In this document, reference to “Bay Tissue Institute”, “BTI”, “we”, “our” or “us” means Bay Tissue Institute NPC, registration number 2020/257188/08 and VAT number 484 0319463.

Bay Tissue Institute respects privacy and is committed to ensuring that personal information and special personal information are collected, used, stored, protected and disclosed properly, lawfully and transparently.

This privacy notice explains how we collect, use, store, process and disclose personal information provided to us, received from donor families, recipients, medical service providers, hospitals, surgeons, laboratories, financial donors, website users, service providers and other relevant parties. This notice is intended to comply with the Protection of Personal Information Act 4 of 2013, commonly known as POPIA, and other applicable South African health, tissue banking, tax, financial, audit and record keeping requirements.

Please read this privacy notice carefully. By providing personal information to us, using our services, interacting with our website, portal, email, WhatsApp or other communication channels, or engaging with us as a donor family, recipient, medical practitioner, hospital, financial donor, supplier or other stakeholder, you acknowledge that we will process personal information as described in this notice, where we are legally permitted or required to do so.

1.  Who We Are
2.  Who This Privacy Notice Applies To
3.  The Type of Personal Information We Collect
4.  Where and When We Collect Personal Information
5.  When We Process Personal Information
6.  When We Process Special Personal Information
7.  How We Use Personal Information
8.  Financial Donor and Section 18A Information
9.  How We Share Personal Information
10.  How We Store and Protect Personal Information
11.  How Long We Keep Personal Information
12.  Your Rights and Access to Information
13.  Changes to Our Privacy Notice
14.  Contact Details
15.  How to Complain

Bay Tissue Institute NPC is a non profit organisation based at Suite 4, Bay Eye Hospital, 241 Main Road, Walmer, Port Elizabeth, 6001. Bay Tissue Institute administers human donor eye tissue and related services, including corneal donor tissue, autologous serum and amniotic membrane services, where applicable.

Bay Tissue Institute is led by Dr Theunis Botha as CEO and Medical Director. Ryan Scheepers is the General Manager and Information Officer. Dr Avette Botha is the Chief Financial Officer and Deputy Information Officer.

Bay Tissue Institute handles sensitive medical, donor, family, recipient, surgeon, hospital, financial and operational information. We understand the importance of confidentiality, traceability, responsible tissue banking, lawful processing and careful record keeping.

This privacy notice applies to personal information and, where applicable, special personal information relating to:

• Cornea tissue donors, donor families and next of kin.
• Living patients and recipients of tissue or related services.
• Surgeons, ophthalmologists, hospitals, transplant teams, laboratories, funeral homes and other medical service providers.
• Financial donors, sponsors, funders and supporters of Bay Tissue Institute.
• Staff, contractors, volunteers, consultants, suppliers, service providers and professional advisers.
• Website users, portal users and people who communicate with us by email, telephone, WhatsApp, forms or other channels.
• Any other person whose personal information is processed in connection with Bay
  Tissue Institute’s operations.

Although POPIA applies to information relating to identifiable living persons and, where applicable, existing juristic persons, Bay Tissue Institute treats donor records, donor family information, recipient information and all related tissue banking information with a high level of confidentiality and care.

Personal information includes information that identifies or can reasonably identify a person or juristic person. Depending on the relationship and the purpose of processing, Bay Tissue Institute may collect and process the following categories of personal information:

•  Name, surname, title, initials, identity number, passport number, registration number or other identifying details.
• Contact details, including physical address, postal address, email address, telephone number and WhatsApp number.
• Age, date of birth, gender, nationality, language, marital status and next of kin details.
• Donor family and consent related information, including relationship to the donor and records of consent or authorisation.
• Medical, clinical and health information required for donor screening, tissue suitability, retrieval, processing, testing, preservation, allocation, release, transplant support and traceability.
• Cause of death information, medical history, ocular history, health screening information and laboratory test results where relevant and lawful.
• Recipient, surgeon, hospital, theatre, transplant, clinical outcome and tissue traceability information.
• Medical aid, billing, payment, account, invoice and financial information where applicable.
• Financial donor and donation administration information, including receipt and accounting information.
• Website, portal, email, WhatsApp and communication records, including enquiries, form submissions, user access records and correspondence.
• Supplier, service provider, staff, contractor, volunteer and professional adviser information.
• Any other information required for lawful tissue banking, medical, regulatory, quality, audit, operational, financial or administrative purposes.

