POPIA Section 51 Manual

Effective: 1 April 2026

Prepared in accordance with Section 51 of the Promotion of Access to Information Act 2 of 2000 ("PAIA"), as amended, read with Section 17 of the Protection of Personal Information Act 4 of 2013 ("POPIA").

1. Introduction and Purpose

This manual is published in compliance with Section 51 of the Promotion of Access to Information Act 2 of 2000 ("PAIA") and Section 17 of the Protection of Personal Information Act 4 of 2013 ("POPIA"). Its purpose is to:

• Inform the public about the categories of records held by the practice and the purposes for which personal information is processed.
• Provide details on how to submit a request for access to records under PAIA.
• Outline the rights of data subjects under POPIA.
• Describe the security measures in place to protect personal information.

2. Contact Details of the Responsible Party

3. Information Officer

4. Guide on How to Use PAIA (Section 10 Guide)

The South African Human Rights Commission ("SAHRC") has compiled a guide in terms of Section 10 of PAIA to assist persons who wish to exercise their right of access to information. This guide is available from the SAHRC:

• Website: www.sahrc.org.za
• Telephone: 011 877 3600
• Email: [email protected]
• Physical Address: Forum 3, Braampark Office Park, 33 Hoofd Street, Braamfontein, 2017

5. Categories of Records Held

The practice holds records in the following categories. Not all records are automatically available for access; requests are assessed on a case-by-case basis in accordance with PAIA.

5.1 Patient Records

• Patient registration and demographic information
• Clinical records (consultation notes, diagnoses, treatment plans, prescriptions)
• Pathology and radiology results
• Referral letters and specialist correspondence
• Consent forms and signed agreements
• Medical aid and billing information
• Appointment history
• Communication records (emails, SMS reminders)

5.2 Employee and Human Resources Records

• Employment contracts and personnel files
• Payroll and tax records (IRP5, UIF)
• Leave records
• Disciplinary records
• Training and development records

5.3 Financial Records

• Accounting records, invoices, and receipts
• Bank statements and payment records
• Tax returns and SARS correspondence
• Medical aid claim submissions and remittance advices
• Insurance policies

5.4 Operational and Correspondence Records

• Supplier and service provider agreements
• Lease agreements
• IT and software licensing agreements
• General correspondence with patients, suppliers, and third parties
• Website enquiries and contact form submissions
• HPCSA and regulatory correspondence

6. Purpose of Processing Personal Information

We process personal information for the following purposes:

• Providing healthcare services (diagnosis, treatment, care management)
• Processing medical aid claims and billing
• Complying with legal and regulatory obligations (HPCSA, NHA, tax legislation)
• Communicating with patients (appointment reminders, results, follow-ups)
• Managing human resources and employment relationships
• Maintaining operational and financial records
• Ensuring the security and integrity of our systems and premises
• Improving the quality of our services

For a comprehensive description, please refer to our Privacy Policy.

7. Information Security Measures

We have implemented appropriate technical and organisational measures to safeguard personal information, including:

• Encrypted data transmission (TLS/SSL) and encrypted storage at rest
• Role-based access controls and strong authentication for all systems
• Regular software updates, patching, and vulnerability assessments
• Firewalls and network security monitoring
• Physical security at our premises (locked storage, controlled access)
• Confidentiality agreements for all staff members
• Regular staff training on data protection and information security
• Data breach response procedures, including notification to the Information Regulator and affected persons where required
• Contracts with all operators (third-party processors) to ensure adequate protection of personal information

8. Objection to Processing of Personal Information

A data subject may, on reasonable grounds, object to the processing of their personal information in terms of Section 11(3) of POPIA. To lodge an objection, please submit a written request to the Information Officer at the contact details provided in Section 3 above.

The Information Officer will consider the objection and respond in writing within 30 days. Please note that in certain cases, processing may continue despite the objection if there is a legal obligation or other lawful ground to do so (for example, where processing is necessary to comply with HPCSA record-keeping requirements).

9. Request Procedures

To request access to records held by the practice, you may submit a request using the prescribed Form A (Request for Access to Record of Private Body) in terms of Section 53(1) of PAIA. An interactive version of this form is available on our PAIA Manual page.

Requests may be submitted:

• By email to [email protected]
• By hand delivery to Suite 12, Prince Vintcent Square, Gloucester Avenue, George, 6530
• By post to the same address

A prescribed request fee and, where applicable, an access fee may be payable. The applicable fees are set out in our PAIA Manual.

10. Availability of This Manual

This manual is available:

• On the NeoHealth website at myneohealth.co.za/popi-manual
• For inspection at our premises during normal business hours, free of charge
• A copy may be requested from the Information Officer (a reasonable reproduction fee may apply)
• It has been submitted to the Information Regulator as required by POPIA

11. Updates

This manual will be reviewed and updated as necessary to ensure ongoing compliance with PAIA and POPIA. The latest version will always be available on this page.