Manual prepared in terms of
• Section 51 of the Promotion of Access to Information Act 2 of 2000 (“PAIA”)
• Section 17 of the Protection of Personal Information Act 4 of 2013 (“POPIA”)
Version: 1.7 | Date: 15 May 2025
1. Introduction
This manual explains what records are held by Clinical Psychology Practice (“the Practice”), how you may request access to those records under PAIA, and how the Practice processes personal information under POPIA.
2. Information Officer details
| Name | Mr Gustaf Pretorius, Clinical Psychologist (Independent Practice) |
|---|---|
| Information-Officer registration | Certificate No 2025-006159 – issued 15 May 2025 |
| Physical address | 621 Olivia Street Garsfontein Pretoria 0042 |
| Telephone | 0823202726 |
| Email (preferred) | privacy@psydev.co.za |
3. Statutory framework
- PAIA 2 of 2000
- POPIA 4 of 2013
- HPCSA Ethical Rules & Booklet 5 (Confidentiality)
4. Guide of the Information Regulator
The PAIA Guide (section 10) is available on inforegulator.org.za or by email to enquiries@inforegulator.org.za.
5. Records automatically available (no PAIA request required)
- Practice profile and services (website)
- Privacy Notice
- This PAIA/POPIA manual
- Information-Officer certificate
6. Records held by the Practice
| Category | Data subjects | Purpose |
|---|---|---|
| Clinical files | Patients | Diagnosis, treatment, continuity of care |
| Billing / medical-aid | Patients; Medical schemes | Invoicing, reimbursement, debt collection |
| Practice-management | Suppliers; Operators; Referrers | Administration, compliance, contracts |
| Research / teaching (anonymised) | Patients (de-identified) | Academic presentation, supervision, conference papers |
7. Requesting access to records (PAIA)
- Complete PAIA Form 02 or write a letter containing the same information.
- Email it to privacy@psydev.co.za or deliver it to the physical address above, together with the prescribed fee (if applicable).
- The Practice will acknowledge receipt within 2 working days and respond within 30 calendar days.
Fees are those in Government Notice R.757 of 2021. Requests for your own personal information carry no request fee.
8. Grounds for refusing access
Access may be refused on any ground permitted by Chapter 4 of PAIA – for example, to protect third-party privacy or to preserve psychologist-patient privilege.
9. POPIA disclosure – processing of personal information
| Item | Details |
|---|---|
| Purpose | Psychological services; invoicing; legislative compliance; de-identified research. |
| Legal basis | Patient consent; National Health Act 61/2003; Health Professions Act 56/1974; POPIA s11(1)(a),(c),(d). |
| Recipients / Operators | Xneelo (hosting); EKB Billing; Apple iCloud; Dropbox; ProtonDrive; debt-collector. |
| Cross-border transfers | Encrypted storage in the EU/US (iCloud, Dropbox) and Switzerland (ProtonDrive) under SCCs and explicit patient consent. |
| Security measures | Device encryption; 2-factor authentication; locked cabinets; operator agreements; breach-response SOP. |
| Retention periods | Clinical notes – minimum 6 y (12 y for minors); Billing records – 5 y; Voice notes – deleted after transcription & 6-year dormancy. |
| Data-subject rights | Access, correction, deletion (where lawful), objection, complaint to the Information Regulator. |
10. Security-compromise procedure
Any unauthorised access, loss or disclosure of personal information will be reported to the Information Regulator and affected data subjects “as soon as reasonably possible” via the online Security Compromise Notification Portal (POPIA s22).
11. Availability of the manual
- Inspection at the Practice (free of charge)
- Online at https://www.psydev.co.za/manual
- Download PDF or request by email to privacy@psydev.co.za
12. Revision history
| Date | Version | Change | Approved by |
|---|---|---|---|
| 15 May 2025 | 1.0 | Initial issue (combined PAIA/POPIA manual) | Information Officer |