Privacy notice

We keep a health record about you because we have to, and because we cannot look after you safely without one. We keep it confidential. We share it only with the people you allow us to share it with, or where the law requires it. We keep it for at least six years after you stop being an active patient, and then we destroy it securely. You can ask to see it, ask us to correct it, and complain if we get it wrong.

Responsible party (the "we" in this notice):

Dr Wilana Hattingh at Willow Way
MBBCh (Wits) · DMH(SA) · FC Psych Part I
HPCSA registration: MP 0971065 (Medical Practitioner, Independent Practice)
Practice number: 1315080
Consulting rooms: Unit 7, Ridge Square On Lynnwood, 162 Lynnwood Ridge, Die Wilgers, Pretoria, 0181
Website: wilanahattingh.co.za

The practice is a sole proprietorship. Dr Hattingh personally is the responsible party for everything in this notice.

Information Officer and records custodian

Under POPIA section 56 read with the Information Regulator's guidance, the head of a private body is the Information Officer by virtue of office. For this practice that is Dr Wilana Hattingh. She is also the custodian of the practice's records. There is no deputy Information Officer: the practice has no other staff. Patient records are kept electronically.

• Email: [email protected]
• WhatsApp / phone: 071 542 0929 (mobile; the practice has no landline or fax)
• Postal / physical address: Unit 7, Ridge Square On Lynnwood, 162 Lynnwood Ridge, Die Wilgers, Pretoria, 0181

Dr Hattingh is registered with the Information Regulator as the practice's Information Officer (registration no. 2026-067676).

2.1 Ordinary personal information

• Your name, preferred name, title, date of birth and gender
• Your South African ID or passport number
• Your address, cellphone number, email address and preferred contact method
• Your population group — collected only because our billing system requires it, and used for nothing else
• Your home language
• Your medical scheme name, plan, membership number and dependant code
• Your next of kin and emergency contact details
• Your account and payment records, including what you owe and what you have paid
• Your appointment history, including missed appointments
• Records of our communication with you — WhatsApp messages, SMSes, emails and call notes
• Technical records created when you use our online forms: IP address, device and browser details, and time stamps

2.2 Special personal information — your health information

POPIA section 26 treats information about your health as special personal information and prohibits processing it unless a specific exception applies. This is the most sensitive category of information there is, and it is most of what we hold about you.

It includes:

• Your medical, surgical, psychiatric and family history
• Your symptoms, examination findings, diagnoses and treatment plans
• Your medicines, allergies and adverse reactions
• Test results — pathology, radiology and anything else
• Your weight, measurements, vital signs and other clinical measurements
• Clinical photographs, where you have separately consented to them
• Records of the products used on you, including batch and expiry details
• Your pregnancy, breastfeeding and reproductive information
• Your smoking, alcohol and substance-use history
• Your mental health information
• Referral letters and reports to and from other practitioners

2.3 Children's information

The practice sees GP patients from age 1. Aesthetic treatments are for adults (18+) only.

If you bring a child to the practice, we also process the child's information. Where the child cannot consent for themselves, we do so on your authority as the competent person under POPIA section 35. How a minor's consent or assent is obtained, and who may consent, follows the practice's patient administration policy.

Why we process it	What makes it lawful
To diagnose and treat you safely, and to give you continuing care	POPIA section 32(1)(a) — processing by a medical professional necessary for your proper treatment and care
To run the practice — bookings, records, follow-up, recalls	POPIA section 32(1)(a) — processing necessary for the administration of the professional practice
Because we must keep a health record by law	National Health Act 61 of 2003 section 13; HPCSA Booklet 9. POPIA section 11(1)(c) — compliance with a legal obligation
To bill you and to submit claims to your medical scheme	POPIA section 11(1)(b) — necessary to perform our agreement with you; and your consent given on the Consent to Disclosure form
To identify you before you sign a document electronically	POPIA section 11(1)(b); Electronic Communications and Transactions Act 25 of 2002 section 13
To send appointment reminders, recalls, results notices, clinical follow-ups and check-ins	Your consent, given on the Electronic Communications Consent form
To defend a complaint, a claim or an audit	POPIA sections 11(1)(d) and 27(1)(b) — necessary for the establishment, exercise or defence of a right in law
To meet SARS, HPCSA, Medicines Act and Health Establishment obligations	POPIA section 11(1)(c)
Where we rely on nothing else	Your consent — POPIA sections 11(1)(a) and 27(1)(a)

We do not sell your information. We do not share it with advertisers. We do not use it to build marketing profiles, and we do not send direct marketing.

Some information we simply cannot work without. If you will not give us your identity details, your medical history or your allergies, we cannot treat you safely, and Dr Hattingh may decline to proceed. If you will not give us medical scheme details, we cannot submit a claim, and your account becomes a private cash account. Optional items — like your email address, or a family member's details — are clearly optional.

