processes relevant to their professional discipline prior to being granted access. Patient information processed via the Vula Platform is accessible only to the authorised Health Practitioner(s) and Specialist(s) involved in the relevant referral or consultation, whether through the Vula mobile application or the secure web portal.

The Health Practitioner remains the primary custodian of the patient’s medical record and is responsible for responding to patient requests for access to, or correction of, their Personal Information or Special Personal Information, in accordance with applicable local privacy and healthcare laws. Health Practitioners may access and download reports relating to their patients and referrals via the Vula Web Portal at any time, subject to applicable legal and professional obligations.

PURPOSE OF COLLECTION AND USE

We collect, store, and process your Personal Information and Sensitive Information solely for the primary purpose of enabling your Health Practitioner to use the Vula Platform for clinical referral and care-coordination activities. This includes:

• securely transmitting your information to another healthcare practitioner or specialist selected by your Health Practitioner for the purpose of obtaining clinical input or facilitating a referral; and

• enabling secure, auditable communication between your Health Practitioner and that specialist to support your assessment, diagnosis, treatment, or ongoing management.

Your information is handled only to the extent reasonably necessary to perform these functions and activities of the Vula Platform.

We will not use or disclose your identifiable Personal Information for any secondary purpose (such as marketing) without your explicit further consent. We may use or disclose de-identified (anonymised) data, from which you cannot be personally identified, for the purposes of service improvement, system analytics, and approved research. Any de-identification process will be carried out in accordance with best-practice standards to ensure that individuals cannot reasonably be re-identified.

If your Health Practitioner does not provide your information for entry into the Vula Platform, they will be unable to use our service to facilitate your specialist referral or consultation.

SHARING OF INFORMATION

Should Vula share any Information with a Third Party outside the scope of obtaining advice from, or referring a patient to a Specialist or Health Practitioner, they undertake to do so only on the following conditions:

• Any information that can identify a person will be removed to protect the person’s privacy. This includes the name, surname, identity number, and facial images.

• Any information that can be used to communicate with a person will be removed to prevent unauthorised communications being sent. This includes phone numbers and email addresses.

• The information shared will only be used for research purposes.

Where necessary to protect our legal rights and interest, or the interests of others, we may also use patient Information in relation to legal claims, compliance, audit, risk management and regulatory functions.

We may, from time to time, share Information contained in reports with the Departments of Health for research purposes. However, we will only share Personal Information in these reports insofar as it is necessary for the governmental institution to fulfil its functions in advancing public health or other public interests.

We may disclose Personal Information to our third parties, as defined in POPIA, for legitimate business purposes, in accordance with applicable law and subject to applicable professional and regulatory requirements regarding confidentiality. In addition, we may disclose Personal Information in order to provide support services to our data subjects. We may also share patient information with:

• any person that works for us and is in the employ of Vula, either as a permanent employee, consultant or contractor;

• companies and organisations that provide services to us, including in relation to technical infrastructure, and web and app development and support;

• our professional advisers, consultants and other similar services;

• legal and regulatory authorities, upon request, or for the purposes of reporting any actual or suspected breach of applicable law or regulation;

• any relevant party, law enforcement agency or court, to the extent necessary for the establishment, exercise or defence of legal rights;

• any relevant party for the purposes of the prevention, investigation, detection or prosecution of criminal offences or the execution of criminal penalties, including, but not limited to, safeguarding against and the prevention of threats to public security.

We will otherwise treat all patient Information as private and confidential and will not share it with other parties except:

• where permission has been given;

• where we believe it is reasonably necessary to comply with any law, regulation, legal process or governmental request, to enforce our Terms and Conditions of use or other agreements, or to protect the rights, property, or safety of us, our customers or others;

• where we may transfer rights and obligations pursuant to an agreement with the Health Practitioner, Specialist or Patient.

PATIENT PRIVACY AND CONFIDENTIALITY

At Vula, we value each patient’s privacy and, and strive to ensure patient confidentiality is maintained at all times. Vula will only collect, process, store and share patient Personal Information and Special Personal Information in accordance with this Patient Privacy Notice, in accordance with the agreement with a Health Practitioner and Specialist, in accordance with the applicable legislation and the Terms and Conditions of use of the Vula Platform they agreed to when registering to use our products and services.

INFORMATION SECURITY

Vula places great importance on ensuring the security of all patient Information and is obliged to prevent the loss of, damage to, or unauthorised destruction of Personal Information and Special Personal Information as well as the unlawful access to or processing of this information. The patient Information collected is securely stored within the Vula Platform using regularly reviewed, up to date, and appropriate and reasonable technical and organisational measures as required by applicable law to protect the Information from loss, misuse, unauthorised access, unauthorised disclosure, alteration or destruction.

The Vula Platform, including both the Mobile App and the Web Portal, are developed using secure technologies with Security by Design and Privacy by Default principles at the forefront of its architecture, and can only be accessed using strong access control protocols, and only by Vula approved and validated end users.

The Vula Platform is a cloud based solution hosted by Heroku (a Salesforce Company) on Amazon Web Services (AWS) infrastructure. All patient Information collected, processed and stored is, thus, done so in this location. The AWS Data Centre is ISO 27001 certified which provides assurance with regards to the physical, logical and environmental security of the hosted solution and the patient Information therein, as well as the business continuity and availability of the services we offer.

