BloodWorld Specific Privacy Policy

This page outlines Bloodworld's privacy policy. It explains your rights and gives you the information you are entitled to see under the Data Protection Act 2018, the Data Protection Act, 2012 (Act 843) and UK General Data Protection Regulation (GDPR), adapted for the context of BloodWorld operating in Africa. Our freedom of information and privacy page includes information on how you can request recorded information held by BloodWorld.

Who we are

BloodWorld is a blood information management system developed by Casantey Business Solutions Group Limited. Bloodworld's data management practices, including the types of data we handle and how we use it, adhere to the highest standards in blood management globally. This encompasses the complete lifecycle of blood and its components, from donation and storage to potential transplantation, as well as supporting research into new treatments and processes.

Reasons and purposes for processing information

We process personal information about you so that we can provide an enhanced level of service for blood donation and management. High standards in handling personal information are of the utmost importance to us, because they help us to maintain confidence from our customers, suppliers, partners, and the wider public.

When we handle your information, we:

make sure you know why we need it
only ask for what we need, and collect the minimal amount required
protect your information and ensure no one has access to it who should not
let you know if we are going to share it with other organizations
make sure we do not keep your information for longer than necessary
ensure you have the right to request any incorrect information be rectified
do not make your personal information available for commercial use without your consent
ensure that measures are put in place to allow appropriate consent to be obtained for holding personal information of anyone aged under 13

In addition to this, we:

value the personal information entrusted to us and make sure that we abide by the law when it comes to handling your personal information
ensure we consider security at the outset of any new project where we are planning to hold or use personal information in new ways, and to continue to review existing systems to ensure they are compliant with new laws
provide training to staff in how to handle personal information, maintain proper oversight of our information assets, and respond appropriately if information is not used or protected properly.

Why we process information

We process information to enable us to:

Promote our policies, procedures, and services to the public
Maintain our accounts and records and to support and manage our staff
Undertake research and development to improve patient outcomes

Provision of blood donation services

We also process information to include administration of health and social care services, management and administration of land, property, and residential property, and undertake research. We may operate a CCTV system on our premises for the prevention of crime and the safety and security of our staff and premises.

Lawful basis for processing your personal data

BloodWorld will process personal data as necessary for the effective performance of a task carried out in the public interest, under the relevant data protection laws in Ghana. We will always identify the lawful basis on which your personal information is processed as defined by the relevant data protection regulations in Ghana. BloodWorld will adhere to the principles of traceability from donor to recipient, where applicable, to deliver safe clinical care. This may affect your individual rights, in particular your right to erasure and to be forgotten. BloodWorld must keep all clinical records for 30 years if you donate to ensure traceability in line with the regulations.

Where required, BloodWorld will also satisfy the common law duty of confidentiality and will define a lawful basis for the use of disclosure of the personal information that has been provided in confidence, this can include valid informed consent; determining an overriding public interest or where there is a statutory basis or legal duty to disclose.

The information we process

We process information about our:

Customers
Employees
Suppliers and providers
Advisers, consultants, and other professional experts
Complaints and enquiries
Students on placements
Academics
Members and supporters of unions
NHS and NHIS staff
Members of the public for CCTV purposes
Research applicants
Researchers
Patients and donors
Family members of donors
Website users
Mobile application users

Information Collected

We may collect the following types of personal information:

Contact Information: Name, address, email address, phone number.
Demographic Information: Age, gender, date of birth.
Health Information: Medical history, blood type, donation records, test results.
Employment Information: Employment history, references (for staff and recruitment).
Financial Information: Bank details (for payments to suppliers or in specific circumstances).
Technical Information: IP address, browser type, operating system (collected when you use our website or app).
Usage Data: Information about how you use our website or app, including pages visited and actions taken.
CCTV Footage: Images and recordings from our CCTV system.
Communication Data: Records of correspondence with you.
Research Data: Information provided when participating in research studies.
Location Data: If you use our mobile application and grant permission, we may collect your precise or approximate location. This data may be used to help you find nearby donation centers, schedule appointments, or provide location based services. We will only collect this data when the app is running in the foreground or background if you have granted us permission to do so.
- Precise location data may include GPS coordinates, while approximate location data may be derived from your IP address or mobile network.
- This data may be used to help you find nearby donation centers, schedule appointments, provide directions, or offer other location-based services.
- We will only collect this data when the app is running in the foreground or background and only if you have granted us permission through your device settings.
- You can withdraw location permissions at any time through your device settings, but this may limit certain features of the app.

