Privacy Policy
This Privacy Policy explains what personal data we collect about the people who contact us or use this website, and how we use and protect it. It is written to meet our obligations under Uganda's Data Protection and Privacy Act, 2019 and the Data Protection and Privacy Regulations, 2021.
For the purposes of that Act, the data controller is Whisper the Union for Childcare, Outreach and Education, the Uganda-registered NGO that runs Whisper Hospital, of 32 Madhvani Road, P.O. Box 5127, Jinja, Uganda.
If you have any questions about this notice, or you want to exercise any of your rights over your data, please contact us.
1. Personal data that we process
The table below explains the personal data we collect through this website and our related services, why we collect it, and the ground under the Data Protection and Privacy Act, 2019 on which we rely.
| Purpose | Data (key elements) | Our lawful ground |
|---|---|---|
| Contacting us with an enquiry, or asking about our work | Name, email, phone (optional), message | Your consent, and our legitimate need to read and store your message so that we can reply to you as you would expect. |
| Giving feedback on your hospital visit (the patient feedback / survey form) | Your ratings and comments; optionally the date of your visit, department, the doctor you saw, and your name if you choose to give it | Your consent. The form is voluntary and every question is optional; you can give feedback without identifying yourself. |
| Booking an appointment online | Name, contact details and the appointment details you provide | Your consent, and the need to arrange the appointment you have asked for. Online booking is handled for us by a third-party booking system (see section 3). |
| Joining a Whisper Hospital WhatsApp group or community | Your phone number and WhatsApp profile | Your consent; joining is voluntary and you can leave at any time (see section 7). |
| Website functionality | Activity that would be collected through cookies | We don't currently use cookies on this website (see section 8). |
Your medical records — the clinical information created when you are treated at the hospital — are not collected through this website. They are held separately and confidentially by the hospital, and are treated as special personal data under the Act, protected by both the Act and our staff's professional duty of confidentiality. This privacy policy only covers the data we collect on this website; for information about your medical records, you will need to contact the hospital.
2. How we use your data
We only use your data in a way that fits the purpose for which you gave it to us, as set out in the table above. For example, we may use your personal information to:
- reply to enquiries you send us;
- arrange and follow up an appointment you have booked;
- understand and act on the feedback you give us, so that we can improve the care we provide.
We do not sell your personal data, and we do not use it to make automated decisions that significantly affect you.
3. When we share your data
We will only pass your data to other people or organisations in the following circumstances:
- you have given your consent for us to share it with a named third party;
- we use a third party only to process data on our behalf, for example the service that runs our website, under an agreement that requires them to protect your data and use it only as we instruct; or
- we are required by law to share it.
4. Sending data outside Uganda
Some of the services we use to run this website are hosted outside Uganda. In particular, messages and feedback sent through forms on this website are handled on web servers located in the United States of America.
The Data Protection and Privacy Act, 2019 allows personal data to be processed or stored outside Uganda where the receiving country has protections at least equivalent to the Act, and where you have agreed to the transfer. We rely on both: we choose service providers that offer such protections, and by sending us data through this website you consent to it being handled in this way. We keep records of the basis and safeguards for these transfers, as the Act requires. If you would prefer not to send your information through the website, you can instead contact or visit the hospital directly.
5. How long we keep your data
We take the principles of data minimisation and removal seriously: we ask only for the minimum data needed for each purpose, and we delete it once it is no longer required for that purpose or by law. Feedback used to improve our services is kept only for as long as it is useful for that purpose, and is reported in a way that does not identify individuals wherever possible.
6. Rights you have over your data
Under the Data Protection and Privacy Act, 2019 you have a number of rights over your personal data, including the right to:
- ask what personal data we hold about you, and to be given a copy of it;
- ask us to correct data that is inaccurate or out of date;
- ask us to delete your data, or to stop processing it, where you withdraw consent or the data is no longer needed;
- object to the processing of your data; and
- not be subject to a decision based solely on automated processing that significantly affects you.
Where our use of your data is based on your consent, you can withdraw that consent at any time — for example by leaving a WhatsApp group, or by asking us to remove your details. To exercise any of these rights, please get in touch with us. Please note that acting on some requests, such as deleting your data, may mean we can no longer provide a particular service to you.
If you believe your rights have not been respected, you can complain to the Personal Data Protection Office (PDPO), Uganda's data-protection regulator.
7. WhatsApp
We may invite you to join a Whisper Hospital WhatsApp group or community, for example to coordinate an event. Joining is voluntary and you can leave at any time. WhatsApp is a third-party service. By default, joining a group makes your phone number visible to the other members of that group. WhatsApp is rolling out usernames and related privacy settings that can let you take part without sharing your number, so you may be able to limit this in your own WhatsApp settings, but setting a username does not hide a number that other members already have saved or that has already appeared in the group. For details of how WhatsApp handles your data, and the privacy controls available to you, see WhatsApp's privacy policy.
8. Cookies and usage tracking
A cookie is a small file of letters and numbers that a website can store on your device, for example to remember your preferences. We don't currently use cookies on this website, and we don't track you as an individual. We do count which pages are visited most, but that information does not identify individual people.
9. Changes to this policy
We may update this Privacy Policy from time to time, and we will always publish the current version on this website. If a change meaningfully reduces your rights, we will take reasonable steps to let affected people know.