This Privacy Policy explains how Infectious Diseases Research Laboratory (IDRL) ("we", "us", "our") at www.idrllab.com collects, uses, shares and safeguards personal data when you interact with our services. We are committed to the principles and obligations under Zimbabwe's Cyber and Data Protection Act [Chapter 12:07] ("CDPA") and Statutory Instrument 155 of 2024 ("SI 155"), including lawfulness, transparency, purpose limitation, data minimisation, accuracy, storage limitation, integrity/confidentiality and accountability.
1. Purpose and Scope
This Policy applies to all personal data processed by IDRL through any means, including diagnostic laboratory testing, clinical trial sample analysis, biospecimen management, viral sequencing, employment relationships, and website interactions. It covers data from:
- Patients and research participants (sample donors)
- Employees and consultants
- Community members
- Suppliers, vendors, and research collaborators
- Website visitors
2. What We Collect
- Personal and demographic data: name, national ID, address, age, gender, phone number, next of kin
- Clinical and laboratory data: medical records, diagnostic test results (haematology, biochemistry, serology, immunology, molecular biology, microbiology), biometrics, consent forms
- Genetic data: genomic sequencing data (HIV, SARS-CoV-2, HPV), HLA typing, drug resistance profiles
- Biospecimen data: sample identifiers, chain-of-custody records, cryopreservation logs, barcode tracking
- Employment data: bank details, tax records, payroll information, qualifications, employment history
- Supplier data: contact details, banking information for invoicing
- Website data: IP address, browser type, geographic location
3. Lawful Bases Under the CDPA
- Consent: informed, specific, freely given consent, which may be withdrawn at any time without prejudice (Sections 10(1), 11(1)-11(2), CDPA)
- Contractual necessity: to perform employment contracts, clinical trial agreements, and supplier contracts
- Legal obligation: compliance with MCAZ, MRCZ, MDPCZ, POTRAZ, ZIMRA, Labour Act, Income Tax Act, and other statutory requirements
- Vital interests: to protect the life or health of the data subject (Section 10(3)(c))
- Public interest: scientific and public health research subject to ethical approvals (Section 10(3)(d))
- Legitimate interest: operational management where not overridden by data subject rights (Section 10(3)(e))
4. How We Use Personal Data
- Diagnostic testing: haematology, biochemistry, serology, immunology, molecular biology, microbiology, urinalysis, toxicology
- Clinical research: sample analysis for clinical trials, endpoint support (viral load, HIV PCR, safety labs)
- Viral sequencing: HIV, SARS-CoV-2, HPV drug resistance and transmission pattern analysis
- Biospecimen management: PBMC isolation, cryopreservation, biobanking with chain-of-custody
- Participant verification: biometric identity verification to prevent duplicate enrolment
- HR and payroll: employment administration, salary processing, statutory deductions
- Regulatory compliance: submissions to MCAZ, MRCZ, MDPCZ, and POTRAZ
- Quality management: ISO 15189:2022-aligned QMS, CAP pathway, audit trail maintenance
- Financial management: procurement, invoicing, and accounts management
5. Sensitive Personal Data
IDRL processes the following sensitive data categories under Sections 11 and 12 of the CDPA, with written consent and/or under applicable exceptions (scientific research, public health, vital interests):
- Race and ethnic origin (ensuring diverse representation in clinical research)
- Genetic and biometric information (core laboratory function: genomic sequencing, viral genotyping, HLA typing; premises access)
- Health status (diagnostic testing, disease monitoring, treatment response tracking)
- Sexual life or family details (STI research, HIV transmission patterns, contact tracing)
- Social origin (assessing barriers to healthcare and research participation)
- Medical records (comprehensive patient history for test suitability and continuity of care)
Children's data: Where diagnostic testing or clinical trials involve minors, processing is conducted per MRCZ-approved protocols with parental/guardian consent (Section 26, CDPA; SI 155, s.10(5)).
6. Data Sharing and Disclosure
- Regulatory authorities (MCAZ, MRCZ, POTRAZ, ZIMRA) as required by law
- Ethics committees for ongoing study oversight
- Study sponsors and their contracted CROs under Data Processing Agreements
- Collaborating research institutions and referring clinicians under binding agreements
- ACRN/Mutala group entities for shared clinical trial operations
- Data processors acting under our instruction (see Section 8)
We do not sell personal data. All third parties receiving personal data must sign a Data Processing Agreement (DPA) including confidentiality, prohibition on secondary use, audit rights, breach notification, and return-or-destroy clauses (Section 18(5), CDPA; SI 155, s.10(4)(f)).
