PAIA manual

Manual prepared in terms of section 51 of the Promotion of Access to Information Act 2 of 2000, as amended, and incorporating POPIA-related information for Dr Wilana Hattingh at Willow Way.

Field	Detail
Private body / practice	Dr Wilana Hattingh at Willow Way
Professional role	Medical Practitioner — Independent Practice
HPCSA	MP 0971065
BHF practice number	1315080
Physical address	Unit 7, Ridge Square On Lynnwood, 162 Lynnwood Ridge, Die Wilgers, Pretoria, 0181
Postal address	Same as physical unless a separate postal address is later approved
Telephone/WhatsApp	071 542 0929 (mobile; no landline or fax)
Email	[email protected]
Website	wilanahattingh.co.za

Role	Person	Contact
Information Officer / head of private body	Dr Wilana Hattingh	[email protected] / 071 542 0929
Deputy Information Officer	None. Sole proprietorship with no staff; owner decision 23 Sep 2026	—
Records custodian	Dr Wilana Hattingh. Records are kept electronically	[email protected] / 071 542 0929

Evidence gate: file the Information Regulator registration proof or screenshot/reference in the private compliance evidence folder. The repo may record that evidence exists, but ID numbers and sensitive account details should not be posted publicly in issues.

This manual helps patients, requesters and third parties understand:

• which categories of records Willow Way holds;
• how to request access to records;
• which records may already be available without a formal PAIA request;
• who to contact for access-to-information queries;
• how personal information is processed;
• possible recipients of personal information;
• whether personal information may be processed outside South Africa;
• security measures used to protect information;
• remedies if a request is refused or not handled.

The Information Regulator publishes a guide on how to use PAIA and POPIA. The guide is available from the Information Regulator. Willow Way will assist a requester to identify the relevant guide/form where reasonably possible.

Category	Access route
Practice contact details	Website, booking page, practice notice
Services offered	Website / practice notice
Operating hours	Website / practice notice
Indicative fees	Website / practice notice / booking process
Complaints route	Practice notice / website / on request
Privacy notice	Website / practice notice / on request
PAIA manual	Website / practice inspection copy / email request

Record category	Relevant law / professional framework
Patient health records	National Health Act; HPCSA ethical guidelines; POPIA
Prescriptions and medicine records	Medicines and Related Substances Act; Pharmacy Act/GPP where applicable
Schedule 5/6 registers, if applicable	Medicines regulations and applicable pharmacy/dispensing rules
Clinical-waste records	Health/environmental/waste norms and contractor requirements
Complaints and adverse-event records	OHSC/National Health Act/professional governance
Financial/accounting records	Tax Administration Act, Income Tax Act, VAT Act where applicable
Employment/contractor/operator records	POPIA; labour/tax/contracts where applicable
PAIA request records	PAIA
POPIA privacy/breach records	POPIA

Subject	Categories of records
Patient administration	demographics, contact details, next-of-kin, medical aid details, appointments, consents, communication records
Clinical care	consultation notes, diagnoses, examination findings, observations, prescriptions, referrals, results, images/photos where clinically justified, aftercare and follow-up
Aesthetic procedures	consent, assessment, face maps, product/batch/lot, dose/volume/site, clinical photographs, aftercare, complication records
Medicines/stock	supplier records, batch/lot/expiry, cold-chain/temperature logs, administration/dispensing records, destruction/quarantine/recall records
Finance/billing	invoices, receipts, claim submissions, remittances, statements, payment records
Governance	complaints, incidents, adverse events, audits, SOP approvals, training/drill records
Suppliers/operators	contracts, operator agreements, confidentiality undertakings, licences, service records
Compliance	HPCSA/BHF/MPS/OHSC/evidence, PAIA/POPIA records, waste manifests, landlord certificates

Willow Way processes personal information to:

• provide healthcare and clinical advice;
• identify patients and maintain health records;
• manage appointments, intake, reminders and follow-up;
• issue prescriptions, sick notes, referrals, pathology/imaging requests and clinical letters;
• claim from medical schemes and process payment;
• comply with legal/professional duties;
• manage medicines, stock, product traceability and recalls;
• respond to complaints, adverse events and clinical incidents;
• communicate with patients, providers, laboratories, insurers/schemes and regulators where appropriate;
• maintain quality, audit and governance systems;
• manage suppliers, contractors and IT/security providers.

