Your treatment consent and marketing choices are separate. Closing membership or deactivating consent does not automatically delete treatment history.
About this policy
Harmony Health & Wellness ("Harmony", "we", "our") respects your privacy. This policy explains how we handle personal information through harmonyhealthsz.com, appointment and survey forms, and our patient management information system (MIS). It also covers information provided during care and related administration.
Contact and location
For privacy questions, access requests or complaints, contact [email protected] or +268 76383349. Our published location is Shop No. 17, The Hub, Manzini, Eswatini; postal address: P.O. Box 3516, Manzini. Please do not send full medical records in an initial email. We may verify your identity before discussing records.
Information we collect
Depending on your interaction, we collect contact and identity details, appointment information, relevant health and treatment history, consultation notes, signed consent records, and service feedback. Representative details may be needed where someone acts for a patient. Website providers may also process technical information such as IP addresses and browser details. We request information relevant to the purpose and explain when information is necessary for care or administration.
Why we use information
We use information to respond to enquiries, arrange appointments, assess and deliver care, record treatment and consent, administer patient services, maintain security, and meet applicable obligations. Optional surveys help us understand service needs and improve services. We do not treat participation in a survey as consent to unrelated uses.
Legal grounds and sensitive information
Processing must have an applicable lawful basis under the Eswatini Data Protection Act, 2022. Depending on the purpose, this may include consent, performance of an agreement, a legal obligation, or another permitted basis. Health information receives additional protection and is handled under applicable provisions for sensitive information and healthcare, including confidentiality requirements. Treatment consent, privacy choices and marketing permission are separate.
Consent recorded in the MIS
Treatment consent is signed and stored in the MIS and can be printed when needed. Consent status may be deactivated under our 30-day follow-up inactivity process. Deactivation does not delete the historical signed form or treatment history. The practitioner reviews the consent position before further treatment and obtains fresh consent where required. Patients may discuss, decline or withdraw consent to future treatment with the practitioner.
Sharing and service providers
Information may be accessed by authorised personnel and service providers only for their relevant functions, or shared where authorised or required by law. Where another healthcare provider is involved, information is shared only on an appropriate lawful basis. Our website references Google Fonts and reCAPTCHA, which may involve third-party processing of technical information. Providers and international transfers must be assessed against applicable data-protection requirements; using this website is not blanket consent to overseas processing.
Retention and membership closure
Closing membership does not automatically erase clinical records. Treatment history and signed consent records may remain necessary for applicable legal and professional obligations, continuity of care or the establishment, exercise or defence of legal claims. Membership alone does not justify indefinite storage. Retention is reviewed according to purpose and applicable requirements, with secure deletion or anonymisation when continued retention is no longer justified.
Testimonials, surveys and marketing
Only service testimonials and survey feedback may be used as marketing content. Identifiable content requires separate, optional permission; survey findings are presented anonymously unless separate permission is obtained. Clinical files and treatment consent forms are not used for marketing. Refusing publicity does not affect access to care. Where you separately choose promotional communications, you may opt out by contacting our privacy email. Withdrawal applies to future consent-based use, not the lawfulness of earlier use.
Your rights and requests
Subject to applicable law and exceptions, you may request access to your information, correction of inaccurate information, or deletion where retention is no longer justified. You may withdraw consent for processing that relies on consent and object to direct marketing. We explain any lawful reason for retaining information or declining a request and respond within applicable statutory time limits. You may complain to the Eswatini Data Protection Authority; see Eswatini Data Protection Authority.
Children and representatives
When a child or another patient requires a representative, we verify the representative's authority and follow applicable consent and confidentiality requirements. We do not assume that a family relationship alone permits unrestricted access to records. Questions about representative access should be directed to the clinic.
Security, incidents and updates
We use safeguards appropriate to the sensitivity of information and restrict access to authorised purposes. No system can be guaranteed completely secure. We assess suspected breaches and notify the regulator and affected people where required by law. Material changes to this policy will be identified with an updated date and any additional notice or consent required by law.