Fistula Care Uganda – Fistula Foundation Surgical Center

Last updated: 13 October 2023

1. Introduction

Fistula Care Uganda, operating through the Fistula Foundation Surgical Center at Surgical Centre Mbarara (“we,” “us,” or “our”), is committed to protecting the privacy, dignity and personal information of patients, website visitors, donors, partners and other individuals who interact with us.

Our website provides information about obstetric fistula, fistula repair services, patient experiences, community awareness and our work to improve access to treatment for women in Uganda.

This Privacy Policy explains how we collect, use, store, disclose and protect personal information when you visit our website, contact us, enquire about our services, support our work or interact with us through other communication channels.

We aim to handle personal information in accordance with Uganda’s Data Protection and Privacy Act, 2019, the applicable Data Protection and Privacy Regulations, 2021, and other relevant laws.

By using our website, you acknowledge this Privacy Policy. Where consent is legally required for a particular activity, we will seek that consent separately.

2. Who We Are

Fistula Care Uganda is a programme providing access to obstetric fistula screening, treatment and surgical repair through Surgical Centre Mbarara, with support from the Fistula Foundation and collaboration with local healthcare stakeholders.

For this Privacy Policy, “Fistula Care Uganda,” “Fistula Foundation Surgical Center,” “we,” “us,” and “our” refer to the programme and the relevant organisation responsible for operating the website and handling the information described here.

Contact details

Address: Plot 4A, Galt Road, P.O. Box 421094, Mbarara, Uganda

Telephone: 0742 673339 / 0764 095907

Website: https://fistulacareuganda.com/

For privacy-related enquiries, please contact us using the details above and indicate that your enquiry concerns personal data or privacy.

3. Personal Information We Collect

The information we collect depends on how you interact with our website and services.

3.1 Information You Provide Directly

When you contact us, submit an enquiry, request information about treatment, make a referral or communicate with our team, we may collect:

Your name and contact details, including telephone number and email address.

Your general location or district, where relevant to your enquiry.

The contents of your message or enquiry.

Information relating to a request for treatment, referral or patient support.

Information you provide when communicating with us as a donor, healthcare professional, community representative or organisational partner.

You should avoid submitting detailed medical records or highly sensitive medical information through a general website contact form unless we have specifically instructed you to use an appropriate secure channel.

3.2 Patient and Health Information

When a person seeks or receives medical care through our programme or the relevant healthcare facility, information may be collected as necessary for appropriate treatment, referral, care coordination and related administrative activities.

Depending on the circumstances, this may include:

Patient identification and contact details.

Relevant medical history, symptoms and examination findings.

Information about obstetric fistula, perineal tears and related conditions.

Diagnosis, treatment plans, surgical procedures and recovery progress.

Referral information, follow-up arrangements and relevant care records.

Information necessary to coordinate transport, accommodation, meals or other patient support.

Patient information is particularly sensitive. It is handled separately from general website enquiries where appropriate and should only be accessed or disclosed for authorised purposes.

3.3 Patient Stories, Testimonials and Photographs

Our website may feature patient stories, testimonials, photographs, quotations or experiences intended to raise awareness about obstetric fistula and demonstrate the impact of treatment.

We recognise that such information can reveal a person’s identity and health history. We will seek appropriate informed consent before publishing identifiable patient stories, photographs or testimonials for awareness, educational, fundraising or promotional purposes, where consent is the applicable legal basis.

Consent to receive medical care is separate from consent to publish a story, photograph or testimonial.

Where a person does not consent to publication, we will not publish their identifiable story or image on that basis. We may use appropriately anonymised information or aggregated statistics where lawful and where individuals cannot reasonably be identified.

3.4 Information Collected Automatically

When you visit our website, certain technical information may be collected automatically, depending on the website’s configuration and the tools enabled. This may include:

Internet Protocol (IP) address.

Browser type and device information.

Pages visited and links clicked.

Date, time and duration of visits.

Referring websites and general usage information.

Technical logs used to maintain website security and performance.

We use this information where appropriate to operate, protect and improve the website.

3.5 Cookies and Similar Technologies

Our website may use cookies and similar technologies to support essential functionality, remember preferences, understand website usage and improve performance.