Mostly from you, directly. We may also receive information about you from:

• Another doctor, hospital or clinic that refers you or reports back on you
• A pathology or radiology laboratory
• Your medical scheme, when it responds to a claim or asks for a motivation
• A family member or emergency contact, in an emergency
• A pharmacy, about a prescription

We share the least we can, with the fewest people possible.

Who	What they get	Why
Your medical scheme and its administrator	Your identity, membership details, dates of service, diagnosis codes (ICD-10), procedure codes and amounts. In an audit, a scheme may lawfully require treatment records	To pay your claim. Medical Schemes Act 131 of 1998 and its Regulation 15J(2)(c); your consent on the Consent to Disclosure form
Pathology and radiology laboratories	Your identity, the test requested and the clinical information needed to interpret it	To do the test and report the result back
Other practitioners — specialists, GPs, allied health, hospitals	A referral letter with the clinical information relevant to that referral	To get you the care you need. National Health Act sections 15 and 16 allow disclosure to a health care provider where necessary for a legitimate purpose in your interests
Pharmacies	Your prescription	To dispense your medicine
NetPractice — our billing and practice-management software	Your identity, contact, scheme and billing details, and the codes for what was done	To generate invoices and submit claims
Our patient app — built and hosted for the practice by our developer, on a server in South Africa	Your intake, consent and clinical records	The app is where your record lives
Amazon Web Services — our offsite backup, in Cape Town	An encrypted copy of the app's records	So your record survives if the server fails
Cloudflare — the network that carries our website	Your booking and intake forms, encrypted, on their way to our server	To connect you to our website securely
WhatsApp Business (Meta)	The content of any message you exchange with us	To communicate with you, if you consent. See the Electronic Communications Consent for the limits
Our SMS provider	Your cellphone number and the one-time code or reminder	To send your code or reminder by SMS when WhatsApp doesn't reach you
Our email host (domains.co.za)	Any email you exchange with us, and results laboratories email to us	To run the practice mailbox
Yoco — our card machine, and our bank	Payment details and amounts	To take payment. We do not store your full card number
Our accountant and, if needed, our auditors	Financial records, which may include your name and amounts	To keep the practice's books and meet SARS obligations
Debt collectors or attorneys	Your identity, contact details and the amount owing — not your clinical information	Only if your account goes unpaid and only after we have tried to resolve it with you
Our indemnifier (MPS) and our attorneys	Whatever is relevant to a complaint or claim	To defend a complaint or claim. POPIA sections 11(1)(d) and 27(1)(b)
Regulators — HPCSA, SAHPRA, the Office of Health Standards Compliance, the Information Regulator, SARS, the Department of Health	Whatever the law requires	Legal obligation. National Health Act section 14(2)(b) permits disclosure required by a court order or any law

Everyone above who processes your information for us is an "operator" under POPIA section 21, and is bound by a written agreement requiring them to keep your information confidential, to process it only on our instructions, to apply the security safeguards in POPIA section 19, and to tell us if there is a breach. Our developer has signed one with us. The service providers are bound by their published data-processing terms, which we have checked and keep on file. Yoco processes card payments under its own terms, as the card networks require.

The map on our website comes from Google Maps. It loads only when you scroll to it; your browser then sends your IP address and browser details straight to Google, which handles them under its own privacy terms. Google is not our operator.

We will add online consultations later, through a telehealth platform. We will update this notice before we do.

6.1 When we may disclose without asking you

Only in the narrow situations the law allows (National Health Act section 14(2)):

• Where a court order or any law requires it
• Where not disclosing would be a serious threat to public health — for example a notifiable disease
• In a life-threatening emergency, to the people treating you
• To report a suspected adverse drug reaction to SAHPRA, which we are asked to do within 7 days for serious reactions and 15 days for non-serious ones (SAHPRA ADR reporting guideline v4, 2025). Adverse-event reports focus on the medicine and the reaction, and we keep identifying details to the minimum

POPIA section 72 restricts sending your personal information to anyone in another country. We may only do it where the recipient is subject to a law, binding corporate rules or a binding agreement giving adequate protection substantially similar to POPIA; or you consent; or it is necessary to perform our agreement with you.

Some of the services we use may store or process information outside South Africa. For each one, the table says where your information goes and how it is protected. Where it leaves South Africa, we have assessed the recipient's protection as adequate (section 72(1)(a)), and recorded that assessment in writing.

