PAIA Manual & POPIA Rights

1. Purpose of this PAIA Manual and POPIA Rights Document

This document explains how patients, website users, employees, suppliers, service providers, and members of the public may request access to records held by Dr Oosthuizen Orthopaedic Practice.

It also explains how the practice processes personal information and summarises the rights that data subjects have under the Protection of Personal Information Act, 4 of 2013.

This document is intended to help you understand:

1. what categories of records the practice holds;
2. which records may be available without a formal PAIA request;
3. how to request access to records under PAIA;
4. what personal information the practice processes;
5. why personal information is processed;
6. who personal information may be shared with;
7. whether personal information may be processed outside South Africa;
8. what security measures are used to protect personal information;
9. what rights you have under POPIA; and
10. how to submit a complaint if you believe your rights have not been respected.

2. Important Definitions

PAIA: means the Promotion of Access to Information Act, 2 of 2000, as amended.

POPIA: means the Protection of Personal Information Act, 4 of 2013.

Information Regulator: means the Information Regulator of South Africa.

Information Officer: means the person responsible for dealing with access-to-information requests and POPIA-related requests.

Personal information: means information relating to an identifiable living person or, where applicable, an identifiable juristic person.

Special personal information: includes health information and other sensitive personal information protected under POPIA.

Practice: means Dr Oosthuizen Orthopaedic Practice.

3. Details of the Private Body

4. Head of the Private Body

For purposes of PAIA, the head of the private body is:

5. Information Officer

The Information Officer is responsible for assisting with PAIA requests, POPIA requests, privacy-related enquiries, and access-to-information matters.

6. Guide on How to Use PAIA

The Information Regulator has published a guide that explains how PAIA works and how people may exercise their rights under PAIA and POPIA.

The guide explains, among other things:

1. the purpose of PAIA and POPIA;
2. how to request access to records;
3. the prescribed forms that must be used;
4. the fees that may apply;
5. the assistance available from Information Officers;
6. the assistance available from the Information Regulator;
7. the remedies available if a request is refused or ignored; and
8. how to lodge a complaint.

The PAIA Guide is available from the Information Regulator. You may also request assistance from our Information Officer if you need help understanding how to make a request.

7. Records Available Without a Formal PAIA Request

Some information may be available without submitting a formal PAIA request. These records may be available on the website, by email request, or at the practice.

Unless a record is listed as automatically available, access may require a formal PAIA request or a POPIA data-subject request.

The practice may refuse access where PAIA, POPIA, medical confidentiality rules, or any other applicable law allows or requires refusal.

8. Records Held by the Practice

The practice holds records under the following subjects and categories.

Access to some records may be restricted because they contain confidential, privileged, third-party, health-related, or legally protected information.

9. Records Available in Terms of Other Legislation

The practice may hold records required under South African law, including records held for purposes of:

1. the Health Professions Act and applicable HPCSA rules;
2. the National Health Act;
3. the Protection of Personal Information Act;
4. the Promotion of Access to Information Act;
5. tax legislation administered by the South African Revenue Service;
6. labour and employment legislation;
7. company legislation, where applicable;
8. medical scheme and billing requirements, where applicable;
9. professional indemnity and insurance obligations; and
10. any other law that applies to medical practices in South Africa.

The fact that the practice holds records under another law does not mean that the records are automatically available to the public. Access will depend on the applicable law, PAIA, POPIA, medical confidentiality duties, and the rights of other persons.

10. Purpose of Processing Personal Information

The practice processes personal information for lawful medical, administrative, legal, operational, and patient-care purposes.

