Overview & Introduction

The East New Britain Provincial Health Authority (ENBPHA) is committed to protecting the privacy and personal information of all individuals who interact with our services, visit our website, or engage with our health programs across East New Britain Province.

This Privacy Policy describes how ENBPHA collects, uses, stores, discloses, and protects personal information in accordance with the Papua New Guinea Privacy and Data Protection Framework and applicable national legislation. It applies to all information collected through our website (enbpha.gov.pg), our health information systems, our patient management systems, and through any direct interactions with ENBPHA staff and services.

By accessing our website or using our services, you acknowledge that you have read and understood this Privacy Policy. ENBPHA encourages you to read this policy carefully and contact us if you have any questions.

Information We Collect

ENBPHA collects personal information only where it is necessary to deliver health services, improve our programs, or fulfil our public health mandate. The types of information we may collect include:

Personal Identification Information

• Full name, date of birth, gender, and National Identification Number (NID)
• Contact details — physical address, postal address, telephone number, and email address
• Village, ward, district, and provincial location details
• Emergency contact information and next of kin details

Health and Clinical Information

• Medical history, diagnoses, treatment records, and clinical notes
• Immunisation records, antenatal and postnatal health data
• Laboratory test results, radiology reports, and pharmacy dispensing records
• HIV status, TB treatment records, and other sensitive health data where relevant to care
• Disability status and rehabilitation service records

Website and Digital Usage Information

• IP address, browser type, operating system, and device information
• Pages visited, links clicked, and time spent on the ENBPHA website
• Referral source and search terms used to reach our website
• Forms submitted or enquiries sent through the website

Staff and Workforce Information

• Employee identification details, qualifications, and employment records
• Payroll information, leave records, and performance data
• Training and professional development records

How We Use Information

ENBPHA uses personal information only for lawful purposes directly related to our mandate as the provincial health authority. Specifically, we use personal information to:

• Provide, manage, and improve health services and clinical care for patients across East New Britain Province
• Maintain accurate health records and support continuity of care across health facilities
• Monitor public health trends, conduct disease surveillance, and respond to outbreaks
• Plan and allocate health resources, workforce, and medical supplies across the four districts
• Report aggregate (de-identified) health data to the National Department of Health as required
• Administer ENBPHA's workforce, payroll, and human resource management systems
• Respond to enquiries, complaints, and feedback from members of the public
• Improve the functionality and user experience of the ENBPHA website
• Fulfil legal, regulatory, and audit obligations under Papua New Guinea law

ENBPHA will not use personal information for any purpose other than the one for which it was collected, except with your consent or as required or permitted by law.

Sharing of Information

ENBPHA does not sell, rent, or trade personal information to third parties. We may share personal information only in the following circumstances:

• With other health facilities and providers: To support continuity of care and patient referrals within the ENBPHA health system and to other health providers involved in your care
• With the National Department of Health: For mandatory health reporting, disease surveillance, program monitoring, and national health planning — in aggregate or de-identified form wherever possible
• With development partners: Where required for program delivery, evaluation, or research, subject to data sharing agreements and participant consent
• With government agencies: Where required by law, court order, or legitimate regulatory authority in Papua New Guinea
• With health system contractors and service providers: Who assist ENBPHA in delivering services, subject to confidentiality obligations
• In a public health emergency: Where disclosure is necessary to protect public health, prevent serious harm, or respond to a disease outbreak

All sharing of personal information is subject to appropriate safeguards and is limited to what is strictly necessary for the stated purpose.

Cookies & Website Tracking

The ENBPHA website (enbpha.gov.pg) may use cookies and similar tracking technologies to improve your browsing experience, understand how visitors use our website, and ensure the website functions correctly.