Service	Likely location	Level of protection
App and database	South Africa	Your record is kept on a server in South Africa. It does not leave the country
Backup (Amazon Web Services)	South Africa (Cape Town)	The backup is encrypted before it leaves our server, and stays in AWS's Cape Town region. It does not leave the country
WhatsApp Business (Meta), including automated messages	Outside South Africa (the United States and elsewhere)	Meta processes our messages as our operator, under its WhatsApp business data-processing terms. We have assessed that protection as adequate (section 72(1)(a)), and you also agree to WhatsApp on the Electronic Communications Consent form
Cloudflare	Worldwide network	Your booking and intake forms pass through Cloudflare, encrypted, on their way to our server. It carries them and does not store their contents. We have assessed its protection as adequate (section 72(1)(a))
Google Maps	Outside South Africa (Google's servers)	The map loads from Google only when you scroll to it. Your browser then sends your IP address and browser details straight to Google, which handles them under its own privacy terms
NetPractice	Mainly South Africa	NetPractice hosts in South Africa. Some of its own service providers are abroad (for example Microsoft in Ireland and Twilio in the United States), and its operator agreement allows this only where section 72 is met
SMS provider	To be confirmed	This row will name the provider, where it stores messages and how they are protected
Email provider (domains.co.za, DiaMatrix CC)	South Africa (Teraco, Johannesburg)	Practice email is on wilanahattingh.co.za and stored in South Africa. The provider's operator agreement allows it to use service providers abroad only where the law permits. Its DNS runs through Cloudflare, which does not hold the mail

• Access is limited to Dr Hattingh, and to anyone she formally authorises in writing
• Records are stored in an access-controlled, encrypted system, with encryption in transit and at rest
• You verify your identity by one-time PIN before you can see or sign anything
• The app keeps an audit trail of who looked at what, and when
• Backups are encrypted
• Any paper record is kept locked
• Doctors are bound by professional confidentiality independently of POPIA (National Health Act section 14; HPCSA Booklet 5), and POPIA section 32(2) requires exactly that

If something goes wrong. If your information is accessed or acquired by someone who should not have it, POPIA section 22 requires us to tell the Information Regulator and to tell you, as soon as reasonably possible after we discover it. There is no fixed 72-hour deadline in POPIA. We will tell you what happened, what information was involved, what we are doing about it, and what you can do to protect yourself.

Record	How long
Your clinical record, generally	At least 6 years from the date it becomes dormant — that is, from your last visit (HPCSA Booklet 9 §7)
A child's record	Until the child turns 21
The record of a patient who is mentally incapacitated	For that person's lifetime
Records under the Occupational Health and Safety Act	20 years
Records of long-latency occupational exposure	At least 25 years
Schedule 1–6 medicine records	At least 5 years (Medicines Act General Regulation 35)
Financial and tax records	At least 5 years from the date the relevant tax return is submitted, and longer while a SARS audit, objection or appeal is open (Tax Administration Act sections 29 and 32)
Consent and signature audit records	For as long as the clinical record they relate to

After the retention period, records are securely destroyed. We do not keep information "just in case".

Under POPIA section 5 you have the right to:

1. Be told what we collect and why — that is what this notice is for (section 18)
2. Be told if your information has been accessed by someone unauthorised (section 22)
3. Ask whether we hold information about you, and ask for a copy (section 23, and PAIA)
4. Ask us to correct or delete information that is wrong, misleading, out of date, incomplete or held without proper grounds (section 24)
5. Object to processing, on reasonable grounds relating to your situation (section 11(3)(a))
6. Object at any time to direct marketing, free of charge (sections 11(3)(b) and 69)
7. Not be subject to a decision based only on automated processing that has legal consequences for you (section 71)
8. Complain to the Information Regulator (section 74)
9. Take civil action if your rights under POPIA are interfered with (section 99)

A note on correcting clinical records. You may always ask us to correct a factual error — a wrong date of birth, a wrong allergy, a wrong scheme number — and we will fix it. A clinical opinion recorded at the time is a different thing: we cannot delete or rewrite a professional observation that was honestly made, because the record has to reflect what actually happened. What we can do is record your disagreement in the file, alongside the original entry, so that anyone reading it sees both.

How to exercise a right. Contact the Information Officer using the details in section 1. Where PAIA applies, we will ask you to use the prescribed form and we will respond within the PAIA time limits. Our PAIA manual sets out the full procedure.

Our PAIA manual (version 1.0, approved 26 September 2026) is available at the practice and on this website: PAIA manual.

If you are not satisfied with how we have handled your information, you may complain directly to the Regulator. You do not need to come to us first, although we would like the chance to fix it.

Information Regulator (South Africa)
Woodmead North Office Park, 54 Maxwell Drive, Woodmead, Johannesburg
PO Box 31533, Braamfontein, Johannesburg, 2017
Telephone: 010 023 5200
Website: inforegulator.org.za
Complaints: online, through the Regulator's eServices portal at eservices.inforegulator.org.za (POPIA Complaints)
General enquiries: [email protected]

You may also complain about Dr Hattingh's professional conduct to the HPCSA, and about a medical scheme's conduct to the Council for Medical Schemes.

If we change how we use your information, we will publish an updated notice and, where the change is significant, tell you directly. The version and date at the top of this notice always tell you which version you are reading.