These purposes include:

1. registering patients;
2. verifying patient identity;
3. scheduling appointments;
4. providing orthopaedic medical care;
5. reviewing clinical information, X-rays, scans, referrals, and medical history;
6. using the patient portal and screening tool;
7. providing preliminary screening feedback where applicable;
8. communicating with patients and authorised representatives;
9. communicating with referring doctors, hospitals, radiology practices, laboratories, and other healthcare providers involved in patient care;
10. billing patients and medical schemes;
11. managing payments, accounts, refunds, and debt collection where applicable;
12. complying with legal and regulatory duties;
13. maintaining accurate medical records;
14. responding to complaints, enquiries, and legal requests;
15. protecting the security of the website, patient portal, practice systems, and patient information;
16. managing suppliers, service providers, employees, and contractors; and
17. improving practice operations and patient service.

The practice will only process personal information where it has a lawful basis to do so, including consent, performance of a contract, compliance with law, protection of a legitimate interest, provision of medical care, or another lawful ground recognised under POPIA.

11. Categories of Data Subjects and Personal Information Processed

The practice may process personal information about the following categories of people.

Because the practice provides medical services, some records may include health information and other special personal information. Such information is treated as confidential and is processed with appropriate safeguards.

12. Recipients of Personal Information

The practice may share personal information with recipients where this is necessary, lawful, and appropriate. Recipients may include:

1. Dr Oosthuizen and authorised practice staff;
2. hospitals, clinics, radiology practices, laboratories, and other healthcare providers involved in patient care;
3. referring doctors and treating healthcare practitioners;
4. medical schemes, administrators, billing providers, and payment processors;
5. IT, hosting, cloud, cybersecurity, patient portal, workflow, and software providers;
6. AI-processing, screening-tool, or clinical workflow providers where applicable;
7. professional advisers, auditors, insurers, and legal representatives;
8. regulatory bodies, professional bodies, courts, law enforcement, or public authorities where required or permitted by law;
9. emergency contacts or authorised representatives, where appropriate; and
10. other parties where the patient has consented or where the law permits disclosure.

The practice will not sell patient information.

13. Cross-Border Transfers of Personal Information

Some technology, hosting, cloud, portal, or AI-processing service providers may store or process personal information outside South Africa.

Where personal information is transferred outside South Africa, the practice will take reasonable steps to ensure that the transfer is lawful under POPIA. This may include ensuring that the recipient is subject to appropriate privacy and security safeguards, contractual obligations, adequate data protection standards, patient consent where required, or another lawful basis for cross-border transfer.

Where cross-border processing is used, it should be documented in the practice's Privacy Notice, sub-processor schedule, or internal data-processing records.

14. Information Security Measures

The practice takes reasonable technical and organisational steps to protect personal information against loss, unauthorised access, misuse, disclosure, alteration, or destruction.

These measures may include:

1. access controls and password protection;
2. role-based access to patient information;
3. secure hosting and cloud infrastructure;
4. encryption where appropriate;
5. audit logs and system monitoring;
6. secure backups;
7. confidentiality duties for staff and service providers;
8. staff training and awareness;
9. cybersecurity controls;
10. secure patient portal controls;
11. incident-response procedures;
12. supplier and service provider confidentiality obligations; and
13. periodic review of privacy and security controls.

No electronic system can be guaranteed to be completely secure. However, the practice will take reasonable steps to protect personal information in line with POPIA, medical confidentiality duties, and good information-security practice.

15. How to Request Access to Records Under PAIA

A person may request access to records held by the practice if the record is required for the exercise or protection of a right.

To submit a PAIA request, the requester should:

1. complete the prescribed PAIA request form, where applicable;
2. clearly describe the record requested;
3. explain which right the requester wishes to exercise or protect;
4. explain why the requested record is required for that right;
5. provide proof of identity;
6. provide proof of authority if acting on behalf of another person; and
7. send the request to the Information Officer.

Requests may be submitted by email, post, or in person using the contact details in this Manual.

The practice may ask for additional information if the request is unclear or incomplete.

16. POPIA Data Subject Requests

A data subject may request that the practice:

1. confirm whether the practice holds personal information about them;
2. provide access to their personal information;
3. correct inaccurate, irrelevant, excessive, outdated, incomplete, misleading, or unlawfully obtained personal information;
4. delete or destroy personal information where POPIA allows this;
5. object to certain processing of personal information;
6. withdraw consent where processing is based on consent; or
7. stop using personal information for direct marketing.

