Your Data
Under the Data Protection and Privacy Act, 2019 of Uganda (the “Act”), you have rights over the personal data that organisations hold about you. This page explains:
- what those rights are;
- how to use them with Diagnovis Technologies Limited (“Diagnovis”, “we”, “us” or “our”); and
- what to expect when you make a request.
It also explains where to go if you are a patient at a hospital or clinic that uses DiagnovisAI. For full details of how we handle personal data, see our Privacy Notice.
On this page
- What personal data we may hold about you
- Your rights
- How to make a request
- Confirming your identity
- Requests made on someone else’s behalf
- How long we take, and cost
- When we may not be able to do what you ask
- If you are a patient
- If you take part in research
- If you are a DiagnovisAI user
- Complaints
- Contact us
1. What personal data we may hold about you
Depending on how you have dealt with us, we may hold:
- your name and contact details, organisation and role, if you have contacted us, requested a demo or worked with us;
- emails, messages and notes of calls or meetings with you;
- records of agreements and business dealings with you or your organisation;
- your marketing preferences; and
- basic technical information recorded by our web server when you visited the Website, such as your IP address.
We do not collect patient information through the Website. Patient information processed through DiagnovisAI is held for, and controlled by, the hospital or clinic concerned. See section 8.
2. Your rights
Right of access
You can ask us to confirm whether we hold personal data about you. If we do, you can ask for:
- a copy of it;
- a description of what it is and why we hold it;
- who we have shared it with; and
- where we got it from, if not from you.
We will usually provide the copy electronically, in a commonly used format, unless you ask for it in another way.
Right to correction
You can ask us to correct personal data that is inaccurate, out of date, incomplete, irrelevant or misleading. We will correct it, or, if we disagree, explain why and record that you have disputed it. Where we have shared the data with others, we will tell them about the correction where practicable.
Right to deletion
You can ask us to delete or destroy personal data that we no longer have a lawful reason to keep. For example, this applies where it is no longer needed for the purpose we collected it for, or where you have withdrawn the consent we relied on. Where we cannot delete data because the law requires us to keep it, we will tell you and keep it only for that purpose.
Right to object
You can ask us to stop, or not to begin, processing your personal data where this causes, or is likely to cause, unwarranted substantial damage or distress to you or another person. Please explain why in your request. We will either stop or explain why we believe we are entitled to continue.
Right to stop direct marketing
You can tell us at any time to stop sending you marketing. We will stop promptly and keep a record of your choice so that we continue to respect it. Every marketing email we send includes an opt-out.
Rights about automated decisions
You have the right not to be subject to a decision based solely on automated processing that significantly affects you. We do not make such decisions about Website visitors, enquirers or business contacts. In DiagnovisAI, the AI prepares a draft report. A radiologist reviews and signs off each report before it is released.
Right to withdraw consent
Where we rely on your consent, you can withdraw it at any time. This does not affect anything we did before you withdrew it.
Right to complain
You can complain to the Personal Data Protection Office about how we handle your personal data. See section 11.
3. How to make a request
Send your request by email to hello@diagnovisai.com with the subject line “Data request”, or in writing to our office at the address in section 12, marked “For the attention of the Data Protection Officer”. You can also call us on +256 200 917 813. We may ask you to confirm a phone request in writing.
To help us deal with your request quickly, please include:
- your full name and how we can contact you;
- which right or rights you want to use;
- details that will help us find your data, such as the email address or phone number you used to contact us, your organisation, and approximate dates; and
- for a correction, what is wrong and what it should say; for an objection, why the processing affects you.
Here is a simple example you can copy:
Subject: Data request
My name is [your name]. I contacted Diagnovis using [email address / phone number] around [month and year]. Under the Data Protection and Privacy Act, 2019, I would like to [see a copy of the personal data you hold about me / correct … / have my data deleted / stop receiving marketing]. You can reach me at [contact details].
4. Confirming your identity
To protect your personal data, we need to be sure that we are dealing with you before we disclose, change or delete anything. Usually we can do this by replying to the email address or phone number we already hold for you.
If that is not possible, we may ask for further information to confirm your identity. We will ask only for what is reasonably necessary, and we will use it only to verify your request. The time for our response starts when we have confirmed your identity.
5. Requests made on someone else’s behalf
You can ask someone else, such as a lawyer or a relative, to make a request for you. They will need to give us your written authority, and we may also need to confirm your identity.
A parent or guardian may make a request on behalf of a child under 18. A person with legal authority may act for someone who is unable to act for themselves. In each case, we will ask for evidence of that authority.
6. How long we take, and cost
- We will acknowledge your request promptly. We will respond in full within 30 days of receiving a complete request and any information we need to confirm your identity.
- If your request is complex, we may need more time. If so, we will tell you within the 30 days, explain why, and give you a date by when we will respond, within any period the law allows.
- Making a request is free. If a request is clearly unfounded or excessive, for example because it is repeated, we may charge a reasonable fee for our administrative costs, where the law allows, or decline to act. We will explain our reasons.
7. When we may not be able to do what you ask
Your rights are important, but they are not always absolute. Ugandan data protection law allows, and sometimes requires, us to refuse or limit a request. Examples include where:
- providing the data would reveal personal data about another person, unless they agree or it is reasonable to disclose without their agreement;
- the data is subject to legal professional privilege;
- we must keep the data to comply with a legal obligation, or need it to establish, exercise or defend legal claims; or
- disclosure would prejudice the prevention or detection of crime, or other interests protected by law.
If we refuse or limit your request, we will tell you which parts we cannot act on and why, unless the law prevents us from doing so. We will also remind you of your right to complain to the PDPO.
8. If you are a patient
Hospitals and clinics may use DiagnovisAI to support their radiologists in reading X-ray, CT and MRI studies. When they do:
- The hospital or clinic is in charge of your health information. It is the data controller. It decides how your imaging studies and reports are used, under its own policies and Ugandan law.
- Diagnovis works on the hospital’s behalf. We, and where applicable our licensed implementation partner, process your information only on the hospital’s instructions, under a written agreement with data protection and security obligations.
- A radiologist is responsible for your report. DiagnovisAI prepares a draft report. A radiologist reviews and signs it off before it is released to the team treating you.
- Your information is not sold or used for advertising. It is used for research or to improve our software only where the hospital’s agreement allows it and all required ethics and regulatory approvals are in place. In those cases it is de-identified first.
How to use your rights as a patient. If you want to see, correct or ask questions about your health information, please contact the hospital or clinic where you had your scan. It holds your records and is best placed to help.
If you contact us instead, we will:
- pass your request to the hospital or clinic, with your agreement; and
- help it respond, as our agreement with it requires.
Please do not send us medical images, reports or health details by email. If we need any information from you to deal with your request, we will arrange a secure way to receive it.
9. If you take part in research
Studies that evaluate DiagnovisAI are carried out only with approval from an accredited research ethics committee and any other required authorities. If you take part in, or your data is used in, such a study, the information sheet and consent form for that study explain:
- how your data is used and protected;
- who is responsible for it; and
- how to withdraw.
You can contact the study team named in those documents, or us, with any question.
10. If you are a DiagnovisAI user
If you use DiagnovisAI as a radiologist or member of clinical staff, your account and activity information is processed under your Institution’s agreement with us. For access to or correction of your account information, contact your Institution’s system administrator or us. We will work with your Institution to respond.
11. Complaints
If you are unhappy with how we have handled your personal data or your request, please tell us first. Contact our Data Protection Officer using the details below. We will look into your concern and respond.
You also have the right to complain to the regulator at any time:
Personal Data Protection Office
Website: pdpo.go.ug
12. Contact us
Diagnovis Technologies Limited
For the attention of the Data Protection Officer
Enjuuba Loop, Bukoto, Kampala, Uganda
Email: hello@diagnovisai.com (subject line “Data request”)
Phone: +256 200 917 813