Referring clinician Access to our PACS system

Protection Of Personal Information Consent: Access to XERO Viewer software

1. This agreement will apply to all personal information as defined in the Protection of Personal Information Act, 4 of 2013 (“POPI”).
2. By either Party submitting any personal information to the other, the disclosing Party unconditionally and voluntarily consents to the processing of the submitted personal information for any and all purposes related to this agreement.
3. The Parties agree and consent that their personal information may be processed by, or on behalf of either of the Parties for the purposes set out in the Agreement.
4. The Parties shall at all times comply with its obligations and procure that each of its Affiliates comply with their obligations under POPI.
5. The Parties shall ensure that any personal information that is processed by it in the course of performing its obligations under the Agreement is done in accordance with POPI.
6. Each Party shall not process, disclose, or use personal information except:
   6.1. to the extent necessary for the provision of Services and/or Products under the Agreement; or
   6.2. to fulfil their own obligations under the Agreement; or
   6.3. as otherwise expressly authorised by the other Party in writing.
7. Each Party shall not disclose any personal information to any Third Party without the other Party’s prior written consent in each instance, other than to the extent required by any Regulator or Law.
8. In the event the other Party provides such consent necessary for the disclosure of personal information to a Third Party, each Party shall:
   8.1. make such disclosure in compliance with POPI; and
   8.2. enter into a written agreement with the applicable Third-Party recipient of such personal information that requires such Third Party to safeguard the personal information in a manner no less restrictive than each Party’s obligations under these terms.
9. The Parties shall implement and maintain effective security safeguards that include but are not limited to administrative, technical, and physical safeguards, and appropriate technical and organisational measures, in each case, adequate to ensure the security and confidentiality of personal information, and to protect against any anticipated risks to the security or integrity of personal information, protect against unauthorized access to or use of personal information, protect personal information against unlawful processing or processing otherwise than in accordance with this agreement, and protect against accidental loss, destruction, damage, alteration or disclosure of personal information.
10. Without limiting the foregoing, such safeguards and measures shall be appropriate to protect against the harm that may result from unauthorised or unlawful processing, use or disclosure, or accidental loss, destruction, or damage to or of Personal Information and the nature of the personal information, and shall maintain all safeguard measures as is required by POPI.
11. Each Party shall not use, process, store, transfer or permit access to any personal information across the borders of South Africa, without the written consent of the other Party.
12. In the event of any actual, suspected, or alleged security breach, including, but not limited to, loss, damage, destruction, theft, unauthorized use, access to or disclosure of any personal information, each Party shall:
    12.1 notify the other Party as soon as practicable after becoming aware of such event.
    12.2 provide the other Party will all information regarding the breach in the Party’s knowledge and possession to allow the Party to ascertain what has occurred and which personal information has been affected.
    12.3 promptly take whatever action is necessary, at each Party’s own expense, to minimise the impact of such event and prevent such event from recurring.
13. The Client hereby consents to the Company sharing the personal information as provided for herein cross border. Should the Client’s personal information be shared cross border, the personal information will not be subject to less protection than it enjoys in terms of South Africa’s data privacy laws.