PRIVACY NOTICE & POPIA POLICY

PRIVACY NOTICE & POPIA POLICY

Last updated: September 2026

Village Health Medical Centre (“Village Health”, “we”, “us” or “our”) is committed to protecting the privacy, confidentiality and security of the personal and medical information entrusted to us.

This Privacy Notice explains what information we collect, why we collect it, how we use and protect it, when it may be shared, and the rights you have regarding your personal information.

We process personal information in accordance with applicable South African legislation, including the Protection of Personal Information Act 4 of 2013 (“POPIA”), the National Health Act 61 of 2003, and applicable professional and ethical requirements governing healthcare practitioners. POPIA establishes requirements for the lawful processing of personal information and gives individuals rights in relation to information held about them.

Who this Privacy Notice applies to

This Privacy Notice applies to personal information processed by Village Health Medical Centre, including information collected:

• when you register as a patient;
• when you receive medical care from our medical practitioners or nursing staff;
• when you contact our reception or administrative team;
• through our website and online forms;
• when booking appointments;
• during telephone, WhatsApp, SMS or email communication;
• for medical aid, billing and account administration; and
• in connection with other services provided directly by Village Health.

Please note: Village Health Medical Centre also accommodates independent healthcare practitioners and healthcare businesses operating from our premises. These practitioners may operate as separate practices and may be separate “responsible parties” under POPIA.

Where an independent practitioner collects or controls your information directly, their own privacy practices and policies may apply. Village Health will only access or process their patient information where necessary and where we are authorised to do so, for example for agreed reception or administrative services.

Information we may collect

Depending on the services you use, we may collect and process the following information.

Personal and identification information

This may include:

• full name and surname;
• identity number, passport number or date of birth;
• gender;
• residential or postal address;
• telephone and mobile numbers;
• email address;
• occupation or employer information where relevant;
• emergency contact details; and
• details of a parent, guardian, responsible person or main member where applicable.

Medical and health information

As a healthcare provider, we may process health information including:

• medical history;
• current and previous medical conditions;
• symptoms and diagnoses;
• allergies;
• medication and prescription history;
• immunisation information;
• family medical history where relevant;
• consultation notes;
• clinical observations and examination findings;
• pathology, laboratory and diagnostic results;
• imaging and reports;
• treatment plans;
• referrals;
• hospital or specialist reports;
• photographs or clinical images where medically appropriate; and
• other information relevant to your healthcare.

Health information is regarded as special personal information under POPIA and receives additional protection.

Medical aid and financial information

This may include:

• medical scheme name;
• medical aid membership number;
• plan or option;
• main member details;
• dependant code;
• benefit and authorisation information;
• claim information;
• invoices and account history;
• payment information; and
• information relating to co-payments or amounts owed.

We do not intentionally retain complete payment-card information where payments are processed through third-party payment systems.

How we collect your information

We generally collect information directly from you or from a person authorised to act on your behalf.

We may also receive relevant information from:

• another healthcare practitioner;
• hospitals or healthcare facilities;
• pathology laboratories;
• radiology providers;
• pharmacies;
• medical schemes and their administrators;
• specialists to whom you have been referred;
• a parent, guardian or authorised representative;
• emergency services; or
• another lawful source where necessary for your care.

Information may be collected verbally, electronically, in writing, through our website or through systems used in the ordinary course of providing healthcare.

Why we process your information

We process your personal information for purposes reasonably connected with providing healthcare and operating our medical practice.

These purposes may include:

Providing healthcare

To:

• register you as a patient;
• assess your health;
• provide consultations and examinations;
• diagnose and manage medical conditions;
• prescribe medication;
• request pathology or diagnostic investigations;
• administer vaccines or other treatments;
• perform medical procedures;
• provide ongoing and preventative care;
• refer you to specialists or other healthcare professionals;
• communicate relevant information to healthcare professionals involved in your care; and
• maintain an accurate medical record.

Practice administration

To:

• schedule and manage appointments;
• send appointment confirmations and reminders;
• communicate with you about your care;
• answer enquiries;
• issue prescriptions, referral letters and medical documents;
• maintain patient records;
• manage accounts and billing; and
• provide general administrative support.

