Privacy Notice

This Privacy Notice explains how Dr Oosthuizen Orthopaedic Practice collects, uses, stores, protects, shares, retains and deletes personal information when you use this website, contact the practice, register on the patient portal, submit medical information, upload X-rays or use the Knee Check or any online screening or assessment tool.

The practice processes personal information in accordance with the Protection of Personal Information Act, 4 of 2013, commonly referred to as POPIA.

Because this is a healthcare practice, the practice also applies professional and ethical duties relating to patient confidentiality, informed consent, clinical communication, record keeping and professional conduct under the Health Professions Council of South Africa, referred to as the HPCSA.

This Privacy Notice should be read together with any consent form, patient portal terms, screening-tool notice, appointment form, hospital documentation or other privacy notice provided to you by the practice.

For purposes of POPIA, Dr Oosthuizen Orthopaedic Practice is the Responsible Party for personal information collected through this website, the patient portal, online forms, appointment requests, uploaded files and screening tools.

Where the practice uses third-party service providers, including hosting providers, cloud providers, patient portal providers, email providers, booking systems, cybersecurity providers, software providers, billing providers or AI-processing providers, those parties may act as Operators under POPIA or as separate responsible parties, depending on the service they provide.

The practice will take reasonable steps to ensure that Operators process personal information only as authorised and that appropriate confidentiality and security measures are in place.

4.1 Identification and contact information

This may include your name, surname, ID number, passport number, date of birth, age, gender, email address, telephone number, physical address, emergency contact details, next-of-kin details and medical aid information.

4.2 Health and medical information

This may include symptoms, injury details, medical history, surgical history, medication, allergies, X-rays, scans, medical images, radiology reports, referral letters, consultation notes, treatment information, hospital information and any other medical information you choose to provide.

Health information is special personal information under POPIA and is treated with additional confidentiality, access-control and security safeguards.

4.3 Patient portal and screening-tool information

If you use the patient portal, X-ray upload function, screening tool, Knee Check tool or AI-assisted assessment tool, the practice may collect your account details, login details, uploaded files, X-ray images, form answers, screening results, timestamps, technical logs, user activity records and communications linked to your submission.

Patients who use the X-ray upload or AI-assisted screening tool should also read the AI Screening Disclaimer, which explains the tool's purpose, limitations, risks, human review options and consent requirements.

4.4 Website and technical information

The website may collect your IP address, browser type, device information, pages visited, time spent on the website, referral source, approximate location, cookie identifiers and similar technical information.

4.5 Communication information

The practice may keep records of emails, WhatsApp messages, SMS messages, online form submissions, telephone notes, appointment requests, consent records, portal messages and other communications with you.

The practice processes personal information for the following purposes:

• to respond to enquiries and appointment requests;
• to register and manage patient portal accounts;
• to receive and review medical information submitted by patients;
• to assist with screening, triage, patient administration and clinical workflow;
• to prepare for consultations or follow-up care;
• to communicate with patients, referring doctors, medical aids, hospitals, radiologists and other healthcare providers involved in care;
• to maintain clinical, administrative and billing records;
• to issue invoices, receipts, statements and medical aid documents;
• to verify identity where necessary;
• to comply with legal, professional, regulatory and ethical obligations;
• to protect the rights, safety and security of patients, the practice, healthcare practitioners and third parties;
• to improve the website, patient portal, internal systems and services;
• to investigate complaints, incidents, queries or disputes;
• to comply with requests or directions from lawful authorities, regulators, courts or professional bodies;
• to send administrative messages, appointment reminders, follow-up information or practice communication; and
• to send direct marketing or promotional communication only where legally allowed and, where required, with your consent.

The practice does not rely only on blanket consent to process personal information.

