1. Contact details
| Private body | Sankofa Health (Pty) Ltd, registration number 2021/593224/07 |
|---|---|
| Head of the private body | Dr David Fraser, Chief Executive Officer |
| Information Officer | Mickey Venter · privacy@sankofa.health |
| Deputy Information Officer | Garett Sidwell · privacy@sankofa.health |
| Physical and postal address | Suite 102, 25 Richefond Circle, Ridgeside Office Estate, Umhlanga Rocks 4319, South Africa |
| Requests and privacy enquiries | privacy@sankofa.health |
| Website | https://sankofa.health |
2. The Information Regulator’s guide (section 10)
The Information Regulator has compiled a guide, in each official language, on how to use PAIA. It is available from the Information Regulator, Woodmead North Office Park, 54 Maxwell Drive, Woodmead, Johannesburg 2191; enquiries@inforegulator.org.za; inforegulator.org.za. Any enquiries about the guide should be directed to the Regulator.
3. Records automatically available (section 52(2))
No notice has been published under section 52(2). The following are available without a formal request: the content of this website, this manual, our privacy notice and terms of use, published announcements and press releases, and marketing material that we choose to distribute.
4. Records available under other legislation (section 51(1)(d))
Records may be requested under other laws where those laws apply, including the Companies Act 71 of 2008, the Basic Conditions of Employment Act 75 of 1997, the Labour Relations Act 66 of 1995, the Income Tax Act 58 of 1962, the Value-Added Tax Act 89 of 1991, the Protection of Personal Information Act 4 of 2013 and the Electronic Communications and Transactions Act 25 of 2002.
5. Records we hold, by subject and category (section 51(1)(e))
| Subject | Categories of record | Availability |
|---|---|---|
| Company and governance | Memorandum of Incorporation; registers of shareholders, directors and beneficial owners; board and shareholder minutes and resolutions; statutory returns; company policies | On request, subject to PAIA |
| Finance and tax | Annual financial statements; management accounts; banking, invoices and payment records; tax returns and correspondence with SARS; insurance policies | On request, subject to PAIA |
| Commercial and legal | Contracts with data partners, customers, suppliers and advisers, including data licence and data processing agreements; non-disclosure agreements; letters of support and collaboration; correspondence; intellectual-property records | On request, subject to PAIA; third-party and confidential material may be refused under sections 63 to 70 |
| Personnel | Employment contracts; personal and payroll records; leave, performance and disciplinary records; policies | To the employee concerned; otherwise subject to PAIA |
| Data platform and information governance | Data-governance policies; de-identification standard and certifications; records of processing; security and incident records; audit reports | On request, subject to PAIA; security-sensitive material may be refused under section 68 |
| Website and enquiries | Contact-form and email enquiries; server logs | To the person concerned; otherwise subject to PAIA |
6. Processing of personal information (section 51(1)(c) read with POPIA section 17)
Purposes. We process personal information to run the company; to deal with enquiries and build commercial relationships; to employ and pay staff and contractors; to contract with and pay suppliers; to comply with the law; and, on the Sankofa platform, to receive de-identified and pseudonymised health data from data partners and to act as operator inside those partners’ environments under written data processing agreements.
Categories of data subjects and information. Business contacts, partners, investors and advisers (names, roles, contact details, correspondence); employees and contractors (identity, contact, banking, tax, employment and performance information); suppliers (contact and banking details); website visitors and enquirers (as described in the privacy notice); and, on the platform and only within the data partner’s environment, patient-level information for which the data partner is the responsible party and Sankofa the operator.
Recipients. Our professional advisers, banks, insurers and auditors; service providers who act as operators (hosting, email, productivity, form delivery, payroll); regulators and authorities where the law requires; data partners under the relevant agreements; and, for de-identified data products only, licensed customers under written sublicences that impose the protections our data partners require.
Cross-border flows. Some operators process information outside South Africa, for example cloud email and productivity services. Transfers are made only on a basis permitted by section 72 of POPIA. Platform data is processed and held in South Africa; any future cross-border transfer of platform data is recorded in the relevant data processing agreement before it occurs.
Security measures. Access control on a need-to-know basis; encryption in transit and at rest; logging and monitoring; secure development and change control; supplier due diligence and written operator terms; staff confidentiality undertakings and training; incident response procedures with notification to the Regulator and the people affected under section 22; and, for platform data, the additional controls set out in the data processing agreements with our data partners, including de-identification before any data leaves the partner’s environment.
7. How to request access (section 53)
Complete the Regulator’s prescribed Form 2 (Request for access to record of private body), available from the Regulator’s website or from us on request, and send it to the Information Officer at privacy@sankofa.health or the address above. The form asks for enough detail to identify the record, the form of access you want, your contact details and, if you are acting for someone else, proof of your authority. If you are requesting a record on behalf of another person, you must state the right you are exercising or protecting. We will acknowledge the request and respond within thirty days, which we may extend once by up to thirty days for the reasons PAIA permits, and we will tell you in writing if the request is refused and why. Where the record contains information about a third party, we may need to notify that person and give them an opportunity to object, which can extend the period.
8. Fees (regulation 9)
| Item | Fee |
|---|---|
| Request fee (payable before the request is processed) | R140.00 |
| Photocopy or printed copy, per A4 page or part | R2.00 |
| Copy in computer-readable form on a flash drive or CD supplied by the requester | R40.00 |
| Copy on a CD supplied by us | R60.00 |
| Transcription of an audio record, per A4 page | R24.00 |
| Transcription or copy of visual images | At the service provider’s quoted cost |
| Search and preparation, per hour or part after the first hour | R145.00, to a maximum of R435.00 |
| Deposit | Where search and preparation is expected to exceed six hours, a deposit of one third of the estimated access fee may be required |
| Postage or electronic transfer | Actual cost |
A personal requester (someone asking for a record about themselves) pays no request fee. Fees are payable to Sankofa Health (Pty) Ltd by electronic transfer; banking details are provided on request. Fees are set by the PAIA Regulations and are updated here when the Regulator amends them.
9. Grounds for refusal, remedies and complaints
We may refuse access on the grounds set out in Chapter 4 of Part 3 of PAIA, including to protect the privacy of a third party, the commercial information of a third party or of Sankofa, information that is legally privileged, and the safety of people and the security of property. A requester who is aggrieved by our decision may lodge a complaint with the Information Regulator on the prescribed Form 5 within 180 days of the decision, or apply to a court under section 78.
10. Availability and updating of this manual
This manual is available on https://sankofa.health, at our registered office during business hours, and from the Information Regulator. It is reviewed at least once a year and whenever the information in it changes. Prepared under the authority of the head of the private body.