The Speech & Hearing Hub (“we”, “us”, “our”) is a private speech therapy and audiology practice registered with the Health Professions Council of South Africa (HPCSA) and operating from Johannesburg, South Africa. We are committed to protecting your personal information in accordance with the Protection of Personal Information Act 4 of 2013 (POPIA), the National Health Act 61 of 2003, and the professional obligations imposed by the HPCSA.

---

1. Information Officer

In accordance with Section 55 of POPIA, we have designated an Information Officer who is responsible for managing our data protection obligations and acting as the point of contact for all privacy-related matters.

---

2. Personal Information We Collect

We collect and process the following categories of personal information:

Identifying Information

• Full name, date of birth, identity number or passport number
• Contact details (telephone number, email address, residential and postal address)
• Next-of-kin and emergency contact details
• Guardian or parental information (where the patient is a minor)

Health Information (Special Personal Information)

Health information is classified as special personal information under Section 26 of POPIA and is afforded the highest level of protection. We collect:

• Medical history, diagnoses, referral letters, and reports from other health professionals
• Assessment findings, clinical notes, session notes, and progress reports
• Hearing test results, audiograms, tympanograms, and related diagnostic data
• Speech, language, and communication assessment results
• Treatment plans, home programmes, and discharge summaries
• Medication information where clinically relevant
• Information about disabilities or special needs

Financial and Administrative Information

• Medical aid scheme name, membership number, and plan details
• Account and billing information
• Appointment history

Website Information

• Contact form submissions (name, email, phone, message)
• Standard server log data (IP address, browser type, pages visited) via WordPress and hosting provider

---

3. Lawful Basis for Processing

We process your personal information on one or more of the following lawful bases in accordance with Section 11 of POPIA:

• Your consent — you have given explicit consent to the processing of your health information for the purposes of receiving speech therapy or audiology services.
• Performance of a contract — processing is necessary to deliver the healthcare services you have requested.
• Legal obligation — we are required to retain and process records under the HPCSA Professional Rules, the National Health Act 61 of 2003, and POPIA itself.
• Vital interests — in an emergency, we may process information to protect your life or that of another person.
• Legitimate interests — for internal administrative purposes such as appointment scheduling, billing, and quality improvement, where these do not override your rights.

---

4. The Eight POPIA Conditions

We comply with all eight conditions for lawful processing under Chapter 3 of POPIA:

1. Accountability — we take responsibility for ensuring POPIA compliance across our practice.
2. Processing Limitation — we collect only what is necessary for identified, lawful purposes.
3. Purpose Specification — we collect information for specific, explicitly stated purposes and inform you of those purposes at the time of collection.
4. Further Processing Restriction — we do not use your information for purposes incompatible with the original purpose without your consent.
5. Information Quality — we take reasonable steps to keep your information accurate, complete, and up to date.
6. Openness — we are transparent about our information processing activities through this Privacy Policy and our POPIA Notice.
7. Security Safeguards — we implement appropriate technical and organisational measures to protect your information against loss, damage, or unauthorised access (see Section 8 below).
8. Data Subject Participation — you have the right to access, correct, and request deletion of your personal information (see Section 7 below).

---

5. How We Use Your Information

• To conduct speech-language, hearing, and related assessments
• To plan and deliver therapy and clinical intervention
• To communicate with you about appointments, results, and progress
• To submit claims to your medical aid scheme on your behalf (with your authorisation)
• To refer you to other healthcare professionals where clinically indicated, with your consent
• To fulfil our obligations under the HPCSA Professional Rules and the National Health Act
• To maintain accurate and complete clinical records as required by law
• To respond to enquiries submitted via our website contact form
• To comply with a court order, subpoena, or other lawful legal requirement

We do not use your personal information for unsolicited marketing, sell it to third parties, or share it with commercial entities for their own purposes.