The practice may process personal information where one or more of the following legal grounds applies:

• you have given consent;
• processing is necessary to provide healthcare services or respond to your request;
• processing is necessary for the performance of an agreement with you;
• processing is required by law;
• processing is necessary to protect your legitimate interests;
• processing is necessary to protect the legitimate interests of the practice or a third party;
• processing is necessary for the establishment, exercise or defence of legal claims;
• processing is necessary for professional, clinical, administrative, billing or regulatory purposes linked to healthcare services; or
• processing is permitted under POPIA for the processing of special personal information, including health information, by a healthcare professional, healthcare institution or medical practice where necessary for proper treatment, care, administration or professional practice.

Where the practice processes health information, it does so subject to professional confidentiality obligations and appropriate security safeguards.

The practice will ask for consent where consent is required by law, professional rules, ethical guidance or the design of the website, patient portal or screening tool.

By voluntarily submitting information through this website, registering on the patient portal, uploading X-rays or using the screening tool, you confirm that the information you provide may be processed for the purposes explained in this Privacy Notice.

However, the practice may also process health information where this is necessary for proper treatment and care, patient administration, clinical record keeping, billing, professional practice, regulatory compliance or the protection of legal rights.

The practice may request separate consent for specific activities, including:

• patient portal registration;
• X-ray or medical image uploads;
• use of the Knee Check or any AI-assisted screening or assessment tool;
• electronic communication;
• sharing information with another healthcare practitioner where consent is required;
• non-routine disclosures;
• photography, videos, testimonials or case studies;
• use of information for clinical audit, quality assurance or service improvement where identifiable information is involved;
• direct marketing or promotional practice updates; and
• any other activity where specific consent is legally or ethically required.

You may withdraw consent where processing is based on consent. Withdrawal of consent will not affect processing that took place lawfully before consent was withdrawn. The practice may still need to retain or process certain information where required or permitted by law, professional rules, clinical record-keeping duties, billing obligations, insurance requirements, dispute resolution or legal claims.

The practice treats patient information as confidential.

Only authorised persons may access patient information where access is necessary for clinical, administrative, technical, billing, legal, regulatory, professional or operational purposes.

The practice will not publish identifiable patient information, images, X-rays, testimonials, reviews, case studies or clinical details without appropriate consent.

The practice will take reasonable steps to protect patient information against improper access, loss, misuse, unauthorised disclosure, alteration or destruction.

The website may allow patients to upload X-rays, medical images or other medical information for the Knee Check, preliminary screening, triage or assessment.

Before you upload an X-ray or start the AI-assisted screening tool, the practice will aim to explain, in plain language:

• that the tool may use artificial intelligence or automated processing to assist with preliminary screening;
• what information the tool uses;
• what the tool is intended to do;
• the main limitations of the tool;
• that the tool may produce errors, incomplete results or inaccurate suggestions;
• that image quality, positioning, medical history and missing information may affect the result;
• that AI-assisted feedback does not replace a consultation, diagnosis, radiology report, medical opinion or treatment plan;
• that a registered healthcare practitioner retains responsibility for clinical decisions;
• that you may request human review;
• that you may decline AI-assisted screening without losing access to ordinary care from the practice; and
• that no solely automated decision will be used to refuse, terminate or materially limit your access to ordinary medical care.

When you use the X-ray upload or AI-assisted screening function:

• the uploaded information may be processed by the practice and authorised technology providers;
• the tool may generate automated or AI-assisted feedback;
• the feedback is preliminary and informational only;
• the feedback must be reviewed in the context of a proper medical consultation;
• the tool must not be used for emergencies;
• the practice may retain the submitted information as part of the patient record, screening record or administrative record where appropriate;
• the practice may contact you to arrange an appointment or request further information; and
• the practice may reject, disregard or require human review of any AI-assisted output where clinically appropriate.

The practice will not present any AI-assisted tool as replacing the judgement of a registered medical practitioner, radiologist or specialist.

Where any software, tool, device, product or service is described on the website, the practice will avoid claims that are misleading, exaggerated, unverified, or likely to create unrealistic expectations.

The practice will not use solely automated processing to make a decision that has a legal, clinical or similarly significant effect on you, unless this is permitted by law and appropriate safeguards are in place.

The practice will not use solely automated AI output to refuse treatment, deny access to ordinary care, make a final diagnosis, prescribe treatment or materially limit healthcare services.

