Privacy Policy

This Privacy Policy explains how Dr GM Monama's practice ("the Practice", "we", "us") collects, uses, and protects your personal information in accordance with the Protection of Personal Information Act 4 of 2013 ("POPIA").

1. Information We Collect

When you submit a booking or become a patient, we may collect:

• Identifying information (name, ID/passport number, date of birth, gender, population group)
• Contact information (email, phone number, residential address)
• Health information (symptoms, medical history, consultation notes, diagnoses, treatment plans)
• Medical aid and billing information
• Referring doctor details, where applicable

When you use our contact form, we collect your name, email address and message so that we can reply to you.

2. Why We Collect It

We process your personal information to:

• Schedule, confirm, and manage your appointments
• Provide clinical diagnosis, treatment, and surgical care
• Generate prescriptions, sick notes, and referral correspondence
• Communicate appointment reminders and practice updates
• Process billing and medical aid claims
• Comply with legal and regulatory record-keeping obligations (HPCSA, POPIA)

3. Special Personal Information

Health information is "special personal information" under POPIA. We only process it for the purposes described above, with your explicit consent given at the time of booking, and we apply appropriate technical and organisational safeguards (including encryption and access controls) to protect it.

4. Who We Share It With

We may share your information with:

• Partner hospitals, for the purpose of scheduling and conducting surgical procedures
• Your referring doctor, where you have been referred to the Practice
• Your medical aid scheme, for claims processing
• Service providers who process data on our behalf (e.g. email and hosting providers), under appropriate confidentiality terms

We do not sell your personal information to third parties.

5. Where Your Information Is Stored

Your information is stored and processed using cloud infrastructure provided by Cloudflare, Inc., in data centres located in the European Economic Area, and may therefore be processed outside South Africa. Appointment and account emails are sent through Resend (United States). We transfer personal information outside South Africa only as permitted by section 72 of POPIA: where the recipient is subject to law or binding agreements providing an adequate level of protection, or with your consent, which you give when you accept this policy at booking. Your information is encrypted in transit and at rest.

6. Data Retention

We retain patient records for the period required by South African health record retention regulations and HPCSA guidelines. Messages sent through the contact form are delivered to the practice by email and are not stored on the website.

7. Your Rights

Under POPIA, you have the right to:

• Request access to the personal information we hold about you
• Request correction of inaccurate information
• Withdraw consent, where processing is based on consent (this may affect our ability to provide care)
• Lodge a complaint with the Information Regulator of South Africa

8. Security

We use encryption, access controls, and audit logging to protect your information. No system can guarantee absolute security, but we take reasonable steps appropriate to the sensitivity of health data.

9. Changes to This Policy

We may update this Privacy Policy from time to time. The version in effect at the time you use the Service will apply.

10. Contact / Information Officer

For privacy-related queries or to exercise your POPIA rights, contact legal-tech@drglenmonama.com.