How we use your information

In addition to the reasons stated above, we may use your information for the following purposes:

Providing and managing blood donation services, including appointment scheduling and donation tracking.
Ensuring the safety and quality of blood and blood products.
Communicating with you about your donations, appointments, and other relevant information.
Conducting research to improve blood donation and transfusion practices.
Managing our website and mobile application and improving user experience.
Personalizing your experience on our website and mobile application.
Responding to your enquiries and complaints.
Maintaining the security of our premises and systems.
Complying with legal and regulatory requirements.
Sending you marketing communications about our services and ways to support BloodWorld (where you have provided consent).
Analysing website and app usage to improve our services.

For location-based services, including:

Finding nearby donation centers.
Providing directions to donation centers.
Sending location-based reminders or notifications (if enabled).

Who we share information with

As a Data Controller of your personal data, we may, where necessary, and in line with data protection legislation, need to share your data (and our data processors may also share information) with other organizations.
Here are some examples of types of organizations where we may, if necessary, share your data. Please note the data shared will be dependent on the type of service used within BloodWorld.

Employment and recruitment agencies: to obtain an employment reference for recruitment purposes
Current and past employers: to verify your employment history for recruitment purposes
Suppliers and service providers: to support the services we provide
Government internal audit and other auditors as required: to support regular audit activities and maintain scrutiny over decision-making and activities
Health and care organizations: to verify clinical and non-clinical activity such as the provision of blood products and testing services
Other statutory law enforcement agencies: to assist in any legal or fraudulent activity
Survey and research organizations: to share your information for research purposes where you have consented to be part of a study
Government regulators: to support organizational audit and investigations
The police: to assist with police enquiries in line with relevant legislation
Other organizations as necessary to fulfil the scope and functions required to provide the best services
IT service providers who assist with the operation and maintenance of our systems and website/app.
Analytics providers who help us understand how our website and app are used.

Data retention

Outside of specific exemptions under specific legislation related to personal data, your information shall be retained for no longer than the purposes for which it is being processed. We comply with the Records Management Code of Practice for 2021. We are required to hold and process your data for at least 30 years to ensure full traceability. This is to ensure full traceability to the point of delivery to a hospital.

Your rights

The data we are collecting is your personal information and you have considerable say over what happens to it. Depending on the legal basis for processing, you have a set of individual rights. You can:

See what data we hold about you (right of access)
Ask us to stop using your data, but keep it on record (right to restriction of processing)
Have some or all of your data deleted (right to erasure)
Have some of your data corrected (right to rectification)
Receive your data in a portable format (right to data portability, where applicable)
Object to the processing of your data (right to object)
Lodge a complaint with the relevant data protection authority in Ghana if you think we are not handling your data fairly or in accordance with the law
Withdraw your consent at any time where consent is the lawful basis for processing.

Rights of Access requests

Data Protection legislation allows you to find out the personal information we hold about you on computer and IT records (formerly known as a subject access request). The legislation requires us to respond to a valid request within one month. However, in the event we are unable to meet this timescale (for example, due to a large volume of information to be assessed) we will keep you informed of progress towards fulfilling your request. To request access to personal data we hold about you, please write to our Data Protection Officer using the contact details on this page.

How we use your information for Research and Development

BloodWorld is working to find ways to develop better treatments for care. The information we hold on you can be used to help our researchers understand more about causes of illnesses and how best to treat them. We follow strict rules to make sure your personal data is always kept secure and confidential. Where possible, we take out any information that could identify you, such as your name, address, and postcode. If we cannot practically take out such information, it is our legal responsibility to ask for your explicit consent or to identify an appropriate legal basis to process your data.

