GLOBAL PRIVACY & DATA PROTECTION POLICY

1. Policy Scope

This Privacy Policy applies to all personal information processed by Health System Link through its websites, platforms, APIs, integrations, and services.

2. Regulatory Framework Alignment

HSL processes personal data in accordance with:

• POPIA – Protection of Personal Information Act (South Africa)

• GDPR – General Data Protection Regulation (EU)

• HIPAA – Health Insurance Portability and Accountability Act (USA)

• Applicable national health information and insurance regulations

3. Categories of Personal Data

HSL may process:

• Identifying information (names, ID numbers, contact details)

• Health and medical claims data (Protected Health Information – PHI)

• Insurance, financial, and benefit data

• System access logs and audit trails

• Device and usage metadata

4. Lawful Basis for Processing

Processing is conducted under lawful bases including:

• Contractual necessity

• Legal and regulatory obligation

• Legitimate interests (security, fraud prevention)

• Explicit consent where required

5. Data Security Safeguards

HSL implements appropriate safeguards including:

• Encryption in transit and at rest

• Role-based access control (RBAC)

• Segregation of duties

• Audit logging and monitoring

• Secure hosting environments

6. Data Subject Rights

Subject to applicable law, data subjects may:

• Request access, correction, or deletion

• Object to or restrict processing

• Request data portability

7. Cross-Border Data Transfers

Where data is transferred internationally, HSL ensures appropriate safeguards such as contractual clauses and secure processing agreements.

8. Cookie Policy

Cookies and similar technologies are used for:

• Authentication and session management

• Performance and analytics

• Security monitoring Users may manage cookie preferences via browser settings.

9. Data Retention

Personal data is retained only for as long as necessary to meet operational, contractual, and legal requirements.