Special personal information includes sensitive categories of information such as health information, biometric information, race or ethnic origin, religious or philosophical beliefs, political persuasion, trade union membership, sex life and information relating to alleged criminal behaviour. In the context of Bay Tissue Institute, special personal information will mainly include health, medical, screening, donor suitability, tissue related and transplant related information.

Most personal information processed by Bay Tissue Institute is provided directly or indirectly through one or more of the following sources:

• Directly from donors, donor families, next of kin, recipients, financial donors, website users, portal users, staff, suppliers and other stakeholders.
• From donor registration forms, family consent records, recipient or patient related documentation, financial donation records and other forms or records submitted to us.
• From hospitals, surgeons, ophthalmologists, optometrists, transplant teams, laboratories, funeral homes and other healthcare or service providers.
• From medical records, donor screening processes, clinical assessments, laboratory tests, tissue retrieval records, processing records, storage records, allocation records and transplant records.
• From our internal donor registry, billing system, storage records, traceability records and operational systems.
• From emails, Gmail, WhatsApp, telephone calls, website forms, portal interactions, letters, meetings and other communications.
• From regulators, auditors, professional advisers, service providers and other third parties where lawful and relevant.

Providing certain information may be voluntary in some contexts. In other contexts, it may be required by law, regulatory requirements, clinical requirements, tissue banking standards, contractual arrangements or operational necessity. If required information is not provided, Bay Tissue Institute may be unable to assess donor suitability, obtain or verify consent, retrieve or process tissue, allocate tissue, support transplant processes, issue records or receipts, comply with legal obligations or provide the requested services

Bay Tissue Institute will process personal information only where a lawful basis exists under POPIA and other applicable law. The lawful basis may include one or more of the following:

• The data subject, or a competent person where required, has consented to the processing.
• Processing is necessary to carry out actions for the conclusion or performance of a contract or service arrangement.
• Processing is necessary to comply with an obligation imposed by law.
• Processing protects a legitimate interest of the data subject or another person.
• Processing is necessary for the proper performance of a public law duty by a public body, where applicable.
• Processing is necessary for pursuing the legitimate interests of Bay Tissue Institute or of a third party to whom the information is supplied, where permitted by law.

We will use personal information only for the purposes for which it was collected, for compatible purposes, or where further processing is permitted or required by law.

Bay Tissue Institute may process special personal information, including health and medical information, where permitted by POPIA and applicable health legislation. This may include processing by medical professionals, healthcare institutions, tissue banking services and authorised staff where necessary for proper treatment, care, tissue banking administration, quality management, regulatory compliance or related lawful purposes.

Special personal information may be processed where:

• Consent has been provided where consent is legally required.
  
• Processing is necessary for medical, healthcare, tissue banking, transplant, quality assurance, traceability, administration or regulatory purposes.
• Processing is necessary to exercise or defend a right or obligation in law.
• Processing is necessary to comply with legal, regulatory, audit or public interest obligations.
• Processing is necessary for research, historical, statistical or quality purposes, where appropriate safeguards are applied and privacy is not adversely affected.
• The information has deliberately been made public by the relevant person, where applicable.

Bay Tissue Institute applies confidentiality safeguards to special personal information and limits access to people who need the information for a lawful and operationally necessary purpose.

Medical and tissue donation information

We process donor, family, recipient, surgeon, hospital, medical and tissue related information for
the following purposes:

• To identify and communicate with donor families, next of kin, recipients, surgeons, hospitals, laboratories and other relevant parties.
• To assess donor suitability and obtain, record and verify consent or authorisation where required.
• To retrieve, process, test, preserve, store, allocate, release, supply and trace corneal tissue and related biological material or products where applicable.
• To support transplant, therapeutic, medical, clinical, quality assurance, adverse event, recall, audit, regulatory and record keeping processes.
• To maintain tissue traceability from donor referral or donation through to allocation, release, transplantation, outcome tracking or disposal, where applicable.
• To communicate with surgeons and transplant teams regarding tissue availability, suitability, clinical information, logistics and outcomes.
• To maintain internal donor registry, billing, storage, traceability and operational records.
• To comply with applicable health, tissue banking, regulatory, ethical, financial, audit and
  reporting obligations.