Some cookies may be provided by third-party services integrated into the website, such as analytics, embedded media or donation-related services.

Where required by law, we will request consent before using non-essential cookies or similar technologies. You can also manage cookies through your browser settings, although disabling certain cookies may affect website functionality.

4. How We Use Personal Information

We may use personal information for the following purposes:

Responding to enquiries: To answer questions, respond to messages and provide requested information.

Treatment and patient support: To facilitate screening, referrals, surgical care, follow-up and related support where applicable.

Care coordination: To coordinate with authorised healthcare professionals, referral facilities and relevant support personnel.

Programme administration: To manage our activities, maintain appropriate records and coordinate programme operations.

Monitoring and reporting: To assess programme performance, understand treatment outcomes and prepare operational or impact reports.

Awareness and education: To communicate information about fistula prevention, treatment and recovery.

Fundraising and accountability: To provide programme information and report on the use and impact of support received.

Website improvement: To understand website usage, troubleshoot problems and improve accessibility, content and security.

Legal and regulatory compliance: To comply with applicable laws, lawful requests and relevant professional obligations.

Protection and security: To detect, investigate and prevent fraud, misuse, unauthorised access or other security incidents.

We will not use sensitive personal information for purposes unrelated to its collection without an appropriate lawful basis.

5. Lawful Basis for Processing

We process personal information only where there is an appropriate legal basis under applicable law.

Depending on the circumstances, this may include:

Your informed consent.

Providing or coordinating healthcare and related services.

Fulfilling legal or regulatory obligations.

Other lawful grounds applicable to the specific processing activity.

Where we rely on consent, you may withdraw it at any time, subject to applicable legal requirements and the consequences explained to you. Withdrawal does not automatically make earlier lawful processing invalid.

Medical records may need to be retained even where consent for a separate activity, such as publishing a testimonial, is withdrawn.

6. Confidentiality and Protection of Health Information

We understand that obstetric fistula and related medical conditions involve deeply personal information. Protecting the confidentiality and dignity of patients is central to our approach.

We take reasonable organisational, technical and administrative measures to protect personal information against unauthorised access, loss, misuse, alteration or disclosure.

These measures may include:

Restricting access to authorised personnel who need information for legitimate duties.

Using appropriate access controls and password protection.

Maintaining reasonable security measures for website systems and stored records.

Training relevant personnel on confidentiality and responsible information handling.

Using appropriate safeguards when sharing information with authorised service providers.

No website, electronic communication channel or storage system can be guaranteed to be completely secure. We therefore encourage individuals to avoid sending highly sensitive medical information through unsecured channels.

7. Sharing and Disclosure of Information

We do not sell personal information.

We may share personal information only where necessary, appropriate and lawful, including in the following circumstances:

7.1 Healthcare Professionals and Referral Facilities

Relevant patient information may be shared with authorised healthcare professionals or referral facilities when necessary to assess, provide, coordinate or follow up on care.

7.2 Programme Partners and Funders

We may share appropriate programme information with the Fistula Foundation, the Ministry of Health, authorised programme partners or funders where necessary for legitimate programme activities, accountability, monitoring or reporting.

Where possible, reports intended for broader distribution will use aggregated or anonymised information rather than identifiable patient records.

Identifiable patient information will not be disclosed to partners or funders merely because they support our work. Any such disclosure must have an appropriate lawful basis and suitable safeguards.

7.3 Website and Technology Providers

We may use third-party providers for website hosting, security, analytics, communications, email or other technical services. These providers may process relevant information on our behalf, subject to appropriate arrangements and safeguards.

7.4 Legal and Safety Requirements

We may disclose information where required or permitted by law, by a lawful order or request from a competent authority, or where disclosure is otherwise lawfully necessary to protect an individual’s safety or rights.

Where appropriate and lawful, we will limit disclosures to the information necessary for the relevant purpose.

8. International Transfers of Personal Information

Some website hosting, email, analytics or other technology providers may store or process information outside Uganda.

Where personal information is transferred internationally, we will take the steps required by applicable law to ensure that the transfer has an appropriate legal basis and suitable safeguards.