Vula, in collaboration with the AWS Data Centre, has further taken reasonable measures to:

• identify all reasonably foreseeable internal and external risks to Personal Information in its possession or under its control;

• establish and maintain appropriate safeguards against the risks identified;

• regularly verify that the safeguards are effectively implemented; and

• ensure that the safeguards are continually updated in response to new risks or deficiencies in previously implemented safeguards.

TRANSBORDER FLOW OF INFORMATION

To enable Healthcare Practitioners to use the Vula Platform and its services, the patient Personal Information and Special Personal Information we process may, in certain circumstances, be transferred to, stored in, or accessed from locations outside the patient’s country of residence.

Where patient information is transferred outside the Republic of South Africa, such transfer will occur only where it is necessary to provide the requested services and where the recipient is subject to laws, binding corporate rules, or contractual obligations that provide a level of protection substantially similar to that required under this Privacy Notice and applicable data protection legislation.

We take reasonable and appropriate steps to ensure that patient information is protected at all times, including by implementing suitable contractual, technical, and organisational safeguards with our service providers and partners.

Our cloud hosting infrastructure is provided by Amazon Web Services, and the real-time communications provider which carries voice calls processes call audio on infrastructure located in the United States. Where patient Information is processed outside the Republic of South Africa, we rely for the purposes of section 72 of POPIA on binding obligations which afford a level of protection substantially similar to that required by POPIA and which restrict any further transfer.

Notwithstanding the above, where patient Personal Information is subject to mandatory data localisation, cross-border disclosure restrictions, or equivalent territorial processing requirements under the laws of a particular jurisdiction, such information shall be stored, processed, and handled in accordance with those mandatory local legal requirements, to the extent that they apply.

You may withdraw your consent to the cross-border processing of your Personal Information at any time. Please note, however, that doing so may mean that your Healthcare Practitioner is no longer able to use the Vula Platform to provide services to you.

RETENTION OF PATIENT INFORMATION

Vula retains Patient Information only for as long as is reasonably necessary for the purposes for which it was collected, or for any longer period required or permitted by applicable law.

Where Patient Information forms part of a patient’s clinical or medical record, Vula will retain that information for at least the minimum period prescribed by applicable health-care laws and regulations governing the retention of medical records. The applicable retention period may differ depending on the nature and category of the Patient Information, the applicable health-care service, and the legal or regulatory requirements applicable to that information.

For the avoidance of doubt, Patient Information may include records of interactions between a patient and Vula, including audio recordings of voice calls, transcripts of those calls, clinical notes, correspondence, assessments and other information generated or received in connection with the provision of health-care services, where such information forms part of, or is required to support, the patient’s clinical record.

Vula maintains a documented retention schedule identifying, for each relevant category of Patient Information:

• the applicable retention period;

• the legal, regulatory or operational basis for retaining the information;

• the purpose for which the information is retained; and

• the manner in which the information is securely disposed of or otherwise processed at the end of the applicable retention period.

Once the applicable retention period has expired, Vula will securely delete the relevant Patient Information or, where deletion is not reasonably practicable or where continued retention is otherwise justified or required by law, irreversibly de-identify the information so that it can no longer reasonably be associated with an identifiable patient.

Where Patient Information is subject to more than one applicable retention requirement, Vula will retain the information for the longer applicable period. Vula will not retain identifiable Patient Information indefinitely merely because it was previously collected or formed part of a patient record.

ELECTRONIC COMMUNICATION

At times, and on a case by case basis, Vula may send patients additional information regarding their scheduled or follow-up appointments with a Specialist or other Health Practitioner, or with regards to the treatment and management of their medical condition.  This will be done in the form of electronic communication including, but not limited to, SMSs and eMails. The patient consents to receiving all communications electronically and is responsible for providing the Health Practitioner with valid and accessible contact information to which any communications may be sent. Any communications sent to the contact information provided by the patient will be deemed to have been received by him/her.

DATA BREACHES

In the event of any privacy or security breaches of the Vula Platform, or at our Third Party Hosted Data Centre, that are likely to result in any risk to a patient’s Personal Information and/or Special Personal Information, or to the patient’s rights and freedoms, we will notify Health Practitioners, Specialists, and the relevant Regulatory Authority as soon as we become aware of such. Notifications will include the nature of the breach, the information involved, and recommended steps that affected individuals should take to mitigate potential harm.

End users of the Vula Platform have also been advised to notify Vula immediately where they have reasonable grounds to believe that their accounts or patient data have been accessed or acquired by any unauthorised person.

REVISIONS TO THIS NOTICE

We may amend this Patient Privacy Notice from time to time. Health Practitioners and Specialists should check the Vula Platform regularly to see when this Patient Privacy Notice was last updated and to review the updated notice.

PRIVACY QUERIES 

Should you have any query in relation to this Patient Privacy Notice or how we handle your patient Personal Information or Special Personal Information, please contact us by sending an email to dataprivacy@vulamedical.com

INFORMATION OFFICER

Vula’s current Information Officer is:

Name: William Mapham

Position: CEO

Email Address: william@vulamedical.com