Privacy Policy

The Blood Donors Association (the "Association", "we", "us", or "our") is committed to protecting your privacy and personal data. This Privacy Policy outlines how we collect, use, store, and protect your personal data in accordance with the Data Protection Act 2017 (DPA 2017) of Mauritius and applicable regulations enforced by the Data Protection Office (DPO) of Mauritius.

By creating an account and using our application, you acknowledge that you have read and understood this Privacy Policy.

When you register for and use our application, we may collect and store personal data that you voluntarily provide: General Personal Data: Full name, email address, telephone number, and date of birth.

Special Category Data (Sensitive Personal Data): Blood group and donor history.

Under Section 2 of the DPA 2017, data concerning health (such as your blood group) is classified as Special Category Personal Data and is afforded higher levels of security and legal protection.

We process your personal data strictly under the following lawful bases pursuant to Sections 28 and 29 of the DPA 2017:

Explicit Consent: By registering, you provide your explicit consent for us to collect and process your health-related data (blood group) solely to connect you with blood donation opportunities and manage your donor profile.

Legitimate Interest & Public Health: Processing is necessary to facilitate voluntary blood donation drives and fulfill our organizational objectives in support of public health in Mauritius.

Legal Obligation: Where retention or disclosure is required by Mauritian law.

Your personal data is collected and used strictly for:

• Managing your user account and donor profile.
• Contacting you for urgent blood donation needs or scheduled donation drives.
• Verifying donor eligibility based on age and health criteria.
• Improving the functionality and security of the application.
• We do not sell, rent, or trade your personal data to third parties for commercial or marketing purposes.

In compliance with Section 31 of the DPA 2017, we implement robust technical and organizational measures to safeguard your personal data against unauthorized access, disclosure, alteration, loss, or destruction. These measures include:

• End-to-end encryption of sensitive health data in transit and at rest.
• Strict role-based access controls limiting data visibility to authorized personnel only.
• Regular security audits and vulnerabilities assessments.

We retain your personal data only for as long as necessary to fulfill the purposes outlined in this Policy, or to comply with statutory retention requirements under Mauritian law. Once your data is no longer required, it will be securely destroyed or anonymized.

You have the right to withdraw your consent and request the permanent deletion of your account and personal data at any time.

In-App Deletion: You can initiate deletion directly via the Delete Account option in the application settings.

Email Request: Contact our Data Protection Officer at blooddonorsoffice@gmail.com

Upon confirmation of your request, your personal data including your name, email address, telephone number, date of birth, and blood group will be permanently erased from our active databases and third-party processors acting on our behalf. Certain records may be retained temporarily where required by applicable Mauritian law or legal defense obligations.

If any of your personal data is stored or processed on cloud servers located outside Mauritius (e.g., AWS, Google Cloud), we ensure compliance with Section 36 of the DPA 2017. Transfers outside Mauritius occur only to jurisdictions providing an adequate level of data protection or where appropriate contractual safeguards (such as Standard Contractual Clauses) are in place.

Under the Data Protection Act 2017, you hold the following rights regarding your personal data:

• Right of Access (Section 37): Request a copy of the personal data we hold about you.
• Right to Rectification (Section 38): Request correction of inaccurate or incomplete personal data.
• Right to Erasure / Right to be Forgotten (Section 39): Request deletion of your personal data.
• Right to Object / Withdraw Consent (Section 40): Withdraw your consent to data processing at any time without affecting prior lawful processing.
• Right to Restrict Processing: Limit how we process your data under specific circumstances.
• To exercise any of these rights, please contact us at blooddonorsoffice@gmail.com.

If you believe that your personal data has been processed in violation of the DPA 2017 or that your rights have been infringed, you have the right to lodge a complaint with the Data Protection Office of Mauritius.

We may update this Privacy Policy periodically to reflect changes in our legal obligations or application features.

If you have any questions or suggestions about our Privacy Policy, do not hesitate to contact us at blooddonorsoffice@gmail.com.