Privacy policy

1. Introduction

The Obesity Health Centre (“OHC”, “we”, “us” or “our”) respects your privacy and is committed to protecting your personal information.

This Privacy Policy explains how we collect, use, store, share and protect personal information when you:

• Visit our website;
• Contact us or submit an online enquiry;
• Request an appointment;
• Register for or receive healthcare-related services;
• Communicate with our healthcare professionals or administrative team; or
• Subscribe to receive news, educational material or other communications.

We process personal information in accordance with the Protection of Personal Information Act 4 of 2013 (“POPIA”), the Promotion of Access to Information Act 2 of 2000 (“PAIA”), and other applicable South African laws and professional obligations.

2. Responsible party

The responsible party for the processing of personal information described in this Privacy Policy is:

• Legal entity: Obesity Health Centre Pty Ltd
• Trading name: Obesity Health Centre
• Registration or practice number: 0441945
• Physical address: Zuid-Afrikaans Hospital, 255 Bourke St, Muckleneuk, Pretoria, 0181
• Telephone: +27 12 346 5639
• Email: bariatrics@obesityhealthcentre.co.za
• Website: www.obesityhealthcentre.co.za

3. Information Officer

Questions or requests relating to your personal information may be directed to our Information Officer:

• Information Officer: Hesme Kruger
• Email: bariatrics@obesityhealthcentre.co.za
• Telephone: +27 12 346 5639
• Physical address: Zuid-Afrikaans Hospital, 255 Bourke St, Muckleneuk, Pretoria, 0181

4. Personal information we may collect

Depending on how you interact with us, we may collect the following information:

4.1 Identification and contact information

• Full name and surname;
• Identity number or date of birth, when required;
• Telephone number;
• Email address;
• Residential or postal address;
• Preferred method of communication; and
• Emergency-contact or next-of-kin details.

4.2 Health and medical information

Because OHC provides healthcare-related services, we may process special personal information concerning your health, including:

• Current and previous health conditions;
• Medical and surgical history;
• Weight, height, body mass index and other health measurements;
• Medication and supplement information;
• Allergies;
• Laboratory and diagnostic test results;
• Information concerning previous or planned treatment;
• Medical-aid information;
• Referral information;
• Consultation notes;
• Dietary, psychological or lifestyle information; and
• Other information reasonably required to assess, coordinate or provide your care.

Health information submitted through the website should be limited to what is reasonably necessary for your enquiry or requested service.

4.3 Financial and administrative information

We may collect:

• Billing details;
• Medical-aid membership details;
• Payment status and transaction references;
• Invoices and account records; and
• Information required for funding or payment arrangements.

Payment-card information may be processed directly by an authorised third-party payment provider. OHC should not retain complete card details unless it is lawfully and securely authorised to do so.

4.4 Website and technical information

When you use our website, we may automatically collect:

• Internet Protocol address;
• Browser and device type;
• Operating system;
• Pages visited;
• Date, time and duration of visits;
• Referring website;
• General location information; and
• Cookie or similar technology identifiers.

4.5 Communications

We may retain emails, online enquiries, telephone records, consent records and other communications exchanged with you.

5. How we collect personal information

We may collect information:

• Directly from you;
• Through website forms, email, telephone, messaging services or consultations;
• From a parent, guardian, caregiver or authorised representative;
• From referring doctors, hospitals, laboratories, dietitians, psychologists or other healthcare professionals;
• From medical schemes, funders or payment providers;
• From publicly available sources where lawful and appropriate; or
• Automatically through cookies and website technologies.

Where information is collected from another source, we will do so only where permitted by law and where the information is relevant to the services being provided.

6. Why we process personal information

We may process personal information to:

• Respond to questions and enquiries;
• Arrange, confirm and manage appointments;
• Assess your suitability for healthcare services or treatment;
• Provide, coordinate and monitor multidisciplinary care;
• Maintain accurate clinical and administrative records;
• Communicate with members of your healthcare team;
• Obtain or verify medical-aid or funding information;
• Process accounts, payments and refunds;
• Issue invoices and financial records;
• Refer you to another healthcare professional or service provider;
• Provide patient education and support;
• Manage consent forms and patient documentation;
• Improve our services and website;
• Maintain website security and prevent fraud or misuse;
• Meet legal, regulatory, ethical and professional obligations;
• Respond to lawful requests from regulators or authorities;
• Establish, exercise or defend legal claims; and
• Send marketing or educational communications where permitted.

We will not use your personal information for a purpose that is incompatible with the purpose for which it was collected unless permitted by law or with your further consent.

7. Lawful grounds for processing

We process personal information when:

• You have provided consent;
• Processing is necessary to provide a service or perform an agreement with you;
• Processing is necessary to comply with a legal or professional obligation;
• Processing protects your legitimate interests or those of another person;
• Processing is necessary for the proper performance of a public-law duty, where applicable; or
• Processing is necessary to pursue our legitimate interests or those of a third party, provided that your rights and interests are appropriately protected.

We process health information only where permitted under POPIA, including where processing is necessary for treatment, care, administration of healthcare services or compliance with legal and professional duties.

8. Voluntary and mandatory information

You may choose whether to provide certain information. However, some information may be required to:

• Respond meaningfully to an enquiry;
• Confirm an appointment;
• Assess your healthcare needs;
• Provide safe and appropriate care;
• Process payment or funding arrangements; or
• Meet legal and clinical recordkeeping requirements.

If required information is not provided, we may be unable to offer or complete the requested service.

