1. Introduction
This privacy statement sets out how our practice collects, uses, shares, and protects your personal information in compliance with the Protection of Personal Information Act, 2013 (POPIA). We are committed to protecting your privacy and ensuring that your personal information is handled responsibly.
2. Personal Information We Collect
We may collect and process the following categories of personal information:
- Identity information: Full name, ID number, date of birth, gender
- Contact information: Physical address, email address, telephone/mobile numbers
- Medical information: Medical history, current conditions, medications, allergies, test results, treatment records
- Financial information: Medical aid details, account numbers, billing information
- Employment information: Employer name and contact details (where relevant to treatment)
- Biometric information: Where clinically necessary (e.g., fingerprints for identification)
- Next of kin/emergency contact details
3. Purpose of Collecting Personal Information
Your personal information is collected for the following purposes:
- To provide you with medical treatment and healthcare services
- To maintain accurate and up-to-date medical records
- To submit claims to your medical aid or process payments
- To communicate with you regarding appointments, results, and follow-up care
- To refer you to specialists or other healthcare providers when necessary
- To comply with legal and regulatory obligations (including the Health Professions Act and National Health Act)
- To manage our practice administration and improve our services
- To conduct quality assurance and clinical audits
4. Legal Basis for Processing
We process your personal information on the following legal grounds:
- Your informed consent (as provided by signing this form)
- Compliance with a legal obligation (e.g., notifiable diseases, medical records retention)
- To protect your legitimate interests or vital health interests
- For the proper performance of a public law duty (e.g., reporting to health authorities)
5. Sharing of Personal Information
Your personal information may be shared with the following third parties, only to the extent necessary:
- Medical aid schemes – for claims processing and authorisations
- Pathology laboratories – for diagnostic testing
- Specialist practitioners and hospitals – for referrals and continuity of care
- Pharmaceutical companies/pharmacies – for prescriptions
- Practice management software providers – for secure electronic records (under strict data processing agreements)
- Regulatory bodies – as required by law (HPCSA, Department of Health)
We will never sell your personal information to third parties or share it for marketing purposes without your explicit consent.
6. Retention of Personal Information
Your medical records and personal information will be retained for the periods prescribed by law:
- Medical records of adults: retained for a minimum period as prescribed by the Health Professions Act
- Medical records of minors: retained until the patient reaches the age of 21 years
- Financial records: retained as required by SARS and applicable legislation
After the retention period, records will be securely destroyed in a manner that protects confidentiality.
7. Your Rights Under POPIA
As a data subject, you have the following rights:
- The right to be informed about how your personal information is used
- The right to access your personal information held by us
- The right to request correction of inaccurate or incomplete information
- The right to request deletion of your information (subject to legal retention requirements)
- The right to object to the processing of your personal information
- The right to lodge a complaint with the Information Regulator
8. Security Measures
We take appropriate technical and organisational measures to protect your personal information, including:
- Secure electronic systems with access controls and encryption
- Physical security measures for paper records (locked filing cabinets, restricted access areas)
- Staff training on confidentiality and data protection
- Regular review and updating of security practices
- Data processing agreements with all third-party service providers
9. Information Officer
For any queries, requests, or complaints regarding your personal information, please contact:
- Information Officer: Dr Mags Pillay
- Practice: Dr Mags Pillay, HPCSA: MP-0523356 · Practice No. 0097934
- Address: The Local, Kyalami Health, Kyalami, Midrand, 1684
- Email: info@kyalamihealth.co.za
- Phone: 010 335 0625
10. Complaints
If you are not satisfied with how your personal information has been handled, you have the right to lodge a complaint with the Information Regulator:
- The Information Regulator (South Africa)
- JD House, 27 Stiemens Street, Braamfontein, Johannesburg, 2001
- P.O. Box 31533, Braamfontein, Johannesburg, 2017
- Email: complaints.IR@justice.gov.za