The practice may require proof of identity before acting on a POPIA request, especially where the request relates to health information or other sensitive personal information.

Requests may be submitted to the Information Officer using the contact details in this Manual.

17. Verification of Identity

Before providing access to records or acting on a correction, deletion, objection, or withdrawal request, the practice may need to verify the requester's identity.

The practice may request:

1. a copy of the requester's identity document;
2. proof of address or other verification information;
3. written authority if the requester acts on behalf of another person;
4. proof of guardianship, curatorship, power of attorney, or other legal authority where applicable; and
5. any further information reasonably required to prevent unauthorised disclosure.

Submitting a website form or email request does not, on its own, prove identity.

18. Fees

PAIA allows certain fees to be charged for processing access-to-information requests.

The practice may charge:

1. a request fee, where allowed by law;
2. an access fee for search, preparation, copying, or reproduction of records;
3. a deposit where the request is extensive and the law allows a deposit; and
4. a reasonable fee for printed copies of this Manual or other records.

The practice will notify the requester if any fee is payable before processing or providing access to the record.

No fee will be charged merely to submit a POPIA correction, deletion, objection, or withdrawal request, unless a lawful fee applies to a record-access request.

19. Time Periods for Responding to Requests

The practice will respond to PAIA requests within the period required by law.

Generally, the practice must respond within 30 days after receiving a valid request. This period may be extended where PAIA allows an extension, for example if the request is complex, involves a large number of records, or requires consultation with third parties.

If an extension is required, the practice will notify the requester.

If a request is refused, the practice will provide written reasons where required by law.

20. Grounds for Refusing Access

Access to a record may be refused where PAIA, POPIA, medical confidentiality rules, or another law allows or requires refusal.

Examples may include:

1. records containing the personal information of another person;
2. records protected by doctor-patient confidentiality;
3. records containing confidential commercial information;
4. records protected by legal privilege;
5. records that could endanger the safety or privacy of another person;
6. records relating to ongoing legal proceedings;
7. records that cannot be disclosed because another law prohibits disclosure; or
8. records not required for the exercise or protection of the requester's rights.

Each request will be considered on its own facts.

21. Your Rights Under POPIA

As a data subject, you have the following rights under POPIA.

21.1 Right to be notified

You have the right to be notified when your personal information is collected, and where your personal information has been accessed or acquired by an unauthorised person, where POPIA requires notification.

21.2 Right of access

You have the right to ask whether the practice holds personal information about you and to request access to that information.

21.3 Right to correction

You have the right to request correction of personal information that is inaccurate, irrelevant, excessive, outdated, incomplete, misleading, or unlawfully obtained.

21.4 Right to deletion or destruction

You may request deletion or destruction of personal information where POPIA allows this. The practice may be required by law or medical-record retention rules to keep certain records for a prescribed period.

21.5 Right to object

You may object, on reasonable grounds, to the processing of your personal information where POPIA allows an objection.

21.6 Right to withdraw consent

Where processing is based on your consent, you may withdraw that consent. Withdrawal of consent will not affect processing that took place lawfully before the withdrawal. It may also not affect processing that the practice is required or permitted to continue under law.

21.7 Right to object to direct marketing

You have the right to object to the use of your personal information for direct marketing.

21.8 Right not to be subject to certain automated decisions

You have the right not to be subject to certain decisions based solely on automated processing where those decisions have legal or significant effects, except where POPIA allows this. Where the practice uses AI-assisted screening tools, the output is not a final medical diagnosis and must not replace consultation with a qualified healthcare practitioner. Clinical decisions remain subject to appropriate professional assessment.

21.9 Right to complain

You have the right to submit a complaint to the Information Regulator if you believe your personal information has been processed unlawfully or your POPIA rights have been infringed.