7. International Data Transfers
IDRL does not currently transfer personal data outside Zimbabwe. All data is processed and stored within Zimbabwe. Should cross-border transfers become necessary, they will be conducted in accordance with Sections 28 and 29 of the CDPA with prior authorisation from the Data Protection Authority.
All processors are contractually required to maintain appropriate security, process only as instructed, and return or destroy data upon contract termination.
8. Data Security
IDRL implements appropriate technical and organisational measures to safeguard personal data (Section 18, CDPA; SI 155, s.16), including:
- Role-based access control (RBAC) with principle of least privilege across LIMS and all digital systems
- Multi-factor authentication (MFA) for all critical system access
- AES-256 encryption at rest; SSL/TLS encryption in transit
- Biometric access scanners and keycard entry to all laboratory areas
- CCTV surveillance with footage retention at all access points
- Secure biospecimen storage: monitored, alarm-equipped, access-controlled freezers with chain-of-custody
- LIMS automation reducing manual data entry errors; barcode sample tracking from collection to disposal
- Comprehensive audit trails (tamper-proof) in LIMS and Freezerworks
- Data integrity measures adhering to ALCOA++ principles
- Mandatory security awareness training for all laboratory personnel
- Periodic security audits and CAP self-inspection readiness activities
A data breach response plan is in place. Breaches are reported to POTRAZ within 24 hours (SI 155, s.17(1)) and affected data subjects notified within 72 hours where high risk exists (SI 155, s.17(3)).
9. Data Retention
Personal data is retained only as long as necessary, per our Data Retention Policy (POL-DPO-002) and the storage limitation principle (Section 7(1)(c), CDPA):
- Clinical trial/laboratory data: 25 years from study close-out
- Diagnostic test results: 10 years (Public Health Act [15:17] s.38)
- Employee records: 6 years from termination
- Financial/tax records: 6 years from end of tax year
- Supplier records: 6 years from end of contract
- Biometric data: deleted upon separation from employment
- CCTV footage: 30 days (auto-overwrite)
- Biospecimen records: duration of study + 25 years or as directed by sponsor
These periods may be extended under a legal hold. Upon expiry, data is securely destroyed (cross-cut shredding; cryptographic erasure; autoclaving for biospecimens). Destruction logs are maintained as permanent audit evidence.
10. Exercise Your Rights
Under the CDPA, you have the right to:
- Be informed about the collection and use of your personal data
- Access your personal data held by IDRL
- Correct inaccurate or incomplete personal data
- Request deletion of data that is no longer necessary or is false/misleading
- Object to processing based on legitimate interests or direct marketing
- Restrict processing in specific circumstances
- Withdraw consent at any time, without explanation and free of charge
- Receive your data in a portable, machine-readable format
- Not be subject to solely automated decisions producing legal effects
- Deactivate, block, anonymise, or delete your data as appropriate
To exercise any of these rights, contact our Data Protection Officer at dpo@acrnhealth.com or +263783507641. We will acknowledge requests within 7 days and respond substantively within 30 days.
11. How to Contact Us
For privacy questions, concerns, or data subject requests:
Data Protection Officer: Tatenda Magetsi (DPO 000754)
- Email: dpo@acrnhealth.com
- Phone: +263783507641
- Mail: 52 Alpes Road, Vainona, Harare, Zimbabwe
General Enquiries: takudzwa.magwaku@acrnhealth.com | +263 77 762 8465
12. Updates to This Policy
We may update this Policy periodically. Material changes will be communicated via our website or directly to affected individuals. The date above indicates when this Policy was last reviewed. This Policy is reviewed at least annually or upon changes to the CDPA, SI 155, POTRAZ guidance, or our processing activities.
13. Governing Law
This Policy is governed by the laws of Zimbabwe, principally the Constitution (Section 57), the Cyber and Data Protection Act [Chapter 12:07], SI 155 of 2024, POTRAZ Guidelines. POPIA and GDPR serves as regional and international comparators.