9. Sharing personal information

We may share relevant personal information with:

• Doctors, surgeons, nurses, dietitians, psychologists and other members of your multidisciplinary healthcare team;
• Hospitals, laboratories, pharmacies and diagnostic service providers;
• Medical schemes, funders and authorised payment providers;
• Website hosting, information technology, cloud-storage and cybersecurity providers;
• Appointment, communication and patient-management service providers;
• Accountants, auditors, insurers and professional advisers;
• Regulatory bodies, courts or public authorities where legally required; and
• Other parties where you have authorised us to share the information.

We require service providers processing information on our behalf to protect it, maintain confidentiality and use it only for authorised purposes.

OHC does not sell personal information.

10. Direct marketing and communications

We may send you healthcare information, newsletters, service updates or promotional communications only where permitted by POPIA. Where consent is required, we will request it before sending unsolicited electronic marketing. Existing patients may receive communications about services similar to those previously obtained, where permitted by law.

You may opt out at any time by:

• Clicking the unsubscribe link in an email;
• Replying “STOP” where that option is provided; or
• Contacting us using the details in this policy.

Opting out of marketing will not prevent us from sending necessary appointment, account, safety or healthcare-related communications.

11. Cookies and website analytics

Our website may use cookies and similar technologies to:

• Enable essential website functions;
• Remember preferences;
• Maintain website security;
• Understand how visitors use the website;
• Measure website performance; and
• Support approved marketing activities.

Where required, non-essential cookies will be used only after you have made a selection through the website’s cookie notice.

You can block or delete cookies through your browser settings. Disabling certain cookies may affect website functionality.

The website’s cookie notice should identify the actual analytics, advertising, embedded-media and third-party services used on the website.

12. Third-party websites

Our website may contain links to external websites, social-media platforms or third-party services. OHC is not responsible for the privacy or security practices of those parties.

You should review the privacy policy of any third-party website before submitting personal information.

13. Children’s personal information

Our services and website are primarily intended for adults.

Where we process the personal information of a child, we will do so only:

• With the consent of a competent person, such as a parent or legal guardian;
• Where permitted or required by law;
• Where necessary to establish, exercise or defend a right or obligation; or
• Under another lawful authorisation.

Parents and guardians should supervise children’s use of the website and should not allow a child to submit health or contact information without appropriate assistance and consent.

14. Information security

We take reasonable and appropriate technical and organisational measures to protect personal information against:

• Loss or damage;
• Unauthorised access;
• Unlawful processing;
• Accidental destruction;
• Alteration;
• Disclosure; and
• Misuse.

These measures may include access controls, authentication, secure systems, confidentiality obligations, staff awareness, backups, encryption where appropriate and oversight of service providers.

No internet transmission or electronic storage system is completely secure. Users should avoid submitting unnecessary medical information through unsecured email or general website forms.

15. Security compromises

If we reasonably believe that your personal information has been accessed or acquired by an unauthorised person, we will investigate and take appropriate steps.

Where required by POPIA, we will notify the Information Regulator and affected individuals as soon as reasonably possible, subject to any lawful instruction that notification be delayed.

16. Retention of information

We retain personal information only for as long as:

• It is needed for the purpose for which it was collected;
• Required by applicable healthcare, tax, corporate or other legislation;
• Required by professional or ethical recordkeeping rules;
• Necessary for the establishment, exercise or defence of legal claims; or
• You have consented to its continued retention.

Clinical records may need to be retained for legally or professionally prescribed periods. When information is no longer required, we will securely delete, destroy or de-identify it, subject to applicable law.

17. Cross-border processing

Some website, communication, cloud-hosting or technology providers may store or process information outside South Africa.

Where personal information is transferred outside South Africa, we will take reasonable steps to ensure that the recipient is subject to:

• A law, binding agreement or corporate rules providing an adequate level of protection;
• Terms requiring protection substantially similar to POPIA;
• Your consent, where appropriate; or
• Another lawful basis permitted by POPIA.

18. Automated decision-making

OHC will not subject you to a decision based solely on automated processing that has legal or similarly significant consequences, unless the decision is permitted by law and suitable safeguards are in place.

Clinical and treatment decisions remain subject to assessment by appropriately qualified healthcare professionals.

19. Your rights

Subject to applicable law, you may:

• Ask whether we hold personal information about you;
• Request access to your personal information;
• Request correction of inaccurate, incomplete, excessive, outdated or misleading information;
• Request deletion or destruction of information that we are no longer authorised to retain;
• Object to certain processing;
• Withdraw consent where processing is based on consent;
• Object to direct marketing;
• Request information about the identity of third parties who have had access to your information, where applicable; and
• Lodge a complaint with the Information Regulator.

Some rights may be limited by healthcare-recordkeeping duties, confidentiality obligations, the rights of others or other legal requirements.

To exercise your rights, contact our Information Officer. We may request proof of identity before processing your request.

20. Complaints

Please first direct privacy concerns to our Information Officer so that we have an opportunity to investigate and respond.

You may also lodge a complaint with the South African Information Regulator:

• Information Regulator South Africa
• Website: inforegulator.org.za (opens in a new tab)
• Complaints email: POPIAComplaints@inforegulator.org.za
• General enquiries: enquiries@inforegulator.org.za
• Telephone: 010 023 5200
• Address: JD House, 27 Stiemens Street, Braamfontein, Johannesburg, 2001

The Information Regulator’s contact information should be verified on its official website before this policy is published.

21. Changes to this policy

We may update this Privacy Policy to reflect changes in our services, systems, legal obligations or privacy practices.

The updated version will be published on this website with a revised “Last updated” date. Material changes may also be communicated through other appropriate channels.

22. Contact us

For privacy-related enquiries, requests or complaints, contact:

• Obesity Health Centre Information Officer
• Name: Hesme Kruger
• Email: bariatrics@obesityhealthcentre.co.za
• Telephone: +27 12 346 5639
• Physical address: Zuid-Afrikaans Hospital, 255 Bourke St, Muckleneuk, Pretoria, 0181