INFORMED CONSENT

PROVIDED BY CLIENT

(“the data subject” and also “the signatory”)

IN TERMS OF THE PROTECTION OF PERSONAL INFORMATION ACT 4 OF 2013 (POPIA)

FOR

PERSONAL INFORMATION TO BE COLLECTED AND PROCESSED

BY

CURO HEALTH PTY LTD and CURO HEALTH CONSULTING PHARMACY (“the

responsible party”, “practice” and also “the company”)

CONSENT FOR THE PROCESSING AND USE OF PERSONAL INFORMATION
I understand and agree that:

• Curo Health is a contracted phlebotomy and managed healthcare provider for life insurer I have chosen for my financial planning, providing phlebotomy and managed healthcare services to clients and as part of its business functions and the practice collects and processes Personal Information.
• The practice collects, stores, uses, handles, processes, transfers, retains, archives and otherwise manages Personal Information.
• In order to discharge this duty, the Responsible Party requires my express and informed permission to collect and to process my Personal Information or that of my minor dependent/s and adult dependents who are unable to provide their own consent.
• Purpose I consent to the practice sharing AND collect my Personal Information with and from healthcare providers, medical schemes, administrators, medical data switches, service providers and any contracted third parties necessary for the provision of any service to me. I also consent to the receipt of my personal medical data from other medical service providers, medical data provider, of any format, by Curo Health for the purposes of managed healthcare.

 I further agree that Personal Information provided to the practice will be used to:

• give effect to my contractual relationship with the practice and to conduct its operations for the provision of health risk analysis services to me and/or my dependents and for any referrals to other specialists and service providers.
• provide a report to the practice’s indemnity or insurance providers and the recipient will be notified of the need to protect the confidentiality of the personal information.
• comply with obligations required by any legislation affecting this practice.
• protect the legitimate interests of the practice, myself and or any third parties.
• store my personal health information in a secure manner in any format.
• furnish my medical scheme for services provided to me or my dependents and
• for medical research purposes.
• to access mine or my dependents medical scheme benefits.
• retain in terms of the statutory and ethical limits.
• transfer to specialists who will access, view and store my personal health information. The practice cannot guarantee the security or integrity of any information that I transmit to the practice online or otherwise and I agree and understand that I do this at my own risk.
• in connection with legal proceedings including disability or death claims for my insurer; I understand and agree that if the practice does not have my or my dependents consent, the practice will not be able to commence the managed healthcare services and cannot share my Personal Information with any specialists/sub-contractors/other providers to optimise my healthcare treatment.

Withholding Consent. I understand that I can withhold consent to the practice collecting and processing my Personal Information. I agree in this case the practice will not be able to provide phlebotomy or managed healthcare services to me.  I accept that underwriting will not be able to complete and the financial cover I applied for will not be issued by the insurer.

Storage of personal information.

My Personal Information will be stored electronically a safe and secure environment according to ISO27001 protocols. After I am no longer an active client, my Personal Information will be retained for as long as law or practice’s indemnity/insurance providers require it.

Retention of Personal Information

The practice will not retain Personal Information for longer than is necessary and for the required purpose. The exceptions to the above principle specifically provided in POPIA are where –

• the retention of the record is required or authorised by law;
• the practice reasonably requires the record for lawful purposes related to its functions or activities;
• the retention of the record is required in terms of an agreement between the practice and myself; or
• the record is retained for historical purposes, with the practice having established appropriate safeguards against the record being used for any other purpose.
• When the Personal Information is no longer required, it shall be destroyed or deleted in a manner that prevents their reconstruction in an intelligible form.

 Intended recipients.

I agree the intended recipients of my Personal Health Information are me, healthcare providers, specialists, underwriters and pathologists (including Practice staff or their practice staff, medical schemes/ administrators, facilities, researchers, emergency medical service providers. Such disclosure shall always be made between the practice and recipient to comply with strict confidentiality and security conditions as contained in POPI Act.

• Transfer outside South Africa I agree to the practice transferring any Personal Information outside of the borders of South Africa to its indemnity providers that has in place similar privacy laws to POPIA or the recipient is bound contractually to no lesser terms of POPIA.
• I understand that I have the right to have my Personal Information processed in accordance with the eight conditions of lawful processing of Personal Information as set out in POPIA.

Objection to Processing.

I understand that I have the right, to object to the practice processing my Personal Information, on reasonable grounds. On receipt of my notice of objection with reasons, the practice shall hold any further processing of my Personal Information until my objection has been addressed, resolved, withdrawn or upheld and accepted by the practice. If my objection is upheld, no further processing of my Personal Information shall be done by the practice. I acknowledge that practice also reserves the right to discontinue treatment and cover.

• Right to withdraw consent I understand that I have the right to withdraw my consent to the practice processing my Personal Information at any time, provided any processing before such withdrawal or if the processing is necessary for the conclusion or performance of a contract to which I am a party will not be affected. I understand that I can revoke consent for any specific healthcare provider, or person who has access to my Personal Information. Once this information is captured and updated, my personal information will no longer be shared. I understand and agree that this may affect my treatment and cover and I take responsibility for my decision.
• Access I have the right at any time to request details of any of my Personal Information that the practice holds, such request shall be made in writing to the Information Officer of the practice.
• Correction/Deletion I have the right to request the practice, to correct and/or delete my Personal Information that is inaccurate, irrelevant, excessive, out of date, incomplete, misleading. That any changes to my personal information must be communicated to the practice immediately so these changes can be updated on their systems. The practice will not be liable for inaccurate information on our systems as a result of my failure to update my personal information. I have the right to request the practice to destroy or to delete a record of my Personal Information that the practice is no longer authorised to retain in terms of any other law.
• Correction of Personal Information I acknowledge that whilst the practice will always use its best endeavours to ensure that my Personal Information is reliable, it is my responsibility to advise the practice of any changes to my Personal Information, as and when these changes may occur. The practice will not be liable for inaccurate information on our systems as a result of my failure to inform us of my updated personal information.
• Marketing

The practice undertakes not to distribute my Personal Information to any third party for the purpose of marketing to me third party’s supplies or other products. Notwithstanding this, I agree the practice may process my Personal Information for providing me with practice’s products / services. Should I not wish to receive these communications, I will provide the practice with a detailed opt out, listing the type of communication that you do not wish to receive addressed to the Information Officer at CKO@curohealth.co.za

I agree:

• I will not hold the practice responsible for any loss (whether direct or indirect) that may arise from the use of my Personal Information.
• I may not hold the practice responsible for any loss that may result from the incorrect use or disclosure of the information by any healthcare provider to whom the practice has provided the Personal Information.
• to give permission for the practice to give my medical scheme/ or administrator details of my diagnosis and clinical information required.
• that I had an opportunity to read the terms and conditions (or they have been read to me), and I fully understand the consequences of these terms and conditions. I had sufficient opportunity to ask questions about this consent form and questions, answered to my satisfaction by the practice.

My consent is provided of my own free will without any undue influence from any person whatsoever.

• I confirm that I have the permission of my dependant(s) to give their consent, where such consent has been provided and I indemnify the practice against this.

 The collection of data:

1. The specific data collect from medical data providers are focused on possible
dreaded disease and therefore managed healthcare.
2. The ICD10 codes for data collection and linked NAPPI codes, are: