Privacy policy

This notice explains how personal information is handled on the EMILIA study CPD assessment website. It is written for the Protection of Personal Information Act 4 of 2013 (POPIA). Anything shown as [PLACEHOLDER: ...] is a fact we do not yet hold and will be filled in before launch. A shorter summary is on the POPIA compliance page.

What personal information we collect

• Full name
• MP number
• Email address
• Contact number, only if you give it
• Roche PJP/Rep, only if you give it
• Your answers to the assessment, and the resulting score and pass or fail
• The time of submission
• Your IP address. It is recorded when you submit the form, only to limit repeated requests, and is kept for about one day. It is recorded on submission attempts only. It is also deleted in full when the retention purge runs.

For people filling in the form we use two functional cookies and nothing else: a visitor-id cookie (cpd_vid, a random code that is not linked to you) and a CSRF cookie (cpd_csrf, which protects the form from forged submissions). On the live site both names start with __Host-, which tells the browser to send them only over HTTPS to this site. No analytics. No tracking.

Why we collect it

By continuing, you acknowledge that your details will be processed for the EMILIA CPD study, on behalf of Roche South Africa.

We collect it to record your participation in the EMILIA study CPD assessment on behalf of Roche South Africa and to facilitate the CPD/CEU process, which carries 2 CEU points.

Responsible party

The responsible party is Roche Products (Pty) Ltd, South Africa.

• Registration number: 1947/027044/07
• Registered address: Building E, Hertford Office Park, 90 Bekker Road, Vorna Valley, Midrand, 1686. P.O. Box 1469, Halfway House, 1685.
• Telephone: +27 (0)11 504 4850
• Email: pharmasa.privacy@roche.com

Operator

Creative & Stuff runs this website for Roche and processes the information on Roche's behalf.

• Operator details: [PLACEHOLDER: Creative & Stuff registered name, address and contact details]

Who sees your information

• Authorised dashboard users at the operator, and the responsible party.
• Mailgun, which delivers our confirmation email and is a service provider. Location of processing: [PLACEHOLDER: Mailgun processing location]

How long we keep it

Entries are kept for a maximum of 1 year, then permanently deleted. The deletion date is currently set to 3 November 2027: after that date the information is permanently deleted.

The deletion covers your name, MP number, email address, contact number, Roche PJP/Rep, your answers, score and result, the time of submission, and the IP-based request counters. It is run by a scheduled job from the start of the retention date (South African time) and cannot be undone.

Backups: copies of the database kept by the hosting provider are kept for a maximum of 1 year. Information that has been deleted from the live site stays in those backup copies until they expire, so it is not gone from every copy on the day of deletion.

Server logs: the web server of the hosting provider keeps access logs that include visitor IP addresses and the pages requested. These logs are kept for a maximum of 1 year. Log entries stay in the logs until they expire, even after the information has been deleted from the live site.

Anonymous totals that cannot be linked to a person are kept: the number of entries, the number that passed, and how often each question was answered correctly.

Security measures

• The site is served over HTTPS only and sends strict security headers.
• Access to the dashboard is limited to authorised staff, who need a password and an emailed one-time code.
• The form is protected by rate limiting.
• Answers are marked on the server. The answer key is never sent to your browser.
• Encryption at rest: [PLACEHOLDER: encryption at rest, to be confirmed by hosting provider]
• Hosting location: [PLACEHOLDER: hosting location of the server and database]

Your rights

Under POPIA you may ask us for:

• access to your personal information
• correction of it
• deletion of it

You may also object to its processing, and withdraw your consent at any time. If you are not happy, you may complain to the Information Regulator (South Africa).

How to make a request: contact the Information Officer, José Da Fonseca, email jose.da_fonseca@roche.com, telephone +27 (0)11 504 4850.

Complaints contact: Kovashni Nair, email kovashni.nair@roche.com, telephone +27 (0)11 504 4850.

Information Regulator contact details: [PLACEHOLDER: Information Regulator contact details]

Information Officer

• Name: José Da Fonseca
• Email: jose.da_fonseca@roche.com
• Telephone: +27 (0)11 504 4850

Cross-border transfer

Whether personal information leaves South Africa: [PLACEHOLDER: cross-border transfer position, including Mailgun and hosting]

Last updated

Last updated: [PLACEHOLDER: date this notice was published]