Data subject	Information categories
Patients	identity, contact, address, DOB/age, sex/gender, next of kin, medical aid, health information, clinical photos where needed, billing/payment and communication records
Parents/guardians/companions	identity/contact/relationship/authority and communication details where needed
Referring/receiving providers	name, practice details, contact, referral/clinical correspondence
Suppliers/operators	contact, contract, licence/evidence, payment, account and service records
Staff/contractors/helpers if added	identity/contact, qualifications, training, access logs, payroll/contract records
Complainants/third parties	contact details, complaint/request content, outcome correspondence

Personal information may be supplied where lawful and necessary to:

• treating/referral clinicians and emergency services;
• pathology/radiology providers;
• pharmacies and medicine suppliers where needed;
• medical schemes, administrators and billing providers;
• payment providers and accountants/bookkeepers;
• practice-management/hosting/IT support providers under operator/confidentiality controls;
• professional indemnity provider/legal advisers;
• regulators/statutory bodies where required;
• waste contractors only to the extent incident/waste records require and not routine patient clinical information;
• the patient or lawful representative/requester where access is granted.

The patient record, its backup and the practice email stay in South Africa: the app runs on a server in South Africa, the encrypted backup is in AWS's Cape Town region (af-south-1), and the mail host stores mailboxes in Johannesburg.

Personal information goes outside South Africa through these services:

Service	What goes there	Basis (POPIA section 72)
WhatsApp Business (Meta), including automated messages	Messages with patients who have consented to WhatsApp	Adequate protection under Meta's WhatsApp business data-processing terms (s72(1)(a)), self-assessed; and the patient's consent (s72(1)(b))
Cloudflare	Booking and intake forms in transit to the practice server; not stored	Adequate protection under the Cloudflare data-processing addendum (s72(1)(a)), self-assessed
NetPractice's own service providers	Billing data, onward from NetPractice's South African hosting	NetPractice's operator agreement allows such transfers only where section 72 is met
Publishing platforms (for example Meta)	Patient images, only where the patient has given specific written consent for that use	The patient's consent

The practice records its adequacy assessment for each foreign provider on one signed page, and adds a new provider there before using it. No AI tool processes live patient information at launch.

Minimum launch safeguards:

• password/PIN/biometric device access;
• no uncontrolled personal-cloud photo sync;
• role/access limitation even in solo practice;
• lockable storage for paper records, stationery and medicines;
• patient information not visible to gym/cafe/public users;
• minimum necessary WhatsApp/email communication;
• secure backup and device-loss/breach procedure;
• operator agreements and confidentiality undertakings;
• audit/version logs for clinical records/documents where system allows;
• secure destruction of duplicate/working paper after confirmed import where appropriate.

Formal requests for access to records must use the current prescribed PAIA request form/process, recorded here as Form 2: Request for Access to Record or its successor form.

A requester should provide:

• sufficient identifying details;
• the record requested;
• the right the record is required to exercise or protect, where required;
• preferred access form;
• contact details for notices;
• authority/proof where requesting on behalf of another person.

Requests involving patient health information must be handled with clinical confidentiality and legal-authority checks. Do not release another person's health information casually because a family member, employer, insurer or gym representative requests it.

Access may be refused, deferred or redacted where PAIA/POPIA/professional duties require or permit, including privacy of another person, privilege, unlawful access, insufficient authority, safety, or other statutory grounds. Keep reasons and appeal/complaint information.

Once approved, the manual should be:

• available at the practice principal place of business for inspection during normal business hours;
• available on the practice website when live;
• provided to the Information Regulator on request;
• supplied electronically/hard copy on request subject to lawful fees/process.