Privacy Policy & Protection of Personal Information

This Privacy Policy outlines how Gebe Orthotic & Prosthetic Services (referred to as "the Practice", "we", "us", or "our") collects, uses, processes, stores, and protects your personal and special personal information in accordance with the Protection of Personal Information Act 4 of 2013 (POPIA) and the Health Professions Council of South Africa (HPCSA) guidelines.

---

1. POPIA Commitment & Information Officer

As a registered healthcare practice(0947725) operating in Mdantsane and King William's Town, Eastern Cape, we act as a Responsible Party under POPIA. We process personal and health-related data lawfully, reasonably, and in a transparent manner that does not infringe upon the privacy rights of our patients.

2. Information We Collect

To deliver specialized orthotic and prosthetic rehabilitation, process medical scheme claims, and maintain dynamic patient communications, we collect and process the following categories of data:

• General Personal Information: Full legal name, South African ID or Passport number, physical address, mobile phone number, and email address.
• Special Personal Information (Health & Clinical Data): Medical history, diagnosis, doctor's referral letters, biomechanical evaluation metrics, limb measurement specifications, diagnostic imaging reports (X-rays, MRI scans), and clinical progress notes.
• Medical Scheme & Financial Information: Medical scheme name, membership number, main member details, dependant codes, SAOPA tariff code claims history, and authorization reference numbers.

3. Purpose & Lawful Basis for Data Processing

Under Section 11 and Section 32 of POPIA (which permits healthcare professionals to process health data for medical treatment), your data is processed strictly for the following purposes:

• Formulating custom orthotic and prosthetic treatment and device fabrication plans.
• Fulfilling clinical motivations and submitting pre-authorisation requests and SAOPA tariff claims directly to medical schemes (e.g., Discovery Health, GEMS, Bonitas, Momentum, Medshield, COID, RAF).
• Dispatching operational updates, booking confirmations, and appointment reminders via automated SMS notifications (powered by SMSPortal).
• Maintaining formal medical record archives as required by the HPCSA and the National Health Act 61 of 2003.

4. Third-Party Disclosures & Operator Agreements

We do not sell, rent, or monetize your personal data. Disclosures are strictly restricted to necessity-based clinical, administrative, and technological requirements:

• Medical Practitioners: Sharing treatment status or clinical feedback with your referring GP, Orthopaedic Surgeon, Neurologist, or Physiotherapist.
• Medical Schemes & Clearinghouses: Submitting pre-authorisation files and billing data to facilitate claim reimbursements.
• Service Operators: Encrypted communication gateways (such as SMSPortal) strictly for dispatching appointment notifications. All third-party operators are bound by operator agreements adhering to Section 20 and 21 of POPIA.

5. Technical & Organizational Security Measures

We maintain rigorous physical, technical, and administrative security measures to protect your personal information against unauthorized access, loss, damage, or destruction:

• Digital Security: Encrypted SQL database infrastructure, secure HTTPS protocols across all web applications, restricted administrative access controls, and firewall defenses.
• Physical Security: Physical clinical record files are kept in lockable storage units accessible only by authorized administrative and clinical staff.

6. Data Retention Period (HPCSA & POPIA)

In compliance with HPCSA Ethical Guidelines (Booklet 9) and Section 14 of POPIA, medical and clinical records are retained for a minimum of 6 years from the date they were generated, or in the case of minor/paediatric patients, until the patient reaches the age of 21.

7. Your Legal Rights Under POPIA

As a data subject, you have the following rights regarding your personal information held by our practice:

• Right to Access: Request confirmation or a copy of the personal information we hold about you (subject to Section 51 PAIA manual protocols).
• Right to Rectification: Request the correction, updating, or destruction of inaccurate, incomplete, or outdated personal details.
• Right to Object: Object to the processing of your personal information on reasonable grounds, unless statutory retention requirements apply.
• Right to Complain: File a complaint with the South African Information Regulator if you believe your POPIA rights have been infringed.

8. Direct Communication & Automated SMS Consent

By submitting an appointment request or contacting our practice through this web portal, you explicitly consent to receiving transactional SMS communications regarding booking status, appointment reminders, and clinical updates via our integration with SMSPortal. You may opt out of promotional messages at any time; however, transactional appointment notifications remain necessary for care delivery.

---

The Information Regulator (South Africa)

If you wish to escalate a privacy concern beyond our Information Officer, you may contact the Information Regulator directly:
Website: inforegulator.org.za
Email Enquiries: enquiries@inforegulator.org.za | POPIA Complaints: POPIAComplaints@inforegulator.org.za