Sensitive patient information will be subject to particular care when considering any international transfer or access.

9. Data Retention

We retain personal information only for as long as reasonably necessary for the purposes for which it was collected, subject to applicable legal, medical, regulatory, operational and recordkeeping requirements.

Retention periods may differ depending on the type of information:

Website enquiries: Retained for the period needed to respond and maintain appropriate administrative records.

Patient and clinical records: Retained in accordance with applicable healthcare, legal and professional recordkeeping requirements.

Patient stories and photographs: Retained for as long as reasonably necessary for the agreed purpose, subject to consent, withdrawal requests and applicable legal obligations.

Technical logs and analytics information: Retained according to operational needs and the settings of the relevant systems.

When information is no longer required, we will take reasonable steps to securely delete it, destroy it or anonymise it, where appropriate and lawful.

10. Your Privacy Rights

Subject to applicable law and any relevant limitations, you may have the right to:

Request confirmation of whether we hold personal information about you.

Request access to personal information we hold about you.

Ask us to correct inaccurate or incomplete information.

Request deletion of personal information where legally permissible.

Object to or request restrictions on certain processing activities where applicable.

Withdraw consent where processing is based on consent.

Raise concerns about how your personal information is collected, used or disclosed.

Seek assistance or lodge a complaint with the relevant Ugandan data protection authority.

Requests relating to medical records may be subject to identity verification, patient confidentiality requirements and restrictions protecting other individuals’ information.

To exercise your rights, contact us using the contact details in Section 2. Please describe your request clearly and provide sufficient information for us to identify the relevant records. We may request reasonable proof of identity before responding.

We will handle requests in accordance with applicable law.

11. Patient Stories and Withdrawal of Consent

We respect every patient’s right to dignity, privacy and informed choice.

If you previously agreed to the publication of your photograph, testimonial or patient story and later wish to withdraw that consent, please contact us and identify the material concerned.

We will review the request and take reasonable steps to remove or stop using the relevant material from channels we control, where appropriate and legally possible.

Please note that copies already distributed by third parties, previously printed materials or archived content may not always be retrievable. Withdrawal of publication consent does not affect the lawfulness of processing carried out before withdrawal.

Choosing not to participate in a testimonial, photograph or awareness campaign will not, by itself, affect eligibility for medical treatment or patient support.

12. Children’s Personal Information

Our website is intended for a general audience, but some information relating to maternal and reproductive healthcare may involve minors.

Where personal information concerning a child is collected, we will take appropriate steps to protect the child’s privacy and handle the information in accordance with applicable law.

We will seek any required consent or authorisation before using identifiable images, stories or other personal information concerning children. Such information will not be published merely because it has been provided to us.

13. External Links and Third-Party Websites

Our website may contain links to external websites, partner organisations, donation platforms or social media services.

These websites operate under their own privacy policies and practices. We are not responsible for the privacy, security or content of external websites that we do not control.

We encourage you to review the relevant privacy policy before submitting personal information through an external service.

14. Data Breaches and Security Incidents

If we become aware of a personal data breach affecting information under our responsibility, we will assess the incident and take appropriate steps to contain it, investigate its effects and reduce potential harm.

Where notification to a regulator or affected individuals is required by law, we will follow the applicable notification requirements.

15. Changes to This Privacy Policy

We may update this Privacy Policy from time to time to reflect changes in our services, website functionality, information-handling practices or legal obligations.

The latest version will be published on this page with an updated revision date. We encourage visitors to review the policy periodically.

Where required, we will provide additional notice or seek fresh consent for material changes to the way personal information is used.

16. Contact Us

If you have questions about this Privacy Policy, wish to exercise your privacy rights or have concerns about the handling of your personal information, please contact:

Fistula Care Uganda – Fistula Foundation Surgical Center

Plot 4A, Galt Road
P.O. Box 421094
Mbarara, Uganda

Telephone: 0742 673339 / 0764 095907

Website: https://fistulacareuganda.com/

Please indicate that your enquiry relates to privacy or personal data so it can be directed to the appropriate person.

This Privacy Policy is intended to explain our information-handling practices in clear language. It should be reviewed against our actual systems and procedures before publication and does not replace professional legal advice.