Communications

We may contact you and enable communication between Bay Tissue Institute and relevant parties by email, Gmail, telephone, WhatsApp, website forms, portal communications, letters and other appropriate channels. Communications may relate to donor referral, consent, tissue services, clinical coordination, billing, account administration, financial donations, regulatory issues, complaints, queries and general operations.

Website, portal and electronic services

We may process information submitted through www.baytissue.co.za, our online portal, website forms, email, Gmail and WhatsApp. This may include enquiries, form submissions, user access information, correspondence, technical information and related communication records. We use this information to respond to enquiries, manage services, maintain records, support users, improve operations and protect the security of our systems.

Billing, accounts and administration

We process billing, payment, invoice, account and administrative information to manage services, recover amounts due, maintain records, reconcile accounts, communicate about accounts, comply with financial and audit obligations and manage the operations of Bay Tissue Institute.

Quality, audit and regulatory purposes

We process information for quality management, training, audit, incident investigation, complaint handling, regulatory reporting, risk management, legal compliance and internal governance. Where possible and appropriate, information used for quality or statistical purposes will be de-identified, aggregated or limited to what is necessary.

Bay Tissue Institute may receive financial donations or support from donors, sponsors, funders and other supporters. Financial donation information is separate from cornea tissue donation information. This privacy notice must not be understood as suggesting that the donation of corneal tissue creates a tax benefit or financial reward for a donor family. Where Bay Tissue Institute is approved, required or otherwise entitled to issue Section 18A tax deductible receipts, or where it is required to keep records relating to financial donations, we may collect and process financial donor information, including:

• Donor name, contact details, physical address and email address.
• Donor type, identity number, passport number, registration number or other identifying details.
• Tax reference number where provided or required.
• Donation amount, donation date, donation method, donation description and receipt details.
• Unique receipt numbers, accounting records, audit records and related supporting
  documents.

We process this information to administer financial donations, issue Section 18A receipts where applicable, maintain accounting and audit records, comply with SARS and other legal reporting obligations, and submit required IT3(d) third party data to SARS where applicable.

If Bay Tissue Institute is not approved or not entitled to issue Section 18A receipts in a particular context, the wording in this section applies only to general financial donation administration, accounting, audit and lawful record keeping purposes.

Bay Tissue Institute will share personal information only where necessary, lawful and relevant to the purpose for which the information was collected or where disclosure is otherwise permitted or required by law.

Surgeons, transplant teams and medical service providers

We may disclose tissue related, clinical, suitability, allocation, storage, transport and transplant support information to surgeons, ophthalmologists, hospitals, transplant teams, laboratories and other relevant medical service providers involved in donor assessment, tissue processing, allocation, transplantation, outcome reporting, quality assurance or regulatory compliance.

Where tissue information is shared with surgeons or transplant teams, Bay Tissue Institute will share only the information required for clinical and transplant purposes. Donor identity details such as name and identity number will not be linked to the tissue information shared with surgeons and will remain securely stored on Bay Tissue Institute’s internal systems.

Regulators, auditors and legal requirements

We may disclose information to regulators, health authorities, auditors, inspectors, professional advisers, legal representatives, courts, law enforcement bodies or other authorities where required or permitted by law, regulation, court order, audit requirement, health requirement, public interest requirement or legal process.

Service providers and operational support

We may share information with service providers who assist us with IT, Gmail, website hosting and maintenance, internal systems, donor registry, billing, storage, scanning, records management, communication, logistics, courier services, laboratory services, accounting, audit, legal, insurance, administration and other operational support. These service providers may process information only for authorised purposes and subject to confidentiality and security requirements where applicable.

Financial donors and SARS

Where applicable, financial donor information may be shared with SARS, auditors, accountants, financial institutions and professional advisers for donation administration, Section 18A receipt issuing, IT3(d) reporting, accounting, audit, tax and legal compliance purposes.

Debt collection and legal enforcement

Where payment is not made or is incomplete, we may share relevant personal information, excluding special personal information unless legally necessary, with debt collectors, attorneys, insurers or other authorised parties for the purpose of recovering amounts due or enforcing legal rights.