21.10 Right to civil remedies

You may have the right to institute civil proceedings in certain circumstances as provided for under POPIA.

22. Complaints and Remedies

If you are unhappy with how the practice handled your PAIA or POPIA request, you should first contact the Information Officer using the contact details in this Manual.

If the matter is not resolved, you may lodge a complaint with the Information Regulator.

Private bodies do not have the same internal appeal process that applies to public bodies under PAIA. If a request to a private body is refused, ignored, or not handled properly, the requester may approach the Information Regulator or a court where the law allows this.

23. Availability of this Manual

This Manual is available:

1. on the practice website;
2. for inspection at the practice during normal business hours;
3. from the Information Officer on request; and
4. to the Information Regulator on request.

A printed copy may be provided on request, subject to a reasonable reproduction fee where applicable.

24. Language and Accessibility

This Manual is available in English.

If you require assistance understanding this Manual, or if you require it in another accessible format, please contact the Information Officer. The practice will consider reasonable requests for assistance or alternative formats.

25. Updates to this Manual

The practice may update this Manual from time to time to reflect changes in law, practice operations, technology, service providers, or information-processing activities.

The latest version will be made available on the practice website.

26. Contact for PAIA and POPIA Requests

All PAIA requests, POPIA requests, privacy enquiries, and complaints should be sent to:

27. Website Form Notice

If you submit a PAIA or POPIA request through the website, please note:

1. submitting a form does not automatically prove your identity;
2. the practice may request identity verification before acting on your request;
3. the practice may request additional information if your request is unclear;
4. medical and health information will only be released where the practice is satisfied that release is lawful and appropriate;
5. if fees apply, you will be notified before the record is provided; and
6. submitting a request does not guarantee that access will be granted.

28. Suggested Website Request Form Options

The website request form may allow users to select one of the following request types:

• PAIA request for access to records;
• POPIA request to access my personal information;
• POPIA request to correct my personal information;
• POPIA request to delete or destroy my personal information;
• POPIA objection to processing;
• withdrawal of consent;
• direct marketing opt-out;
• privacy complaint; or
• general PAIA/POPIA enquiry.

The form should ask the requester to provide:

• full name and surname;
• ID number or passport number;
• email address;
• telephone number;
• postal or physical address;
• relationship to the record or patient;
• whether the requester acts for themselves or another person;
• proof of authority if acting for someone else;
• details of the record or personal information requested;
• the right being exercised or protected, where applicable;
• preferred format of access;
• preferred method of communication; and
• confirmation that the information provided is true and correct.

29. Important Medical Confidentiality Notice

Patient records, X-rays, scans, medical reports, clinical notes, portal submissions, and screening-tool outputs may contain confidential health information.

The practice will not release such information unless it is satisfied that disclosure is lawful, authorised, and appropriate.

A patient's right to access their own health information is important, but access may still be subject to PAIA, POPIA, medical confidentiality duties, third-party rights, legal privilege, retention obligations, and other applicable laws.

30. AI-Assisted Screening Tool Notice

Where the practice uses an AI-assisted screening tool or patient portal, any automated or AI-assisted output is intended to support administrative, screening, or preliminary review processes only.

It is not a final diagnosis, medical opinion, treatment recommendation, or substitute for consultation with a qualified healthcare practitioner.

Patients should not rely solely on automated or AI-assisted feedback when making decisions about their health. A qualified healthcare practitioner must assess medical concerns, X-rays, symptoms, diagnosis, and treatment options.

The practice will process portal and screening-tool information in accordance with POPIA, this Manual, the Privacy Notice, and applicable medical confidentiality obligations.

31. Disclaimer

This Manual is provided for transparency and compliance purposes. It does not limit any rights you may have under PAIA, POPIA, or any other applicable law.

If there is a conflict between this Manual and the law, the law will apply.

This Manual should be reviewed periodically and updated when the practice changes its systems, service providers, information-processing activities, or legal obligations.

Submit a request