Medical aid administration

To:

• verify membership or benefits;
• obtain authorisations where required;
• submit claims;
• respond to medical scheme queries; and
• provide information reasonably required to process claims or benefits.

Legal and professional obligations

We may also process information where necessary to:

• comply with healthcare legislation;
• meet professional and ethical record-keeping requirements;
• comply with tax, accounting and business obligations;
• respond to lawful requests;
• manage complaints or legal claims;
• protect patients, employees or the public; or
• fulfil other legal or regulatory requirements.

POPIA does not require every instance of processing to be based solely on patient consent. Personal information may also be processed where another lawful basis applies, while health information is subject to the additional protections applicable to special personal information.

Your medical record

Village Health maintains medical records relating to the healthcare provided to you.

Records may be stored electronically and/or in paper format.

Where more than one Village Health medical practitioner is involved in your care, authorised practitioners may access information relevant to treating you and providing continuity of care.

The National Health Act requires health establishments to create and maintain health records and provides that information concerning a patient’s health status and treatment is confidential.

Access to medical records is limited to persons who have an appropriate reason to access them.

Sharing your information

We do not sell patient information.

We may share relevant personal or medical information when reasonably necessary and lawfully permitted.

This may include sharing information with:

• doctors and other healthcare practitioners involved in your care;
• specialists;
• hospitals;
• pathology laboratories;
• radiology providers;
• pharmacies;
• medical schemes and administrators;
• emergency medical providers;
• healthcare service providers;
• accounting, billing or debt-administration providers;
• information technology and practice-management service providers;
• secure data-storage or backup providers;
• professional advisers such as accountants, auditors or attorneys; or
• government, regulatory or law-enforcement authorities where legally required.

Only information reasonably necessary for the relevant purpose should be disclosed.

The National Health Act permits healthcare information to be disclosed in the ordinary course of healthcare where necessary for a legitimate purpose and in the patient’s interests, while otherwise treating patient information as confidential.

Where third-party service providers process personal information on our behalf, we require appropriate confidentiality and information-security protections where applicable.

Medical aids

If you provide us with medical scheme information, we may communicate with your medical scheme or its administrator for purposes including:

• membership verification;
• benefit enquiries;
• claims;
• authorisations;
• chronic medication or programme administration; and
• resolving rejected or unpaid claims.

Medical scheme authorisation or verification of benefits does not guarantee payment of an account.

Communication by telephone, WhatsApp, SMS and email

Village Health may use the contact information you provide to communicate with you regarding your healthcare and the administration of your account.

This may include:

• appointment confirmations;
• appointment reminders;
• follow-up communication;
• account information;
• medical aid queries;
• referral information;
• requests to contact the practice;
• notices regarding prescriptions or results; and
• other healthcare-related administrative communication.

We take reasonable precautions when communicating electronically. However, email, SMS and WhatsApp communication carries inherent privacy and security risks.

Patients should avoid sending unnecessary sensitive medical information electronically and should contact us if they are concerned about the security of a particular communication method.

It is your responsibility to ensure that the contact details supplied to us remain correct.

Direct marketing

Healthcare and administrative communication is separate from marketing.

We will only send electronic direct marketing where we are lawfully permitted to do so.

Where consent is required for electronic direct marketing, we will request it separately from consent required for healthcare or patient registration.

You may withdraw marketing consent or unsubscribe from promotional communication at any time.

POPIA specifically regulates unsolicited electronic direct marketing and gives data subjects the right to object to such processing.

Children and minors

Village Health provides healthcare services to children and therefore processes children’s personal and health information.

Where required, information may be provided by or consent obtained from a parent, guardian or other person legally authorised to act on behalf of the child.

The appropriate consent requirements may differ depending on:

• the child’s age;
• maturity;
• the nature of the healthcare service;
• the child’s capacity to understand the proposed care; and
• applicable South African legislation.

We take additional care when handling children’s personal and medical information.

Information security

We take reasonable technical and organisational measures to protect personal information against:

• loss;
• damage;
• unauthorised destruction;
• unauthorised access;
• unlawful disclosure;
• misuse; and
• alteration.

