Privacy Notice

---

Doctor On Call (Pty) Ltd ("Doctor On Call", "DOC", "we", "our", or "us") is committed to protecting the privacy and confidentiality of personal information processed through the Healthcare Management System (HMS).

This Privacy Notice explains how the HMS collects, uses, stores, shares, and protects personal information in accordance with the Botswana Data Protection Act, 2024.

This Privacy Notice applies to all authorized users of the HMS, including healthcare professionals, clinic staff, administrators, authorized contractors, and patients who access any patient-facing functionality.

Contact details

What personal information we collect

We may collect:

Patient Information

• Identification information
• Contact details
• Demographic information
• Medical history
• Consultation notes
• Diagnoses
• Allergies
• Medications and prescriptions
• Laboratory and diagnostic results
• Clinical observations
• Appointment history
• Billing and payment information
• Emergency contact details

User Information

For authorized HMS users we may process:

• Name
• User account details
• Professional registration information
• Organization or clinic
• User role and permissions
• Login history
• Audit logs
• Electronic signatures where applicable

Technical Information

The HMS automatically records:

• IP address
• Device information
• Browser information
• Login timestamps
• User activity
• Security events
• System logs

How we use your personal information

Personal information processed through the HMS is used to:

• deliver and support healthcare services;
• maintain accurate clinical records;
• manage appointments and referrals;
• facilitate communication between patients and healthcare providers;
• support prescribing, dispensing, and laboratory services;
• administer billing and payment processes;
• authenticate authorized users;
• protect the security and integrity of the HMS;
• investigate incidents and suspected misuse;
• comply with legal and regulatory obligations; and
• support the effective administration of healthcare services.

Research, Analytics and Service Improvement

Doctor On Call is committed to improving healthcare delivery, advancing medical knowledge, and supporting evidence-based healthcare planning.

The Healthcare Management System records information necessary for patient care and system administration.

To improve healthcare services, enhance system functionality, monitor healthcare trends, and support approved research and public health initiatives, Doctor On Call may generate de-identified, anonymised, and aggregated information from information processed through the HMS.

Wherever reasonably practicable, research, analytics, and reporting activities will be conducted using information that has been anonymised and aggregated so that individuals cannot reasonably be identified.

These activities may include:

• service improvement;
• healthcare analytics;
• healthcare forecasting;
• quality assurance;
• statistical reporting;
• operational planning;
• clinical research;
• public health research; and
• healthcare policy development.

Where identifiable personal information is required for research, it will only be processed where permitted by law and subject to the appropriate legal basis and governance requirements.

Doctor On Call does not sell personal information for research purposes.

Lawful bases and data protection rights

Subject to the Data Protection Act, 2024, you have the right to:

• Be informed about how your personal information is collected and used.
• Request access to the personal information we hold about you.
• Request correction of inaccurate, incomplete, or outdated personal information.
• Request erasure of your personal information where the conditions under the Act are met.
• Object to the processing of your personal information where permitted by law.
• Withdraw your consent at any time where processing is based on your consent.
• Lodge a complaint with Doctor On Call or the Information and Data Protection Commission if you believe your personal information has been processed unlawfully

We may request information to verify your identity before responding to your request.

We will respond to requests within the timeframes prescribed by the Data Protection Act, 2024.

To exercise any of your rights, please contact our Data Protection Officer using the contact details provided in this Privacy Notice.

Our lawful bases for the collection and use of your data

Under the Data Protection Act, 2024, we will only collect and use your personal information where we have a lawful basis for doing so.

Our lawful bases for collecting and using personal information through the Healthcare Management System (HMS) are:

• Consent – where you have freely given your consent after being provided with the necessary information. For example, where consent is required for specific healthcare services, optional communications, or certain research activities. Where we rely on your consent, you have the right to withdraw it at any time. Withdrawal of consent will not affect the lawfulness of any processing carried out before your consent was withdrawn.
• Contract – where processing is necessary to take steps at your request before entering into a contract or to perform contractual obligations relating to the provision of healthcare services or the use of the HMS.
• Legal obligation – where we are required to collect, use, retain, or disclose personal information to comply with applicable laws, regulations, court orders, professional obligations, or other legal requirements.
• Vital interests – where processing is necessary to protect your life, health, or safety, or that of another individual, particularly in medical emergencies or other circumstances where urgent action is required.
• Legitimate interests – where processing is necessary for our legitimate interests or those of a participating healthcare provider, provided those interests are not overridden by your fundamental rights and freedoms. Our legitimate interests include:
  • administering and maintaining the Healthcare Management System;
  • authenticating users and managing access to the HMS;
  • protecting the confidentiality, integrity, and availability of the HMS;
  • monitoring system performance and investigating security incidents;
  • maintaining audit logs and system records;
  • preventing fraud, misuse, and unauthorized access;
  • improving the functionality, usability, and security of the HMS;
  • supporting business continuity and disaster recovery;
  • establishing, exercising, or defending legal claims; and
  • supporting service improvement, quality assurance, and operational management.

Where we get personal information from

• Patients
• Authorized representatives
• Healthcare professionals
• Participating clinics
• Laboratories
• Pharmacies
• Medical aid providers where applicable
• Authorized HMS users; and
• System-generated activity logs

How we protect personal information

Doctor On Call implements technical and organisational measures to protect personal information processed through the HMS. These measures include user authentication, role-based access controls, audit logging, encryption where appropriate, monitoring, secure backups, and regular security reviews.

All authorised users are required to comply with the HMS Acceptable Use & Information Security Policy.

How long we keep information

Personal information is retained in accordance with applicable legal requirements, healthcare record retention obligations, and contractual requirements.

Where information is no longer required, it will be securely deleted or anonymized.

Who we share information with

Data Processors

Doctor On Call (Pty) Ltd

This data processor does the following activities for us:

• hosting and operating the Healthcare Management System
• processing patient and healthcare information entered into the HMS
• managing user accounts and access controls
• maintaining system security and audit logs
• providing technical support and system administration
• performing system maintenance, backups, and disaster recovery activities
• supporting authorized reporting, analytics, and service improvement activities in accordance with applicable legal and contractual requirements.

Others we share personal information with

• Authorized healthcare professionals
• Participating clinics
• Laboratories
• Pharmacies
• Medical aid schemes and insurers where applicable
• Law enforcement agencies where required by law
• Other persons or organizations where authorizes by law or with the individual’s consent

Questions, Concerns and Complaints

Questions, concerns or privacy-related matters may be reported through the HMS Support Helpdesk using the appropriate request type (e.g., Internal Privacy Complaint or Personal Data Breach).

If you believe that your rights under the Data Protection Act, 2024 have been infringed, please contact us in the first instance:

Data Protection Officer

Doctor On Call (Pty) Ltd

Email: privacy@doc.co.bw

We will acknowledge and investigate your complaint and endeavour to respond within a reasonable period in accordance with applicable law.

If you remain dissatisfied with our response or believe that we have not handled your personal information in accordance with the Data Protection Act, 2024, you may lodge a complaint with the:

Information and Data Protection Commission

Ministry for State President, Defence and Security

Private Bag 001

Gaborone

Botswana

Telephone: (+267) 395 0800

Changes to Privacy Notice

We may update this Privacy Notice to reflect changes in our services, legal obligations, technology, or privacy practices.

The latest version will always be available on our website. Where required by law, we will notify individuals of material changes.

Last Updated: 15 October 2026