Types of cookies we may use:

• Essential cookies: Necessary for the website to function properly — these cannot be disabled
• Analytics cookies: Help us understand how visitors interact with our website so we can improve it (e.g. Google Analytics — data collected is anonymous and aggregated)
• Preference cookies: Remember your settings and preferences for future visits

You may disable cookies through your browser settings. Please note that disabling certain cookies may affect the functionality of some parts of the website. ENBPHA does not use cookies to collect personally identifiable information without your knowledge.

Data Security

ENBPHA takes the security of personal information seriously. We implement reasonable technical, administrative, and physical safeguards to protect personal information from unauthorised access, use, disclosure, alteration, or destruction. These measures include:

• Restricted access to personal information — only authorised staff with a legitimate need can access personal health and administrative data
• Password-protected and encrypted health information systems
• Physical security controls for records stored at ENBPHA facilities
• Staff training on privacy obligations and confidentiality requirements
• Regular review of our data security practices and systems

While ENBPHA takes all reasonable precautions, no data transmission or storage system is completely secure. If you have reason to believe that your personal information has been compromised, please contact us immediately at info@enb.gov.pg.

Data Retention

ENBPHA retains personal information for as long as it is necessary to fulfil the purpose for which it was collected, or as required by law. Specifically:

• Patient health records are retained in accordance with the PNG National Health Records Retention Schedule and applicable provisions of the Public Hospitals Act
• Employee and workforce records are retained for the duration of employment and for a defined period thereafter in accordance with the Public Services (Management) Act
• Website usage data is retained for a period of up to 24 months for analytical purposes, after which it is deleted or anonymised
• Correspondence and enquiry records are retained for a minimum of seven years in accordance with national archives requirements

When personal information is no longer required, ENBPHA will take reasonable steps to destroy or permanently de-identify it in a secure manner.

Your Rights

Individuals whose personal information is held by ENBPHA have the following rights, subject to applicable law:

• Right of access: You may request a copy of the personal information ENBPHA holds about you
• Right of correction: If you believe the information we hold is inaccurate, incomplete, or out of date, you may request that it be corrected
• Right to withdraw consent: Where processing is based on your consent, you may withdraw consent at any time — this will not affect any processing already carried out
• Right to complain: You have the right to lodge a complaint with ENBPHA or with the relevant regulatory authority if you believe your privacy rights have been breached

To exercise any of these rights, please submit a written request to ENBPHA using the contact details provided in Section 12 of this Policy. ENBPHA will respond to all valid requests within 30 working days.

Children's Privacy

ENBPHA provides essential health services to children as part of its core mandate — including immunisation, maternal and child health, and paediatric care. Health information relating to children is collected and handled with the highest level of care and confidentiality.

Where personal information about a child is collected, it is done so with the knowledge and consent of a parent or legal guardian, except where the disclosure is necessary to protect the health or safety of the child. Children's health records are subject to the same security and retention standards as adult records.

The ENBPHA website does not knowingly collect personal information directly from children under the age of 18. If you believe a child has submitted personal information through our website without parental consent, please contact us at info@enb.gov.pg so we can take appropriate action.

Third-Party Links

The ENBPHA website may contain links to external websites operated by third parties, including the National Department of Health, partner organisations, and development agencies. These links are provided for your convenience and information only.

ENBPHA does not control and is not responsible for the privacy practices or content of any external websites. We encourage you to review the privacy policy of any third-party website you visit. The inclusion of a link on the ENBPHA website does not imply endorsement of that website or its content by ENBPHA.

Changes to This Policy

ENBPHA may update this Privacy Policy from time to time to reflect changes in our practices, legal obligations, or the services we provide. When we make significant changes, we will update the "Last Updated" date at the top of this page and, where appropriate, notify users through the ENBPHA website or other communication channels.

We encourage you to review this Privacy Policy periodically to stay informed about how we are protecting your personal information. Continued use of ENBPHA's website or services after any changes to this policy constitutes your acceptance of the updated terms.

Contact Us

If you have any questions, concerns, or requests relating to this Privacy Policy or to the way ENBPHA handles your personal information, please contact us using the details below.