Marketing

For all services, we would like to keep in touch with you to inform you of the valuable work and services BloodWorld does and inform you of other ways to support BloodWorld. You are always in full control of the messages you receive. If you are a blood donor, we will ask you to provide us with additional contact information like your email address and mobile phone number. We do this so that we can provide you with timely communications relating to when donation appointments are available, preparing for your donation, and letting you know where your donation was issued. If you want us to change the way we contact you, please let us know by contacting us. Please note: if you do choose to opt out of communications it can take up to 30 days to process your request.

The website and cookies

You can use our website without providing any personal details. However, to sign up to any services such as blood donation, you must provide data to support this. Cookies are a record made on your computer that saves information about the web pages you visit and services you use.

You may disable the use of cookies, but this may limit the functionality of our websites or your access to it. Cookies are files or pieces of information that are stored by your browser on your computer's hard drive. BloodWorld may use cookies to collect information about you and to identify you during your visit to our websites, like the particular site areas you visit and the services you use through our websites.
We collect this information to better tailor our site to your interests and needs. Cookies may also be used to help speed up your future activities on our websites. For example, a site can recognize that you have provided personal information to us and refrain from requesting the same information a second time. We also use cookies for online retargeting purposes to show you relevant adverts from us on third-party sites, including social media websites, based on pages you have visited on our site and others.
We hold cookie information for 30 days before the cookie expires. Most browsers are initially set to accept a cookie. If you prefer, you can set yours to refuse cookies or to alert you when cookies are being sent. Refusal of cookies at the site you enter may result in an inability to visit certain areas of the site or to receive personalized information when you visit the site. For further information on 'cookies' please consult the ‘help’ section of your browser.

National Data Opt Out

BloodWorld will comply with the national data opt-out policy, if applicable in Ghana. Whenever you use a health or care service or using any of our services, important information about you is collected in a patient record for that service. Collecting this information helps to ensure you get the best possible care and treatment.
The information collected about you when you use these services can also be used and provided to other organizations for purposes beyond your individual care, for instance to help with:

improving the quality and standards of care provided
research into the development of new treatments
preventing illness and diseases
monitoring safety
planning services

Most of the time, anonymized data is used for research and planning so that you cannot be identified in which case your confidential patient information is not needed.
You have a choice about whether you want your confidential patient information to be used in this way. If you are happy with this use of information you do not need to do anything. If you do choose to opt-out your confidential patient information will still be used to support your individual care. You can change your mind about your choice at any time.
Data being used or shared for purposes beyond individual care does not include your data being shared with insurance companies or used for marketing purposes and data would only be used in this way with your specific agreement.

Data Security

We take the security of your personal information very seriously. We have implemented appropriate technical and organizational measures to protect your data against accidental or unlawful destruction, loss, alteration, unauthorized disclosure, or access. These measures include:

Encryption of data at rest and in transit.
Regular security assessments and audits.
Access controls and authorization procedures.
Staff training on data protection and security.
Physical security measures for our premises.

Data Transfers

Data will be stored primarily in Ghana but may be stored internationally in data centres such as AWS, Oracle data cloud, etc., as the need arises. Where we transfer your personal data to countries outside of Ghana, we will ensure that appropriate safeguards are in place to protect your data in accordance with applicable data protection laws. These safeguards may include the use of standard contractual clauses approved by the relevant authorities.

Contacting our Data Protection Officer

BloodWorld is the Data Controller for the personal data we hold and process about you. The Data Protection Officer can be contacted:

In writing:
Casantey Business Solutions Group Limited.
5 Nii Adjei Okpong II Link,
Adjiriganor, Accra.

By email: privacy@casantey.com

Contacting the relevant data protection authority

For independent advice about data protection, privacy, and data sharing issues, you can contact the independent data protection authority in Ghana. Their contact details are:

East Legon,
Paw Paw Street
Accra, Ghana

Updates to this Privacy Policy

We may update this privacy policy from time to time to reflect changes in our practices or legal requirements. We will notify you of any significant changes by posting the updated policy on our website or through other appropriate communication channels. We encourage you to review this policy periodically.