---

6. Disclosure to Third Parties

We may share your information only in the following circumstances:

• Medical aid schemes and billing administrators — to process claims and obtain pre-authorisation, with your explicit written consent.
• Other healthcare professionals — to refer you or to co-manage your care, with your consent and on a need-to-know basis.
• Emergency services — in a life-threatening situation where your consent cannot reasonably be obtained.
• Legal and regulatory authorities — where disclosure is required by law, court order, or the HPCSA.
• Practice staff — limited to employees and contractors who require access to deliver or administer services, all of whom are bound by confidentiality obligations.

We do not transfer your personal information outside South Africa without ensuring that the recipient country provides an adequate level of protection, or without your consent, as required by Section 72 of POPIA.

---

7. Your Rights as a Data Subject

Under Chapter 2 of POPIA, and consistent with the National Health Act, you have the following rights:

• Right to be notified — to be informed whether we hold your personal information and for what purpose.
• Right of access — to request a copy of the personal information we hold about you.
• Right to correction or deletion — to request that inaccurate, incomplete, or outdated information be corrected or deleted, subject to our legal obligation to retain clinical records.
• Right to object — to object to the processing of your information on legitimate grounds.
• Right to withdraw consent — to withdraw your consent to processing at any time, without affecting the lawfulness of processing carried out before withdrawal.
• Right to lodge a complaint — to complain to the Information Regulator if you believe your rights under POPIA have been violated (see Section 10).

To exercise any of these rights, please contact our Information Officer at privacy@speechandhearinghub.co.za. We will respond within a reasonable time and, where required by law, within 30 days.

Please note that our obligation to retain clinical records under the HPCSA and the National Health Act may limit our ability to delete certain records before the legally mandated retention period has expired.

---

8. Security of Your Information

We implement appropriate technical and organisational safeguards to protect your personal information against loss, unauthorised access, disclosure, alteration, or destruction. These measures include:

• Secure, password-protected electronic records systems with access restricted to authorised staff
• Physical security for paper-based records (locked storage, restricted access)
• Confidentiality agreements signed by all staff and contractors with access to patient information
• SSL/TLS encryption on this website
• Regular review of access rights and security procedures

In the event of a data breach that poses a risk to your rights and freedoms, we will notify both you and the Information Regulator without unreasonable delay, in accordance with Section 22 of POPIA. We will provide details of the nature of the breach, its likely consequences, and the measures we are taking to address it.

---

9. Retention of Records

We retain your clinical records for a minimum period in accordance with:

• The HPCSA Professional Rules, which require health records to be retained for a minimum of six (6) years after the last date of service, or in the case of minor patients, for six years after the patient reaches the age of majority (18 years).
• The National Health Act 61 of 2003, which requires that patient records be kept for the period specified in any applicable regulation.
• Any longer period required by law, litigation hold, or medical aid scheme obligation.

Administrative and financial records are retained for a minimum of five (5) years in accordance with the Companies Act and standard auditing requirements. Website contact form submissions are retained only for as long as necessary to respond to your enquiry.

Once the applicable retention period has expired, records are securely destroyed or anonymised.

---

10. Information Regulator

If you believe that we have not handled your personal information in accordance with POPIA, you have the right to lodge a complaint with the Information Regulator of South Africa:

We encourage you to contact us first so that we may resolve your concern directly.

---

11. Cookies and Website Data

Our website uses standard WordPress cookies required for basic functionality (session management, security tokens). We do not use tracking cookies or third-party advertising cookies. The Google Fonts service loads fonts from Google’s servers; this involves your browser making a request to Google. For details, refer to Google’s privacy policy.

---

12. Changes to This Policy

We may update this Privacy Policy from time to time to reflect changes in law, our practices, or our services. The updated date at the top of this page will always reflect the most recent revision. We encourage you to review this policy periodically. Material changes will be communicated to active patients directly.

---

For any privacy-related queries, please contact our Information Officer at privacy@speechandhearinghub.co.za or call 011 275 0019.