Legal

POPIA Policy

Effective date: [Effective date]

Sandton Therapy is committed to protecting the personal information of the people we serve. This POPIA Policy is a practical summary of how the practice complies with the Protection of Personal Information Act 4 of 2013 (POPIA). It sits alongside our Privacy Policy: the Privacy Policy tells you what we collect and why, while this policy focuses on our compliance obligations, our internal safeguards, and your rights as a data subject. The practitioner responsible for the practice is Sarah-Jane Lipshitz, Registered Educational Psychologist (HPCSA registration PS 0123102, practice number 086 003 0529346).

Who we are (the Responsible Party)

Sandton Therapy is the responsible party under POPIA. You can reach us at:

• Address: Manor Medical Centre, 189 Kelvin Drive, Morningside Manor, Sandton, 2196, Gauteng, South Africa
• Email: sarahjane@sandtontherapy.co.za
• Phone: 083 438 1768

The eight conditions for lawful processing

POPIA sets out eight conditions for the lawful processing of personal information. We apply them as follows.

1. Accountability

The practice takes responsibility for complying with POPIA. Our Information Officer oversees this policy, our processes, and our agreements with service providers, and reviews them from time to time.

2. Processing limitation

We process personal information lawfully, minimally, and in a way that does not unreasonably intrude on your privacy. We collect only what we need to provide therapy and run the practice, and we rely on a lawful basis (most often your consent, the performance of our service agreement, or a legal obligation such as health-record keeping).

3. Purpose specification

We collect personal information for specific, clearly defined purposes: booking and managing 60-minute in-person and online educational-psychology sessions, onboarding, recording electronic consent, invoicing, and supporting medical-aid claims.

4. Further processing limitation

We do not use your information for new purposes that are incompatible with the reason it was collected. Where a genuinely new purpose arises, we will seek your consent or rely on another lawful ground.

5. Information quality

We take reasonable steps to keep your information accurate, complete, and up to date. You can ask us to correct anything that is wrong, and we encourage you to tell us when your contact, medical-aid, or other details change.

6. Openness

We are transparent about what we do with your information. This policy and our Privacy Policy are published on our website, and we will maintain the records of processing required under POPIA.

7. Security safeguards

We protect personal information with appropriate technical and organisational measures, described in concrete terms below.

8. Data subject participation

You have the right to know what information we hold about you, to access it, and to ask us to correct or delete it. Our request procedure is set out below.

Information we process

Depending on the service, we may process your name, email address, phone number, identity number, date of birth, medical-aid details (scheme, plan, member number and dependent code), clinical records, and records of your electronic consent.

Lawful bases, special personal information and children's data

Clinical and health records are special personal information under POPIA, and identity numbers receive heightened protection. We process this information on the basis of your express consent and because it is necessary to provide the psychology services you have requested.

Where a client is a child, we process their information with the consent of a competent person (usually a parent or legal guardian) and in the child's best interests, as required by POPIA. We collect only what is necessary for assessment and therapy, and we apply the same security safeguards to children's records.

Security safeguards in practice

Our concrete measures include:

• Field-level encryption of particularly sensitive fields, including identity numbers and medical-aid numbers, so that they are not stored in plain text.
• Protected document storage for clinical records, consent records, and uploaded documents, with access restricted to those who need it.
• An audit trail that records access to records, so unusual activity can be detected and investigated.
• Essential cookies only on our website (a session cookie and a CSRF token to keep your session secure). We do not use third-party analytics or advertising/tracking cookies by default.

Operators and sub-operators

Where we use service providers (operators) to host data, send communications, or support invoicing and medical-aid claims, we require them to process personal information only on our instructions, to keep it confidential, and to apply security measures consistent with POPIA. Any sub-operators they appoint are held to the same standards through written agreements.

Your requests and the prescribed forms

You may ask us to confirm what personal information we hold, to provide a copy of it, to correct or update it, to delete or destroy it where appropriate, or to object to certain processing. To make a request, contact our Information Officer using the details above.

POPIA provides prescribed forms for certain requests, including the form to object to processing and the form to request correction or deletion of personal information. Access requests may be made under the Promotion of Access to Information Act (PAIA). We will help you use the correct form and will respond within the timeframes the law allows. We may need to verify your identity before acting on a request, and we may decline or limit a request where the law requires us to retain records.

Breach notification

If we have reasonable grounds to believe that your personal information has been accessed or acquired by an unauthorised person, we will notify the Information Regulator and affected data subjects as soon as reasonably possible, in line with POPIA. The notification will describe the nature of the breach and the steps you can take to protect yourself.

Retention and deletion

We keep personal information only for as long as necessary to provide our services and to meet our legal, professional, and ethical obligations, including the health-record retention periods that apply to HPCSA-registered practitioners. When information is no longer needed and no legal duty requires us to keep it, we securely delete or destroy it.

Information Officer

Our Information Officer is responsible for ensuring compliance with POPIA, handling data subject requests, and liaising with the Information Regulator.

• Information Officer: [Information Officer name]
• Email: sarahjane@sandtontherapy.co.za
• Phone: 083 438 1768
• Address: Manor Medical Centre, 189 Kelvin Drive, Morningside Manor, Sandton, 2196, Gauteng, South Africa

The Information Regulator

If you are not satisfied with how we have handled your personal information or a request, you may lodge a complaint with the Information Regulator of South Africa:

• Email: enquiries@inforegulator.org.za
• Website: https://inforegulator.org.za

Changes to this policy

We may update this POPIA Policy from time to time to reflect changes in our practice or in the law. The current version, with its effective date, will always be available on our website.