1. Who We Are

The Speech & Hearing Hub is the responsible party (“operator”) as defined in POPIA. We are a private healthcare practice registered with the HPCSA, operating from three locations in Johannesburg (Randburg, Lenasia, and Norwood). We process your personal information in the course of delivering speech-language therapy and audiology services.

---

2. What Personal Information We Process

We process the following categories of personal information:

Category	Examples	Classification
Identifying information	Name, date of birth, ID number, contact details	General personal information
Health information	Diagnoses, clinical notes, test results, treatment plans	Special personal information (s.26)
Financial information	Medical aid details, billing records	General personal information
Guardian information	Parent/guardian name, contact details, ID (minor patients)	General personal information
Website enquiry data	Contact form name, email, phone, message	General personal information

Health information is classified as special personal information under Section 26 of POPIA. We are only permitted to process it with your explicit consent, or where processing is necessary to fulfil our obligations under the National Health Act or HPCSA rules.

---

3. Why We Process Your Information

We process your personal information for the following purposes:

• To provide speech therapy and audiology assessments and treatment
• To maintain accurate clinical records as required by the HPCSA and the National Health Act 61 of 2003
• To communicate with you about your care and appointments
• To submit medical aid claims with your authorisation
• To refer you to other healthcare professionals where clinically indicated, with your consent
• To comply with applicable law, professional rules, and regulatory requirements
• To respond to enquiries submitted via our website

---

4. Legal Basis for Processing

We process your information on the following lawful bases under Section 11 of POPIA:

• Explicit consent (s.11(1)(a)) — for the processing of health information and for non-essential communications
• Contractual necessity (s.11(1)(b)) — to deliver the services you have contracted us to provide
• Legal obligation (s.11(1)(c)) — to comply with the HPCSA, National Health Act, and POPIA itself
• Vital interests (s.11(1)(d)) — to protect life in an emergency situation
• Legitimate interests (s.11(1)(f)) — for internal administration such as scheduling and billing, where not overriding your rights

---

5. Your Rights Under POPIA

As a data subject, you have the following rights under Chapter 2 of POPIA:

To exercise any of the above rights, contact our Information Officer:

---

6. How Long We Keep Your Information

We retain personal information only for as long as necessary for the purpose for which it was collected, and thereafter only to the extent required by applicable law:

• Clinical health records: Minimum of 6 years from the date of last treatment, or in the case of minor patients, 6 years from the date the patient turns 18 — whichever is later. This is required by the HPCSA Professional Rules and the National Health Act.
• Financial and billing records: Minimum of 5 years in accordance with the Companies Act and SARS requirements.
• Website contact enquiries: Retained only as long as necessary to respond to your enquiry, and no longer than 12 months unless further correspondence is required.

After the applicable retention period, records are securely destroyed or anonymised so that you can no longer be identified.

---

7. Security Safeguards

We implement appropriate technical and organisational measures under Section 19 of POPIA to protect your personal information against:

• Loss, damage, or destruction
• Unlawful access or processing
• Accidental or unauthorised disclosure

Our safeguards include secure access-controlled electronic records systems, locked physical storage, staff confidentiality agreements, and website encryption (SSL/TLS). Access to health records is limited strictly to those staff members who require it for clinical or administrative purposes.

---

8. Data Breach Notification

In the event of a security compromise that may affect your personal information, we will notify you and the Information Regulator without unreasonable delay, as required by Section 22 of POPIA. Our notification will include:

• A description of the nature of the breach
• The likely consequences of the breach
• The measures we have taken or propose to take to address the breach
• Recommendations for steps you can take to mitigate any potential harm

---

9. Sharing Your Information

We do not sell your personal information. We share it only:

• With your medical aid scheme to process claims — with your written authorisation
• With other treating healthcare professionals — with your consent, on a need-to-know basis
• In an emergency, where sharing is necessary to protect your life or the life of another
• Where legally required — court orders, subpoenas, HPCSA investigations, statutory reporting obligations

We do not transfer your personal information outside South Africa except with your consent or where the receiving country provides an adequate level of protection as required by Section 72 of POPIA.

---

10. Information Regulator

You have the right to lodge a complaint with the Information Regulator of South Africa at any time:

We encourage you to contact our Information Officer first to resolve any concern directly before escalating to the Regulator.

---

11. Related Documents

This notice should be read together with:

• Privacy Policy — full detail on how we collect, use, and protect your information
• Terms & Conditions — governing the use of our services and your patient rights

---

This notice is reviewed annually or whenever there is a material change in our processing activities or applicable legislation. For queries, contact our Information Officer at privacy@speechandhearinghub.co.za.