Where automated or AI-assisted processing is used, it is intended to support preliminary screening, workflow, administration or clinical review. You may request human review of AI-assisted feedback.

The practice may send you administrative messages relating to appointments, forms, portal use, consultations, follow-ups, accounts, clinical administration or information you requested.

The practice will only send direct marketing or promotional communication where permitted by law. Where consent is required, the practice will request consent before sending such communication.

You may opt out of marketing communication at any time by using the unsubscribe option provided, replying with an opt-out request, or contacting the practice.

Opting out of marketing communication will not stop the practice from sending necessary administrative, appointment, clinical, billing or legal communication.

The practice may share personal information with:

• Dr Oosthuizen and authorised practice staff;
• hospitals, clinics, radiology practices, laboratories and other healthcare providers involved in your care;
• your referring doctor or treating healthcare practitioner;
• medical schemes, administrators and billing providers;
• IT, hosting, cloud, cybersecurity, portal and software providers;
• AI-processing, screening-tool or clinical workflow providers, where applicable;
• professional advisers, auditors, insurers and legal representatives;
• regulatory bodies, professional bodies, courts, law enforcement or public authorities where required or permitted by law;
• emergency contacts, guardians, representatives or next of kin where necessary and lawful;
• debt collection or payment service providers where necessary for account administration; and
• other persons or organisations where you have consented or where the law allows disclosure.

The practice does not sell patient information.

The practice will take reasonable steps to ensure that third parties who process personal information on behalf of the practice are bound by appropriate confidentiality, privacy and security obligations.

Some technology providers may store or process personal information outside South Africa.

Where personal information, including health information, is transferred outside South Africa, the practice will do so only where POPIA permits the transfer.

This may include circumstances where:

• the recipient is subject to a law, binding corporate rules or agreement that provides an adequate level of protection;
• the patient has consented to the transfer after being informed of the possible risks;
• the transfer is necessary for the performance of a contract with the patient;
• the transfer is necessary for the implementation of pre-contractual measures taken in response to the patient's request;
• the transfer is necessary for the conclusion or performance of a contract concluded in the interest of the patient; or
• the transfer is for the benefit of the patient and it is not reasonably practicable to obtain consent, but consent would likely have been given.

Where prior authorisation from the Information Regulator is required under POPIA before certain processing or cross-border transfers may take place, the practice will obtain that authorisation before the processing or transfer takes place.

The practice will take reasonable steps to ensure that any cross-border transfer is subject to appropriate privacy, confidentiality and security safeguards.

The practice uses a small number of trusted technology providers (Operators under POPIA) to host the website, store patient data and provide AI-assisted screening. The current list is below. Material changes will be reflected in an updated version of this Notice and announced via the changelog in Section 24.

Each Operator is bound by a written agreement containing confidentiality, security and breach-notification obligations. Where data is processed outside South Africa, the safeguards described in Section 13 apply.

The practice takes reasonable technical and organisational measures to protect personal information against loss, unauthorised access, misuse, disclosure, alteration or destruction.

These measures may include:

• access controls;
• password protection;
• secure hosting;
• encryption where appropriate;
• staff confidentiality duties;
• secure transmission methods;
• audit logs;
• backups;
• malware protection;
• cybersecurity monitoring;
• provider due diligence;
• internal policies and procedures; and
• limited access on a need-to-know basis.

Electronic communication always carries some risk. Patients are encouraged not to send highly sensitive information through unsecured channels unless specifically requested and unless appropriate precautions are in place.

If the practice becomes aware of a security compromise involving personal information, it will take steps required by POPIA, which may include notifying the Information Regulator and affected persons where required.

This website uses cookies and similar technologies. Non-essential cookies (analytics, marketing) are off by default and are only set after you opt in via the cookie banner. You can change your choice at any time using the "Manage cookies" link in the footer or via our dedicated Cookie Notice, which lists each category, its purpose and the cookies we use.

Essential cookies (sign-in session, consent record, security) are required for the site to function and cannot be disabled.

