PAIA Manual
Acronyms
- HPCSA: Health Professions Council of South Africa
- IO: Information Officer
- PAIA: Promotion of Access to Information Act 2 of 2000, as amended
- POPIA: Protection of Personal Information Act 4 of 2013
- Regulator: the Information Regulator
- The practice: Simone Vosloo Physiotherapy (Pty) Ltd
Purpose of this manual
This manual helps members of the public to:
- see which records the practice makes available without a formal request;
- understand how to request access to a record, by describing the subjects and categories of records the practice holds;
- see which records are kept under other legislation;
- find the contact details of the Information Officer;
- find the Regulator's guide on how to use PAIA;
- understand how the practice processes personal information, who it may share it with, whether it transfers information outside South Africa, and how it keeps information secure.
Contact details
- Private body
- Simone Vosloo Physiotherapy (Pty) Ltd, registration number 2021/416268/07
- Head and Information Officer
- Simone Vosloo, Director registration with the Regulator to confirm
- Deputy Information Officer
- None designated, to confirm
- Telephone
- 031 562 9393
- simone@svphysios.com
- Physical address
- Sunningdale Medical Centre, 4 Village Way, Sunningdale, Umhlanga, 4051
- Postal address
- to confirm
- Website
- svphysios.com
The Regulator's guide to PAIA
Under section 10(1) of PAIA, the Regulator has published a guide on how to use PAIA and POPIA. It is available in every official language and in braille. It explains the objects of both Acts, how to make a request to public and private bodies, the help available from the Regulator, and the remedies available, including how to lodge a complaint.
You can get the guide from the Regulator's website at inforegulator.org.za, by asking the Information Officer, or by inspecting it at the practice during normal working hours, where copies are kept in English and a second official language.
Records available without a request
| Category | Records | Where |
|---|---|---|
| Practice information | Services, contact details, Privacy Policy, Terms of Use, this manual | Website |
| Patient information | General information about appointments and fees | On request |
Records kept under other laws
The practice keeps records as required by, among others:
- Companies Act 71 of 2008
- Health Professions Act 56 of 1974, and the HPCSA's ethical rules and guidelines on patient records
- National Health Act 61 of 2003
- Medical Schemes Act 131 of 1998
- Income Tax Act 58 of 1962
- Value-Added Tax Act 89 of 1991
- Protection of Personal Information Act 4 of 2013
- Promotion of Access to Information Act 2 of 2000
- Basic Conditions of Employment Act 75 of 1997, Occupational Health and Safety Act 85 of 1993 and Unemployment Insurance Act 63 of 2001, where the practice employs staff
Subjects and categories of records
| Subject | Categories of records |
|---|---|
| Company | Registration documents, memorandum of incorporation, director records, statutory returns |
| Patients | Contact and identity details, clinical records, assessments, treatment notes, referral letters, consent forms, correspondence |
| Finance | Accounts, invoices, medical scheme claims, bank statements, tax records |
| Staff and contractors | Contracts, professional registration, payroll and leave records |
| Suppliers | Contracts, invoices, service agreements |
| Communications | Website booking enquiries, email, WhatsApp and telephone records relating to appointments |
Processing of personal information
Purpose
The practice processes personal information to assess, treat and care for patients; arrange appointments; keep clinical records; bill patients and medical schemes; employ staff; manage suppliers; and meet its legal and professional obligations.
Categories of data subjects and information
| Data subjects | Personal information |
|---|---|
| Website visitors who accept optional cookies | Device and browser information, pages visited, approximate location from the internet address, cookie identifiers |
| Patients and enquirers | Names, contact details, identity numbers or dates of birth, medical scheme details, health information, next of kin, account records |
| Parents and guardians | Names, contact details, relationship to the patient |
| Staff and contractors | Names, contact details, identity numbers, qualifications, professional registration, bank and tax details |
| Suppliers | Names, contact details, registration and bank details |
Recipients
| Information | Recipients |
|---|---|
| Clinical and claim information | Medical schemes and their administrators |
| Clinical information, with the patient's permission | Referring and treating healthcare professionals |
| Contact, enquiry, clinical and account information | Service providers: website host (Cloudflare), patient enquiry platform (HighLevel), practice management (Zanda Health), email (Microsoft 365), WhatsApp (Meta), accounting providers, and the marketing agency that maintains the website and enquiry system |
| Website measurement information (no health information) | Google (Google Analytics) and Meta (Meta Pixel), only with the visitor's consent |
| Information required by law | The HPCSA, the South African Revenue Service, courts and other authorities |
Transfers outside South Africa
The practice communicates with patients on WhatsApp, which is operated by Meta and may store information outside South Africa. The website host (Cloudflare, United States), the patient enquiry platform (HighLevel, United States), Google and Meta (website measurement, only with consent), the practice management system and email (Microsoft 365) may also store information outside South Africa. Confirm where Zanda Health and the email provider store data Any transfer takes place only as section 72 of POPIA allows.
Security measures
The practice uses password and device protection, restricted access to clinical records, confidentiality undertakings, reputable service providers, encrypted website connections, backups and secure disposal of records. Confirm the measures in place, such as two-step login and backup method
How to request a record
- Your own records. Patients may ask for their own personal information at any time by contacting the Information Officer. See our Privacy Policy.
- Other records. Under section 50 of PAIA, a requester must be given access to a record of a private body if the record is required to exercise or protect a right, the requester follows the procedure in PAIA, and no ground for refusal applies.
- How to ask. Complete the prescribed request form, available from the Regulator's website, and send it to the Information Officer by email or deliver it to the practice. Identify the record, explain which right the record is needed for, and give an address or email for the reply.
- Fees. A request fee and access fees may be payable, as prescribed in the PAIA Regulations. You will be told of any fee before your request is processed.
- Decision. The Information Officer will decide on the request as soon as reasonably possible, and in any event within 30 days, unless that period is extended as PAIA allows.
- Refusal. PAIA sets out grounds on which access may or must be refused, for example to protect another person's privacy, confidential or commercial information, or legal privilege. Health records of another patient will not be released without the consent PAIA requires.
- Remedies. If you are unhappy with a decision, you may complain to the Regulator at PAIAComplaints@inforegulator.org.za, or apply to court.
Availability and updates
This manual is available on this website, for inspection at the practice during normal business hours, to anyone on request against the prescribed fee, and to the Regulator on request. The practice will update it when its information changes.
Signed by Simone Vosloo, Head of Simone Vosloo Physiotherapy (Pty) Ltd, on date. The signed copy is kept at the practice.