Privacy Policy (POPIA)

Katlehong Renal (Pty) Ltd is the “responsible party” as defined in POPIA in respect of the personal information described in this policy.

Information Officer

Our Information Officer is responsible for ensuring compliance with POPIA and for handling requests and complaints regarding your personal information.

Depending on how you interact with us, we may collect:

a) Website and general contact information

• Full name
• Email address
• Contact number
• Any message content or details you submit through our website contact form

b) Patient and health information (special personal information) When you become or enquire about becoming a patient, we may collect, with your consent and/or as necessary for your healthcare:

• Identity information (ID number, date of birth, gender)
• Contact and next-of-kin details
• Medical aid, billing, and payment information
• Health and medical information, including diagnosis, treatment history, dialysis records, test results, medication, and clinical notes
• Information relating to referring practitioners and other healthcare providers involved in your care

Health information is classified as “special personal information” under section 26 of POPIA. We only process this information where a recognised legal ground applies — most commonly your explicit consent, or because it is necessary for the provision of healthcare and management of healthcare services, in line with section 32 of POPIA and applicable health legislation.

c) Website usage information

• IP address, browser type, device information
• Cookies and similar tracking technologies (see section 9 below)

d) Employment and supplier information Where applicable, information relating to job applicants, employees, contractors, and suppliers.

We collect personal information:

• Directly from you, e.g. when you complete our website contact form, register as a patient, or communicate with our staff
• From healthcare providers, medical aids, or referring practitioners involved in your treatment, with appropriate authority
• Automatically through cookies and similar technologies when you use our website
• From publicly available sources, where lawful and appropriate

We use your personal information to:

• Provide, manage, and coordinate renal dialysis and related healthcare services
• Communicate with you about appointments, treatment, and your care
• Process billing, claims, and payments, including with medical aids
• Respond to enquiries submitted through our website
• Comply with legal, regulatory, and statutory obligations (e.g. health record-keeping requirements)
• Conduct community outreach and health education initiatives
• Improve our website and services, including through analytics
• Protect the safety and security of our patients, staff, and facilities

We do not use your health information for direct marketing without your consent, and we do not sell your personal information to third parties.

We process personal information on one or more of the following grounds recognised under POPIA:

• Consent — where you have given specific, informed consent (e.g. for treatment, or for the website contact form)
• Contract — where processing is necessary to perform a service you have requested
• Legal obligation — where we are required by law (e.g. health, tax, or labour legislation) to process the information
• Vital interests — where processing is necessary to protect your life, health, or safety, or that of another person
• Legitimate interests — where processing is necessary for our legitimate business interests and does not unreasonably infringe your rights

We may share your personal information with:

• Healthcare professionals, referring practitioners, and other providers involved in your treatment
• Medical aid schemes and administrators, for billing and claims purposes
• Regulatory bodies and government departments, where legally required (e.g. Department of Health)
• Service providers who process information on our behalf (“operators”), such as IT, hosting, and administrative service providers, under written agreements requiring them to keep the information confidential and secure
• Professional advisors (e.g. auditors, legal advisors), where necessary
• Any party where required by law, court order, or to protect our rights or the safety of any person

We do not transfer personal information outside South Africa unless the recipient is subject to a law, binding corporate rules, or a binding agreement that provides an adequate level of protection substantially similar to POPIA, or another ground under section 72 of POPIA applies (e.g. your consent).

We retain personal information only for as long as necessary to fulfil the purposes for which it was collected, including to satisfy legal, regulatory, accounting, or reporting requirements. Medical records are generally retained in line with applicable health record-keeping legislation and guidance (which may require retention for extended periods, including after the end of a patient relationship). Once information is no longer needed, we securely delete or de-identify it.

Our website uses cookies and similar technologies, managed through a cookie consent tool, which allows you to accept, reject, or customise your preferences for the following categories:

• Necessary cookies — required for core site functionality; do not store personal data
• Functional cookies — support features such as content sharing and feedback tools
• Analytical cookies — help us understand visitor behaviour (e.g. visitor counts, bounce rate, traffic sources)
• Advertisement cookies — used to deliver and measure personalised advertising

You can manage your cookie preferences at any time using the cookie settings tool available on our website.

We implement appropriate technical and organisational measures to protect personal information against loss, unauthorised access, alteration, disclosure, or destruction, in line with section 19 of POPIA. These measures include restricted access to patient records, secure storage of physical and electronic records, staff confidentiality obligations, and IT security controls. While we take reasonable steps to protect your information, no method of transmission or storage is completely secure, and we cannot guarantee absolute security.

Subject to POPIA, you have the right to:

• Be notified that your personal information is being collected
• Request access to the personal information we hold about you
• Request correction or deletion of inaccurate, irrelevant, excessive, out of date, incomplete, misleading, or unlawfully obtained personal information
• Object to the processing of your personal information, on reasonable grounds
• Withdraw your consent at any time, where processing is based on consent (this does not affect the lawfulness of processing before withdrawal)
• Complain to the Information Regulator if you believe we have processed your personal information unlawfully
• Not be subject solely to automated decision-making that significantly affects you, without appropriate safeguards

To exercise any of these rights, please contact our Information Officer using the details in section 2 above, or see our PAIA Manual for details of the formal access request process.

We do not knowingly collect personal information directly from children without the consent of a parent or legal guardian, except where necessary for the provision of healthcare to a minor patient and permitted by law.

If you are unhappy with how we have handled your personal information, please contact our Information Officer first so we can try to resolve your concern. You may also lodge a complaint with the Information Regulator of South Africa:

We may update this Privacy Policy from time to time to reflect changes in our practices or legal requirements. The updated version will be posted on our website with a revised “Last updated” date.

If you have any questions about this Privacy Policy or how we handle your personal information, please contact us: