Privacy notice.

1. Contact details

Information Officer: Francois Pretorius
Email: physiofp@gmail.com
WhatsApp: 082 415 2274
Practice telephone: 021 300 5162

2. Information we may collect

• Identity and contact information, including name, date of birth, ID/passport details where required for a claim, residential address, telephone number and email address.
• Parent, guardian, authorised-representative, responsible-payer and emergency-contact information where applicable.
• Referral and clinical information obtained during assessment and treatment, including findings, diagnoses, treatment plans, progress notes, correspondence and supporting reports.
• Medical-scheme, COIDA, RAF, insurer, claim, billing and payment information.
• Administrative communications and basic technical information generated when the website or electronic systems are used.
• Information entered in the secure electronic patient form, including the administrative, funding, account, signature and red-flag responses shown on that form.

3. Where information comes from

Information is usually obtained directly from the patient or an authorised representative. Where lawful and relevant, it may also be received from a referring or treating healthcare practitioner, medical scheme or funder, insurer, employer for a COIDA claim, attorney, hospital or other authorised source.

4. Why information is processed

• To identify and contact the patient; arrange appointments; assess, treat and refer appropriately; and maintain the clinical record.
• To communicate with treating or referring practitioners and support continuity of care.
• To issue accounts, submit claims, obtain payment, collect overdue accounts and respond to funding queries.
• To meet legal, regulatory, tax, accounting, professional, insurance, audit, quality-assurance and patient-safety duties.
• To protect the legitimate interests and safety of the patient, the practice or another person where permitted by law.

Processing uses the lawful grounds available under POPIA and applicable healthcare law, including providing healthcare, performing administrative and account obligations, complying with legal and professional duties, protecting legitimate interests and, where appropriate, obtaining consent. Health information is special personal information and remains subject to professional confidentiality.

5. Information required for care or claims

Information needed to identify the patient, provide safe care, maintain a lawful clinical record, submit a requested claim or recover a lawfully due account is necessary for those purposes. Without essential information, the practice may be unable to provide treatment safely, communicate about appointments or accounts, submit a claim or recover an overdue account. Claim-specific information is not required from a private self-pay patient unless another lawful need applies.

6. Communication channels

Billing, statements and practice documents are sent by email. Telephone and WhatsApp may be used for appointment arrangements, follow-up and account queries. These channels should not be used for emergencies. The practice limits sensitive information in routine messages and verifies identity where appropriate. Patient contact details are not used for direct marketing.

7. When information may be shared

Only the minimum information reasonably necessary for the purpose is shared, including where appropriate with:

• Treating or referring healthcare practitioners, hospitals or emergency services involved in the patient's care.
• Medical schemes, administrators, COIDA or Compensation Fund processes, RAF, insurers, responsible payers and authorised claim representatives.
• Registered debt collectors, attorneys, tracing providers and registered credit bureaux where lawfully required for recovery of an overdue account. Disclosure is limited to identity, contact, account and supporting billing information reasonably necessary for the purpose; clinical notes are not routinely disclosed.
• Approved service providers supporting clinical records, billing, claims, secure storage, communication, accounting, legal compliance, professional indemnity, audit or system support, subject to confidentiality and security obligations.
• Regulators, statutory bodies, courts or other recipients where disclosure is authorised or required by law.

8. Secure electronic patient form

A patient or authorised representative may submit the new-patient form through this website. The submission is encrypted while temporarily stored. The notification email sent to physiofp@gmail.com contains a submission reference and protected access link, but no patient name, health information or red-flag answers. Access links expire after 30 days.

The practice downloads or prints the form for the clinical record and then deletes the temporary website copy. Expired copies are removed during routine form activity. Patients may instead use the printable form or complete it at reception.

9. Electronic records, audio and AI-assisted notes

Clinical records may be created and stored electronically using approved healthcare and practice-management systems. Access is limited to authorised persons and the physiotherapist remains responsible for the clinical record.

If audio recording or AI-assisted clinical-note drafting is offered, it is optional and will be explained separately at the assessment. No session will be recorded without specific permission. Before recording, the patient will be told the provider, purpose, whether audio is retained and whether information may be processed outside South Africa. The physiotherapist reviews and corrects any draft note. Declining recording will not affect care.

10. Children and authorised representatives

Information about a child or represented patient is processed only where authorised by law, a competent person or another applicable justification. The practice records representative authority where relevant and considers the child's maturity, capacity and participation in healthcare decisions as required by law and professional guidance.

11. Security and retention

Reasonable organisational and technical safeguards appropriate to confidential health information are used, including controlled access, passwords, secure storage, backups, confidentiality duties and service-provider arrangements. If a security compromise creates a duty to notify, the Information Regulator and affected persons will be notified as required by POPIA.

Records are retained for periods required by applicable law, HPCSA guidance and legitimate clinical, funding, insurance or legal needs. Longer periods may apply to minors, ongoing care, complaints or legal proceedings. Information no longer lawfully required is securely destroyed or de-identified.

12. Processing outside South Africa

Some approved electronic service providers or their sub-processors may process information outside South Africa. Any transfer must satisfy POPIA section 72 through an applicable safeguard or lawful basis. Provider-specific information will be disclosed where relevant, especially before optional audio or AI processing.

13. Patient rights

Subject to POPIA, PAIA, healthcare-record duties and lawful limitations, a patient or authorised representative may:

• Ask whether the practice holds personal information and request access to it.
• Request correction, updating, deletion or destruction of inaccurate, excessive or unlawfully retained information.
• Object to processing where POPIA permits, or withdraw consent for future processing where consent is the lawful basis.
• Ask how information is used and lodge a complaint with the practice or Information Regulator.

A request may require proof of identity or authority. Clinical records cannot be deleted merely because deletion is requested where a lawful or professional retention duty applies.

14. Complaints

Privacy questions or requests should first be sent to the Information Officer. A complaint may also be submitted through the Information Regulator's eServices portal or to POPIAComplaints@inforegulator.org.za.

15. Notice updates

This notice may be updated when the practice's systems, service providers, legal duties or processing activities change. The current version will remain available at reception and on this website.