Privacy
REACH Recovery Privacy Notice
REACH Recovery ("REACH") is a recovery and support programme, operating under Woord en Lewe AGS Kerk. This notice explains how we handle your personal information under South Africa's Protection of Personal Information Act (POPIA).
Information Officer
Bryan Pollen, bryan@wordandlife.com
What we collect
Your contact and identity details, emergency contact, programme and attendance records, and, where relevant to your programme, health related information such as test results and intake details.
Why
To run REACH's programmes, including matching you to the right group, arranging assessments, weekly testing where required, and tracking your progress, and to meet obligations to a referring court, employer or school where that applies to you.
Legal basis
Your consent, given at registration, and, for mandatory referral testing, our obligation to the referring authority.
How we protect it
Health related information is encrypted. Access is role based, so only staff who need it for your care can see it, and this is logged.
Who else sees it
Only the specific report a referring court, employer or school is entitled to, never your full record. Service providers who help us run REACH (email, hosting, error monitoring, payments) may process your information on our behalf, under agreement, never for their own purposes.
Your rights
You can ask to see, correct, object to or ask us to delete your information, and withdraw consent at any time, by contacting the Information Officer above. Withdrawing consent for mandatory referral testing may affect your referral. You can also complain to the Information Regulator (inforegulator.org.za).
The Reach Nexus app, messages and announcements
Members and facilitators can use the Reach Nexus app and website to see their own sessions, attendance, clean time and account, and to send messages. A private chat can only be read by the people in it. If someone reports a chat, or uses the urgent help button, our Director and Social Worker can then read that conversation, and each time they do it is logged. Messages are encrypted when stored and are deleted after 12 months unless they were reported. Announcements from REACH appear as a message in the app, and a reminder email never contains the text of a message. Members can also see their own test results in the app, but only once REACH management has released them, and only the member can see them there. If you turn on notifications on your phone, we send short alerts, such as "You have a new message", that never contain the text of a message or anyone's name. They are delivered through your phone's notification service (Google on Android, Apple on iPhone), which can see that an alert was sent but not what is in your messages. You can turn notifications off at any time in the app. To delete your account and data, see how to ask.
Retention
We keep your information for as long as you're an active participant, and as required by law afterwards.