Next of kin and authorised representatives

Where a person provides us with next of kin or representative details, that person must ensure that the next of kin or representative is aware that their personal information may be provided to and processed by Bay Tissue Institute for contact, consent, communication, administrative or related lawful purposes.

Bay Tissue Institute has put in place appropriate physical, technical and organisational security measures to prevent personal information from being accidentally lost, used, accessed, altered, disclosed or destroyed in an unauthorised way.

Access to personal information is limited to staff, contractors, medical professionals, service providers and other authorised parties who have a business, medical, operational, regulatory or legal need to know. They may process information only for authorised purposes and are expected to maintain confidentiality.

Our security measures and internal controls may include:

• Physical security measures for records, premises and storage areas.
• Computer, network, system and access security controls.
• Restricted access to donor registry, billing, storage and traceability records.
• Secure communication and confidentiality procedures.
• Confidential handling of medical, donor, family, recipient and surgeon information.
• Security and confidentiality requirements for service providers and outsourced activities.
• Retention, archiving and disposal procedures.
• Incident identification, investigation and response procedures.
• Training, guidance and internal accountability measures.

We use an internal and self built billing system, donor registry and storage system. We use Gmail for email communication. We own and manage our website. We also use WhatsApp for communication where appropriate. Although electronic communication can carry risks, we take reasonable steps to protect information and encourage users not to send unnecessary sensitive information through unsecured channels.

Bay Tissue Institute keeps personal information only for as long as necessary for the purposes for which it was collected or processed, unless a longer retention period is required or permitted by law, regulatory requirements, tissue banking standards, audit requirements, legal claims, contractual obligations or operational necessity.

As a general retention period, Bay Tissue Institute keeps relevant records for 15 years. This may include donor records, consent records, tissue traceability records, medical and clinical records, recipient and transplant support records, laboratory and quality records, financial records, donation records, account records, communication records and related operational records.

Where information is no longer required, Bay Tissue Institute will take reasonable steps to securely delete, destroy, archive, de-identify or anonymise it, where appropriate and lawful.

You have rights in connection with your personal information, subject to applicable law, clinical requirements, confidentiality obligations and lawful exemptions. These rights may include the right to:

• Request access to your information: You may ask us what personal information we have about you and request a copy of that information, subject to applicable legal limitations.
• Change or correct information: You may ask us to correct information you believe is inaccurate or complete information you believe is incomplete.
• Delete information: You may ask us to delete or remove personal information in certain circumstances, subject to legal, regulatory, medical, tissue traceability, audit and record keeping requirements.
• Object to processing: You may object to processing where the law allows you to do so, including where we rely on legitimate interests and there is something about your situation that makes you want to object.
• Withdraw consent: Where processing is based on consent, you may withdraw consent. Withdrawal of consent does not affect processing that was lawful before the withdrawal.
• Request restriction of processing: You may ask us to suspend or restrict processing in
  certain circumstances, for example while we verify accuracy or the reason for
  processing.

To make a request, object to processing, withdraw consent or raise a privacy query, please contact the Information Officer using the contact details below. You are not required to pay a charge for exercising your rights. If you make a request, Bay Tissue Institute will respond within the period required by law, usually within one month unless an extension or exemption applies.

Bay Tissue Institute may amend this privacy notice from time to time to reflect changes in law, regulatory requirements, tissue banking practice, systems, services, operations or privacy practices. We encourage you to review this privacy notice regularly

Should you have a privacy query, request or complaint, please contact the Information Officer of Bay Tissue Institute:

Organisation: Bay Tissue Institute NPC
Registration number: 2020/257188/08
Information Officer: Ryan Scheepers, General Manager
Deputy Information Officer: Dr Avette Botha, Chief Financial Officer
Email: admin@baytissue.co.za
Address: Suite 4, Bay Eye Hospital, 241 Main Road, Walmer, Port Elizabeth, 6001
Phone Number: 041 373 8800

You have the right to lodge a complaint with the Information Regulator South Africa if you are unhappy with how Bay Tissue Institute has used your personal information.

The Information Regulator’s contact details are as follows:

The Information Regulator South Africa
33 Hoofd Street
Forum III, 3rd Floor, Braampark
P.O. Box 31533
Braamfontein, Johannesburg, 2017
Complaints email: complaints.IR@justice.gov.za