Privacy Policy [Effective Date 01.02.25]

1. About This Policy

This Privacy Policy explains how [Equine Insight Counselling] ("the Practice," "we," "us") handles personal information.

If you are visiting our website, the information you need is in Section 2 below.

If you are a patient or client receiving healthcare services from us, the full policy (Sections 2–15) applies to all information we process, both online and in our practice.

We are a registered healthcare practitioner under the Health Professions Act (No. 56 of 1974) and are regulated by the Health Professions Council of South Africa (HPCSA). We are committed to protecting your privacy in accordance with:

• The Protection of Personal Information Act, No. 4 of 2013 ("POPIA")

• The National Health Act, No. 61 of 2003 ("NHA")

• The HPCSA Ethical and Professional Rules (particularly Rules 13 and 27A)

• The HPCSA Guidelines for Good Practice (including Booklet 5: Confidentiality and Booklet 9: Keeping of Patient Records)

• The Constitution of the Republic of South Africa, 1996 (Section 14)

2. Website Privacy

This section applies to anyone who visits our website or submits our contact form.

What we collect:

• The information you voluntarily provide through our contact form (name, email address, and your message)

• Basic technical data collected automatically (IP address, browser type, and device information)

What we use it for:

• Responding to your enquiry

• Maintaining the security and functionality of our website

What we do NOT do:

• We do not sell, rent, or share your contact form details with third parties

• We do not use your submission to send marketing or promotional communications unless you have separately and explicitly opted in

• We do not use tracking or advertising cookies

• We do not collect or process any health information through our website

Security:

• Our website uses HTTPS/SSL encryption to protect data in transit

• Contact form submissions are stored securely and deleted after a reasonable period (typically 6–12 months)

Your rights regarding website data:

• You may request access to, correction of, or deletion of any information you submitted through our contact form by contacting the Information Officer (Section 14)

Links to other websites:

Our website may contain links to other websites that are not owned or controlled by us. Please be aware that we are not responsible for such other websites or third parties' privacy practices. We encourage you to be aware when you leave our website and read the privacy statements of each website that may collect personal information.

3. Broader Processing in Our Practice

If you are a patient or client of the Practice, the sections below explain how we collect, use, store, and protect your personal information in the course of providing healthcare services. This includes information collected in person, by phone, by email, or through our practice management systems.

4. Information Officer

In terms of POPIA Section 52, our Information Officer is:

[Tara du Plessis], [Registered Counsellor]
[taracounsels@gmail.com]

The Information Officer is responsible for ensuring the Practice's compliance with POPIA and is the point of contact for any privacy-related enquiries or complaints.

5. What Personal Information We Collect

We collect the following categories of personal information:

Identity information: Full name, ID number, date of birth, gender, marital status Contact information: Home address, postal address, telephone number, email address Financial information: Medical scheme number, banking details (for payments) Health information: (special personal information) Medical history, diagnoses, symptoms, prescriptions, mental health information Referral information: Details received from or sent to other healthcare practitioners involved in your care.

Note on health information: Health information is classified as special personal information under POPIA Section 26. We process this information only where it is necessary for the provision of healthcare services, with your explicit consent, or as required by law.

6. How We Collect Your Information

We collect your personal information:

• Directly from you (in person, by phone, by email, or via our website contact form)

• From your medical scheme or insurer (for claim submissions)

• From other healthcare practitioners who refer you or whom we refer you to

7. Purposes for Which We Process Your Information

We process your personal information for the following purposes:

1. Provision of healthcare services – diagnosing, treating, and managing your health condition

2. Administrative purposes – scheduling appointments, maintaining patient records, managing correspondence

3. Billing and claims – submitting claims to your medical scheme, processing payments, and debt collection

4. Referrals – sharing relevant information with other healthcare practitioners involved in your care (with your consent)

5. Legal and regulatory compliance – complying with the HPCSA, the Medical Schemes Act, and other applicable legislation

6. Research and education – only with your explicit written consent, and only in anonymised form where possible

We do not sell, rent, or share your personal information for marketing purposes without your explicit consent.

