Privacy Policy

1Introduction

Hema Flow ("we", "us", "our") is a haematology diagnostic management platform operated for the Nelson Mandela Bay Health District (NMBHDL). This policy explains what personal and medical information we collect from patients, doctors, laboratory staff and administrators, why we collect it, and how it is protected under the Protection of Personal Information Act, 2013 (POPIA).

2Information We Collect

Depending on your role, we may collect:

• Identity information: full name, South African ID number, date of birth, contact details and physical address.
• Account information: email address, hashed password, and login activity.
• Medical information: test requests, sample records, results, medical conditions, allergies, and medications.
• Consent records: which doctors you have granted access to your records, and when.
• Usage information: activity logs kept for audit and security purposes.

3How We Use It

• To create and manage your Hema Flow account.
• To process laboratory test requests and deliver results to the correct patient and treating doctor.
• To maintain an accurate, unified medical record across the diagnostic workflow.
• To keep an audit trail of actions taken on your record, for accountability and security.
• To communicate service updates, such as password resets or result availability.

4Legal Basis for Processing

We process personal information where it is necessary to provide a healthcare service, to comply with a legal obligation, in the legitimate interests of the diagnostic laboratory network, or with your consent (for example, when you grant a doctor access to your medical profile via Consent Management).

5Sharing of Information

Your information is only shared with:

• Doctors you have explicitly granted access to via the Consent Management feature.
• Laboratory technicians and managers directly involved in processing your test requests.
• Regulatory or governmental bodies where required by law.

6Data Security

Passwords are stored using industry-standard hashing, all portal sessions are authenticated, and access to records is restricted by role. Data is stored on infrastructure secured against unauthorised access, and administrative actions are logged for audit purposes.

7Data Retention

Medical records are retained for as long as your account remains active and thereafter for the minimum period required by applicable healthcare record-keeping regulations. You may request more detail on retention periods by contacting us (see Section 12).

8Your Rights Under POPIA

As a data subject, you have the right to:

9Cookies

Hema Flow uses a minimal, essential authentication cookie required to keep you securely signed in to the portal. We do not use third-party advertising or tracking cookies.

10Children's Information

Where a patient is a minor, their medical records are managed in accordance with applicable healthcare consent laws, typically via a parent, guardian or the treating doctor.

11Changes to This Policy

We may update this policy from time to time. Material changes will be communicated through the portal. The "Last updated" date at the top of this page reflects the most recent revision.