.png)
MaryBegg Health Services Privacy Policy
Effective Date: 15-09-2025
Last Updated: 05-10-2026
1. INTRODUCTION
1.1 Mary Begg Health Services (“MBHS”, “the Hospital”, “we”, “us”, “our”) respects the privacy of its patients and is committed to protecting their personal and health information.
1.2 This Privacy Notice explains how MBHS collects, uses, stores, discloses and protects personal information when patients register, receive care, or otherwise interact with any MBHS facility.
1.3 This Privacy Notice is issued in accordance with the Data Protection Act No. 3 of 2021 (“the Act”) and other applicable laws of Zambia.
1.4 This notice is provided to you at the time of registration. It does not form part of, and does not replace, any consent form you may be asked to sign authorising specific treatment, procedures, or disclosure of information.
2. WHO WE ARE
2.1 MBHS is a private, multi-facility healthcare provider operating hospitals, clinics, and diagnostic services across Zambia, providing emergency, outpatient, and inpatient clinical care, diagnostics, and related health services.
2.2 MBHS is a Data Controller in respect of personal information processed in the course of its operations, and is committed to ensuring that such information is processed lawfully, fairly, transparently and securely.
3. INFORMATION WE COLLECT
3.1 Depending on your interaction with us, we may collect the following categories of personal information:
a) Identification Information: full name, date of birth, national registration card number, physical address, telephone number, and email address;
b) Health and Medical Information: diagnoses, treatment history, medications, laboratory and diagnostic results, and clinical notes;
c) Billing and Insurance Information: charges, payment records, and insurer or employer scheme details; and
d) Next of Kin Information: next of kin and emergency contact details.
e) CCTV Information: Video footage and images captured through CCTV cameras at MBHS facilities for security and safety purposes.
f) Digital Application Information: Personal information collected through MBHS applications and online platforms, including account details, device information, usage data, appointment details and information submitted through these platforms.
4. HOW WE COLLECT INFORMATION
4.1 We may collect personal information:
a) directly from you during registration, consultation, admission, treatment, or discharge;
b) by phone, where you register or book an appointment by phone;
c) from a referring healthcare professional or another MBHS facility involved in your care; and
d) from your medical aid scheme or insurer, where relevant to your claim.
5. HOW WE USE YOUR INFORMATION
5.1 We may process personal information for the following purposes:
a) providing you with safe and appropriate clinical care and treatment;
b) processing billing, insurance claims, and payment for services rendered;
c) maintaining accurate medical records as required by law and professional clinical standards;
d) complying with legal, regulatory, and public health reporting obligations; and
e) internal quality assurance, audit, and service improvement.
f) ensuring the safety and security of patients, visitors, staff and MBHS facilities; and
g) managing patient accounts, appointments and digital services.
6. FAILURE TO PROVIDE INFORMATION
-
6.1 Where personal information is required to provide healthcare services, verify your identity, process insurance claims, or comply with a legal obligation, failure to provide such information may limit our ability to provide the requested services.
7. LEGAL BASIS FOR PROCESSING
7.1 We process personal information where:
a) you have provided your consent;
b) processing is necessary for the provision of healthcare services to you;
c) processing is required to comply with a legal obligation;
d) processing is necessary to protect your vital interests or those of another person; or
e) processing is necessary for the legitimate operational interests of MBHS.
8. SHARING OF INFORMATION
8.1 We share only the specific information necessary for each purpose below, not your complete medical record, unless stated otherwise. We may share personal information with:
a) healthcare professionals directly involved in your treatment, who may access your full clinical record to the extent necessary to treat you safely;
b) your medical aid scheme or insurer, limited to billing-related information (diagnosis, procedure, and charge details) needed to process your claim;
c) regulatory and statutory bodies (e.g. HPCZ, Ministry of Health), only where a specific legal or reporting obligation requires it; and
d) authorised service providers acting on our behalf (e.g. our electronic medical records system provider, IT support, or laboratory partners), limited to what each provider needs to perform its specific function, and only under a signed data processing agreement.
8.2 We do not sell your personal information, and we do not share it with third parties for marketing purposes.
9. CROSS-BORDER TRANSFERS
9.1 We may transfer personal information outside Zambia where necessary for the provision of services, such as through systems operated or supported by service providers located abroad.
9.2 Where personal information is transferred outside Zambia, we shall ensure that appropriate safeguards are in place and that the transfer complies with the Act.
10. DATA SECURITY
10.1 We maintain appropriate physical, technical, and organisational safeguards to protect personal information against unauthorised access, disclosure, loss, misuse, alteration, or destruction.
10.2 Access to personal information is restricted to authorised personnel who require it for legitimate purposes.
11. DATA BREACH MANAGEMENT
11.1 We maintain procedures for identifying, investigating, managing, and responding to actual or suspected personal data breaches.
11.2 We will notify the Data Protection Commissioner within 24 hours, and notify you as soon as practicable, if a security breach affects your information.
12. RETENTION OF INFORMATION
11.1 We maintain procedures for identifying, investigating, managing, and responding to actual or suspected personal data breaches.
11.2 We will notify the Data Protection Commissioner within 24 hours, and notify you as soon as practicable, if a security breach affects your information.
13. YOUR RIGHTS
13.1 Subject to the Act, you have the following rights in relation to your personal and health information:
a) Right to Access: you can ask us to confirm whether we are processing your medical data and obtain a copy of your health records;
b) Right to Rectification: you can request correction of inaccurate or incomplete medical information;
c) Right to Erasure: you can ask for your data to be deleted under specific circumstances, though exceptions apply for ongoing medical treatment or legal retention requirements;
d) Right to Restrict Processing: you can request limits on how we use your health data, for example during disputes over accuracy;
e) Right to be Informed: you must receive clear information about who is collecting your health data, why it is processed, and who it is shared with;.
f) Right to Data Portability: you can obtain your health records in a structured format to transfer them to another healthcare provider; and
g) Right to Object: you can object to the processing of your personal health data in certain specific situations.
13.2 We will not treat you differently or affect your care because you have raised a concern or exercised any of these rights.
13.3 Requests relating to your personal data may be submitted to MBHS's Data Protection Officer using the contact details in Section 18.
14. CONFIDENTIALITY OF PATIENT RECORDS
14.1 Patient information and medical records are confidential.
14.2 Access to patient records is restricted to authorised personnel and other persons permitted by law or authorised by the patient.
14.3 MBHS maintains appropriate safeguards to ensure the confidentiality, integrity, and availability of patient information.
15. LEGAL PROCEEDINGS AND COURT ORDERS
15.1 Under the Act, your information may only be processed in connection with legal proceedings where:
a) it is done under the supervision of a public body discharging its duty, where necessary for those proceedings;
b) it is necessitated by litigation; or
c) it is processed by a legal practitioner to the extent necessary to protect their client’s interests
16. COMPLAINTS
16.1 If you believe that your personal data has been processed unlawfully or that your rights have been infringed, you may submit a complaint to MBHS using the contact details in Section 18.
16.2 You also have the right to lodge a complaint with the Office of the Data Protection Commissioner.
17. CHANGES TO THIS PRIVACY NOTICE
17.1 MBHS may amend this Privacy Notice from time to time, including to reflect changes in our practices or in the law.
17.2 Where we make a material change, the updated notice will apply to information held about you going forward. The current version of this notice is always available on request at any MBHS facility.
18. HOW TO REACH US
18.1 If you have questions about this notice or wish to exercise any of your rights, please contact:
Data Protection Officer, Mary Begg Health Services
Email: mbachi.kaonga@marybegg.com