The practice keeps personal information only for as long as reasonably necessary for the purposes for which it was collected, unless longer retention is required or permitted by law, professional rules, clinical record-keeping obligations, insurance requirements, billing requirements, dispute resolution, regulatory obligations or legal claims.

Default retention periods: the practice retains patient health records (including X-ray uploads and AI screening outputs) for a minimum of six (6) years from the date of the last clinical interaction, in line with HPCSA professional guidance. Records for minors are retained until the patient reaches the age of 21 or for six years after the last interaction, whichever is later. Marketing-only contact details are retained until you opt out.

Where personal information is no longer required, the practice will take reasonable steps to delete, destroy, de-identify or restrict the information, unless further retention is required or permitted.

Subject to POPIA, PAIA and other applicable laws, you may have the right to:

• ask whether the practice holds personal information about you;
• request access to your personal information;
• request correction or updating of inaccurate, irrelevant, excessive, outdated, incomplete, misleading or unlawfully obtained personal information;
• request deletion or destruction of personal information where legally permitted;
• object to certain processing;
• withdraw consent where processing is based on consent;
• ask about the identity of third parties who have received your personal information;
• complain to the Information Regulator; and
• institute civil proceedings where permitted by law.

Requests for access to records may need to be made under the Promotion of Access to Information Act, commonly referred to as PAIA.

Objections to processing and requests for correction or deletion may need to be submitted using the prescribed POPIA forms, where applicable.

Some requests may be refused, limited or delayed where the practice is required or permitted to keep records, protect another person's rights, preserve clinical records, comply with legal or professional duties, prevent fraud, protect public interests, maintain evidence, recover fees, or establish, exercise or defend legal claims.

The Information Officer is responsible for encouraging and supporting compliance with POPIA within the practice.

The practice will take reasonable steps to maintain appropriate privacy governance measures, which may include:

• a POPIA compliance framework;
• a personal information impact assessment where appropriate;
• internal privacy and security procedures;
• staff awareness and confidentiality measures;
• operator and service-provider checks;
• breach-response procedures;
• records of processing activities where appropriate; and
• a PAIA manual where required.

For privacy questions, access requests, correction requests, deletion requests, objections or complaints, you may contact the Information Officer using the details provided in this Privacy Notice.

Where the patient is a child or minor, the practice may require consent from a parent, guardian or person legally authorised to act on behalf of the child, unless the law allows the child to consent independently in the circumstances.

The practice will process children's personal information with appropriate care and safeguards.

The practice may retain children's health records for longer periods where required or recommended by law, professional guidance, insurance requirements, clinical needs or legal risk.

This website may contain links to third-party websites, platforms or services.

The practice is not responsible for the privacy practices, security or content of third-party websites. You should read their privacy notices before submitting personal information to them.

If you have questions about this Privacy Notice or how the practice processes your personal information, please contact:

You may also lodge a complaint with the Information Regulator of South Africa if you believe your personal information has been processed unlawfully or in a way that violates POPIA.

The practice may update this Privacy Notice from time to time to reflect changes in the law, professional guidance, the website, the patient portal, technology, service providers or practice procedures.

The latest version will be published on this website.

By using this website, submitting information, registering on the patient portal, uploading X-rays or using the Knee Check or any screening or AI-assisted assessment tool, you acknowledge that you have read and understood this Privacy Notice.

Where separate consent is required, the practice will request that consent separately.

Use the form below to ask the Information Officer for access to your personal information, request a correction or deletion, object to processing, withdraw a consent or unsubscribe from marketing. You can also email rudolf@doctoroosthuizen.com directly. See PAIA Manual & POPIA Rights for the full process and the prescribed forms.

• Version 1.1 — 22 June 2026: Added hosting & sub-processor table (Section 13a); set explicit retention periods aligned to HPCSA guidance (Section 16); revised cookie section to cross-reference the Cookie Notice and confirm default-deny behaviour (Section 15); added in-page data subject request form (Section 24).
• Version 1.0 — 22 June 2026: Initial publication.