8. Legal Basis for Processing

In terms of POPIA, we process your personal information on the following legal bases:

Section 11(1)(b) – necessary for the performance of a contract to which you are a party, Special personal information (health data) Section 26(1)(a) – explicit consent, or necessary for the provision of healthcare, Billing and medical scheme claims Section 11(1)(c) – necessary for compliance with a legal obligation, Record-keeping Section 11(1)(c) – required by HPCSA Ethical Rule 27A , Responding to website enquiries Section 11(1)(b) – necessary for pre-contractual measures, Research (if applicable)Section 26(1)(a) – explicit consent

9. Consent

• General consent: By attending a consultation or engaging our services, you consent to the processing of your personal information for the purposes stated in this policy.

• Special personal information (health data): We will obtain your explicit, written consent before processing special personal information, as required by POPIA Section 26. This is typically done through a consent form at your first consultation.

• You may withdraw consent at any time by contacting the Information Officer. However, withdrawal may affect our ability to provide certain services.

10. Disclosure of Your Information

We will not disclose your personal information to third parties without your consent, except in the following circumstances (as required by HPCSA Rule 13 and the NHA):

1. With your express consent (written or verbal, recorded in your file)

2. To other healthcare practitioners involved in your care (e.g., referring doctor, specialist, pharmacist, laboratory) – limited to the minimum information necessary

3. To your medical scheme or insurer – for the purpose of claim submission, with your consent

4. As required by law – e.g., a court order, a statutory provision, or a requirement of a regulatory body

5. In the public interest – where non-disclosure would pose a serious threat to public health or safety, or where a court or the HPCSA requires disclosure

6. To our Information Officer or legal representatives – for the purpose of compliance, dispute resolution, or legal proceedings

In all cases, we will:

• Seek your consent wherever possible

• Anonymise data where unidentifiable data will serve the purpose

• Keep disclosures to the minimum necessary

11. Security Measures

We implement the following security measures to protect your personal information:

• Physical security: Physical patient records are stored in locked, access-controlled filing cabinets. Only authorised personnel have access.

• Electronic security: Electronic records are stored on password-protected systems. Access is limited to authorised staff on a need-to-know basis.

• Transmission security: Our website uses HTTPS/SSL encryption.

• Staff confidentiality: All staff and agents who handle patient information are bound by confidentiality obligations.

• Access controls: Electronic systems use unique user IDs, strong passwords, and role-based access.

• Backups: Records are backed up securely in accordance with HPCSA Booklet 9 guidelines.

These measures are consistent with the National Health Act Section 17(1) and POPIA Section 19.

12. Retention of Your Information

In terms of HPCSA Ethical Rule 27A and Booklet 9 (Keeping of Patient Records):

• Patient health records are retained for a minimum of six (6) years from the date of the last entry, or indefinitely where electronic storage makes this practical.

• Records relating to minors are retained until the minor reaches the age of majority plus six years.

• Administrative and financial records are retained for a minimum of five (5) years as required by tax and financial legislation.

• Information collected via our website contact form is retained only for as long as necessary to respond to your enquiry (typically 6–12 months), after which it is deleted or anonymised.

We will not retain your personal information longer than necessary for the purposes for which it was collected, unless required by law.

13. Your Rights

In terms of POPIA Sections 49–51, you have the following rights:

Right to know: You may request to know whether we hold your personal information Right of access: You may request a copy of your personal information held by us Right to correction: You may request that we correct or update inaccurate or incomplete information Right to deletion: You may request that we delete your information, unless we are legally required to retain it Right to object: You may object to the processing of your information in certain circumstances Right to complain: You may lodge a complaint with the Information Regulator if you believe we have violated your rights under POPIA

To exercise any of these rights, please contact the Information Officer at the details in Section 4. We may charge a reasonable administrative fee for formal access requests, as provided for under PAIA.

14. Complaints

If you have a concern about how we handle your personal information:

1. First, please contact our Information Officer directly at [taracounsels@gmail.com]. We will make every effort to resolve your concern promptly.

2. If unresolved, you may lodge a complaint with:

   • The Information Regulator of South Africa (www.inforeg.org.za) – for POPIA complaints

15. Changes to This Policy

We may update this Privacy Policy from time to time to reflect changes in legislation, our practices, or the services we offer. The updated policy will be posted on this page with a revised "Effective date." We recommend that you review this policy periodically.

This Privacy Policy should be read in conjunction with our PAIA Manual.