These measures may include, where appropriate:

• password-protected systems;
• restricted user access;
• role-based access to medical records;
• computer and network security;
• secure backups;
• physical security measures;
• staff confidentiality requirements;
• appropriate agreements with service providers; and
• staff training regarding confidentiality and personal information.

The National Health Act expressly requires measures to prevent unauthorised access to health records, while POPIA requires responsible parties to safeguard personal information.

No electronic system can, however, be guaranteed to be completely secure.

Information security breaches

If we have reasonable grounds to believe that personal information has been accessed or acquired by an unauthorised person, we will investigate the incident and take appropriate steps in accordance with POPIA.

Where required, this may include notifying the Information Regulator and affected individuals.

Section 22 of POPIA specifically deals with notification following certain security compromises.

How long we keep your information

Personal information will not be retained longer than necessary unless:

• retention is required or authorised by law;
• professional healthcare record-keeping requirements require retention;
• the information is required for an ongoing healthcare purpose;
• the information is reasonably required for legal proceedings or a potential claim;
• a contractual obligation requires retention; or
• another lawful reason permits us to retain it.

Medical records are retained in accordance with applicable legislation and professional guidelines.

Where records are no longer authorised or required to be kept, they will be securely destroyed, deleted or de-identified where appropriate.

Information stored or processed outside South Africa

Some of the technology or service providers used by Village Health may store, back up or process information using infrastructure located outside South Africa.

Where personal information is transferred outside South Africa, we will take reasonable steps to ensure that the transfer complies with POPIA and that appropriate safeguards apply.

Website information and cookies

When you visit our website, certain technical information may automatically be collected, including:

• IP address;
• browser type;
• device information;
• pages visited;
• dates and times of visits; and
• cookies or similar technologies.

Cookies may be used for purposes such as:

• ensuring the website functions correctly;
• remembering preferences;
• website security;
• analysing website usage; and
• marketing, where consent has been provided.

You may manage your cookie preferences using the website’s cookie controls.

Links and third-party services

Our website may contain links to third-party websites or services, including online booking platforms and other healthcare service providers.

Village Health does not control the privacy practices of independent third parties.

You should review the privacy information provided by those services before submitting personal information to them.

Your rights

Subject to applicable law, you may have the right to:

• ask whether Village Health holds personal information about you;
• request access to your personal information;
• request correction of inaccurate or outdated information;
• request deletion or destruction where Village Health is no longer authorised to retain the information;
• object to certain processing;
• withdraw consent where processing relies specifically on your consent;
• object to direct marketing; and
• lodge a complaint with the Information Regulator.

POPIA specifically provides rights relating to notification, access, correction, deletion, objection and direct marketing.

Please note that the right to request deletion does not mean that a healthcare provider must delete your medical record whenever requested. We may be legally or professionally required to retain certain information.

Accessing or correcting your information

If you believe that personal information held by Village Health is inaccurate or requires updating, please contact us.

Certain requests for access to information may be dealt with in accordance with POPIA and the Promotion of Access to Information Act (PAIA).

We may need to verify your identity before releasing or changing personal information.

We will not release another person’s confidential information simply because they are related to you, unless the disclosure is appropriately authorised or otherwise permitted by law.

Information about another person

If you provide personal information relating to another person, for example:

• your child;
• dependant;
• spouse;
• emergency contact; or
• another patient on whose behalf you are acting,

you confirm that you are authorised to provide the information where such authority is required.

Changes to this Privacy Notice

We may update this Privacy Notice from time to time to reflect:

• changes in legislation;
• regulatory requirements;
• changes to our systems or services; or
• changes to how personal information is processed.

The most recent version will be published on our website with the date on which it was last updated.

Contact us regarding your personal information

For questions, requests or concerns regarding your personal information, please contact:

Village Health Medical CentreShop 1, Sugar Village CentreUmhlali, KwaZulu-NatalSouth Africa

Telephone: 032 061 0619WhatsApp: 071 329 1993Email: accounts@villagehealthmedical.co.za / reception@villagehealthmedical.co.za

Complaints to the Information Regulator

If you believe that your personal information has been processed unlawfully, you may first contact Village Health so that we can attempt to resolve your concern.

You also have the right to lodge a complaint with the:

Information Regulator (South Africa)

Current contact and complaint information can be obtained from the Information Regulator’s official website.