Privacy Policy

The Responsible Party — the person legally accountable for your information — is:

Ekhaya Medical Centre
Ekhaya Mall, Medical Suites 13C, Embalenhle, 2285, Secunda, Mpumalanga
HPCSA practice number 1440918
Telephone 017 632 9450
Email dr.tio@ekhayamedicalcentre.co.za

Our Information Officer is Dr Tio Laosebikan and can be reached at dr.tio@ekhayamedicalcentre.co.za. Any question, request or complaint about your personal information should go to them first.

We only collect what you actively type into this website. We do not buy information about you, and we do not track you around the internet.

Information about your health is special personal information under POPIA section 26, and the law treats it more strictly than an ordinary name and phone number. Your symptoms, medical history and medical aid membership all fall into this category.

We process it on two bases: your explicit consent, and POPIA section 32, which permits medical professionals and healthcare institutions to process health information where it is necessary for proper treatment and care.

Consent is not buried in the small print. The pre-consultation form cannot be submitted without it — our server rejects any submission that does not carry it — and we record the date and time you gave it.

• To contact you and confirm the appointment you asked for.
• To let the treating clinician prepare before you arrive, so your consultation is spent on you rather than on paperwork.
• To flag urgent symptoms for prompt clinical review.
• To keep the patient records the HPCSA requires us to keep.
• To keep the website secure and working.

We never sell or rent your information to anyone. We send marketing only to people who have specifically asked for it — see section 5.

We send occasional practice news and general health information by email, but only if you asked us to. The booking form has a tick box for it, and it is unticked by default. Leaving it alone means you get nothing, which is how it should be — the consent you give when you book is consent to be treated, not consent to be marketed to. That distinction is what section 69 of POPIA requires.

What we will never send you under that tick box:

• anything about your own diagnosis, test results or treatment
• anything from another business — we do not sell, rent or share your address

Some messages are not marketing and you will get them whether or not you ticked the box, because they are part of the service you asked us for:

• confirmation that we received your booking request
• a short thank-you after a visit

If you have unsubscribed, we stop sending those too.

You can stop hearing from us at any time:

• tap Unsubscribe at the foot of any newsletter — it takes one click and needs no login
• leave the opt-in box unticked next time you book, which withdraws it
• tell reception, or email the Information Officer

We record when you opted in, and we keep a log of the messages we send you, so we can show what was sent and on what basis.

Inside the practice, access is limited to the clinical and reception staff who need it to treat you or arrange your visit. Outside the practice, we use the following service providers — Operators in POPIA's language — who process information strictly on our instructions:

We may also share information where the law requires it, or with your medical scheme when you ask us to submit a claim on your behalf.

Your information is currently stored on servers located in Ireland (eu-west-1), not in South Africa.

POPIA section 72 permits this where the destination country is subject to a law that provides a level of protection substantially similar to POPIA. Ireland is subject to the EU General Data Protection Regulation, which meets that standard, and our hosting provider is contractually bound to process the information only on our instructions.

POPIA section 19 requires reasonable technical and organisational safeguards. In practice that means:

• All traffic to this site is encrypted in transit (HTTPS), and the database is encrypted at rest.
• Patient tables are protected by row-level security and carry no public access policies whatsoever. The website's public credentials cannot read a single patient record — we have tested this directly.
• Records are reachable only through our own server, never from your browser.
• Notification emails to the practice deliberately exclude your clinical answers, and mask medical aid numbers.
• We keep an audit trail of staff access to patient records.

No system is perfectly secure. If a breach ever affects your information, POPIA section 22 requires us to notify both the Information Regulator and you, and we will.

• Clinical records: 6 years from your last consultation, and for patients under 18, until their 21st birthday, in line with HPCSA guidance.
• Appointment requests that did not become a consultation: 12 months.
• Contact details for booking purposes: 24 months.

When a retention period ends we delete the information or de-identify it so it can no longer be linked to you.

Under POPIA you may:

• Ask what information we hold about you, and get a copy (section 23).
• Ask us to correct or delete information that is wrong, misleading, irrelevant, excessive or out of date (section 24).
• Object to how we are using it, on reasonable grounds (section 11(3)).
• Withdraw consent at any time — including consent to marketing, which you can withdraw in one click from any newsletter. Withdrawing does not affect processing already carried out, and we may still be required to retain your clinical record.
• Complain to the Information Regulator.

To exercise any of these, contact our Information Officer using the details in section 1. We may need to verify your identity first — it protects you if we do. We will respond within a reasonable time, and in any event as required by law.

We treat information about patients under 18 as belonging to a child, and we rely on the consent of a parent or guardian. A child may be brought to the practice by a parent or guardian who completes these forms on their behalf.

This website sets no cookies of its own and runs no advertising trackers. Its analytics are cookieless and do not record your IP address. Some third-party content, such as the embedded map, may set its own cookies when it loads. The details are set out in our Cookie Policy.

Please raise concerns with our Information Officer first — most issues are resolved quickly. If you are not satisfied, you may complain to:

The Information Regulator (South Africa)
JD House, 27 Stiemens Street, Braamfontein, Johannesburg, 2001
Complaints: complaints.IR@justice.gov.za
Enquiries: enquiries.IR@justice.gov.za
https://inforegulator.org.za

We update this policy when the way we handle information changes — for example when the database moves to a South African region. The date at the top always reflects the current version. Material changes affecting how we use health information will be brought to your attention rather than made quietly.