Sandton Therapy logo Sandton Therapy

Legal

Privacy Policy

Effective date: [Effective date]

This Privacy Policy explains how Sandton Therapy collects, uses, shares, protects and retains your personal information when you visit our website, book a session, complete our onboarding and consent process, or receive psychology services from us. Please read it together with any consent forms you complete.

1. Who we are (the Responsible Party)

The responsible party for your personal information is:

  • Sandton Therapy, the practice of Sarah-Jane Lipshitz, Registered Educational Psychologist
  • HPCSA registration: PS 0123102 · Practice number: 086 003 0529346
  • Manor Medical Centre, 189 Kelvin Drive, Morningside Manor, Sandton, 2196, Gauteng, South Africa
  • Email: sarahjane@sandtontherapy.co.za · Phone: 083 438 1768

We provide in-person and online educational-psychology therapy sessions (60 minutes), and our website supports online booking, onboarding, electronic consent, invoicing, and medical-aid claims.

2. The personal information we collect

Depending on how you use our services, we may collect:

  • Identity and contact details: name, email address, phone number, identity (ID) number and date of birth;
  • Medical-aid details: scheme, plan, member number and dependent code;
  • Clinical records: assessment notes, session records and related health information;
  • Consent records: electronic consent you provide during onboarding and treatment.

Some of this is special personal information under POPIA — in particular health information and, where the client is a child, a child's personal information. We process this category only where the law permits, including where it is necessary for the provision of health services and with your consent.

3. Children's information

Many of our clients are children. Where we provide services to a child, we process the child's personal information with the consent of a parent or legal guardian, who completes the booking, onboarding and electronic consent on the child's behalf. A parent or guardian may exercise the data subject rights set out below on the child's behalf.

4. Why we use your information and our lawful basis

We use your personal information to:

  • schedule, manage and deliver in-person and online therapy sessions;
  • complete onboarding and record your electronic consent;
  • maintain clinical records as required of a registered psychology practice;
  • issue invoices and process payments;
  • support medical-aid claims and respond to scheme queries;
  • communicate with you about appointments and your care; and
  • comply with our legal, professional and ethical obligations.

Our lawful basis for processing under POPIA includes your consent, the performance of our agreement with you, compliance with a legal obligation, and our legitimate interests in operating the practice. Health information is processed on the additional basis that it is necessary for the provision of health services by a health-care professional.

5. How we share your information

We treat your information as confidential and we do not sell it. We share it only where necessary and lawful, including with:

  • Medical schemes and their administrators, where you ask us to support a claim or where required to process payment;
  • The Health Professions Council of South Africa (HPCSA) and other regulators, where we are required to do so to meet our professional and legal obligations;
  • Trusted service providers (operators / sub-processors) who help us run the practice — such as secure email and SMS providers and our document storage and booking systems — who may process information only on our instruction and under appropriate confidentiality and security commitments; and
  • Other parties where the law requires it, or where you give us specific consent (for example, sharing a report with a school or referring professional).

6. How we protect your information

We apply appropriate technical and organisational safeguards, including:

  • Field-level encryption of sensitive identifiers such as ID numbers and medical-aid numbers;
  • Protected document storage for clinical and onboarding documents;
  • Access controls that limit who can view your information; and
  • An audit trail that records access to records.

Our website uses only essential cookies — a session cookie and a CSRF (security) token needed for the site to function. We do not use third-party analytics or advertising/tracking cookies by default.

7. How long we keep your information

We keep clinical and related records for at least the minimum periods required by the HPCSA's record-keeping guidelines and other applicable law. Records relating to children are kept for the periods required after the child reaches majority, in line with those guidelines. Where we no longer have a lawful reason to retain your information, we securely delete or de-identify it.

8. Cross-border processing

Some of our service providers may store or process information on servers located outside South Africa. Where this happens, we take reasonable steps to ensure that your information receives a level of protection consistent with POPIA, including through appropriate safeguards or your consent where required.

9. Your rights

Subject to POPIA, you (or a parent/guardian on a child's behalf) have the right to:

  • Access the personal information we hold about you;
  • Correct or update information that is inaccurate or incomplete;
  • Request deletion of information where we have no lawful basis to keep it;
  • Object to certain processing; and
  • Withdraw consent you previously gave, without affecting processing already carried out.

Please note that some information must be retained to meet our legal and professional record-keeping obligations even after you ask us to stop using it.

10. How to exercise your rights or contact us

To exercise any of these rights, or for any privacy question, please contact our Information Officer:

  • Information Officer: [Information Officer name], Sandton Therapy
  • Email: sarahjane@sandtontherapy.co.za · Phone: 083 438 1768
  • Manor Medical Centre, 189 Kelvin Drive, Morningside Manor, Sandton, 2196, Gauteng, South Africa

We may ask you to verify your identity before we act on a request, to protect your information.

11. Complaints to the Information Regulator

If you are not satisfied with how we have handled your personal information, you may lodge a complaint with the Information Regulator (South Africa) at https://inforegulator.org.za. We would, however, appreciate the opportunity to address your concerns directly first.

12. Changes to this policy

We may update this Privacy Policy from time to time. The current version, and its effective date, will always be available on our website.