Popia Data Protection & Privacy Policy

Ashleigh Hall & Associates (Pty) Ltd t/a AHA Medical
Last Updated: 03 March 2026

Ashleigh Hall & Associates (Pty) Ltd trading as AHA Medical (“AHA Medical”, “we”, “us”, “our”) is committed to protecting the confidentiality, integrity and security of personal information in accordance with:

  • The Protection of Personal Information Act, 4 of 2013 (“POPIA”)
  • The National Health Act
  • The Health Professions Act
  • HPCSA Ethical Rules of Conduct
  • HPCSA Booklet 1 & 2 (General Ethical Guidelines)
  • HPCSA Booklet 5 (Confidentiality: Protecting and Providing Information)
  • HPCSA Booklet 9 (Guidelines on the Keeping of Patient Records)
  • HPCSA Booklet 10 (Informed Consent)

1. Responsible Party

Ashleigh Hall & Associates (Pty) Ltd
t/a AHA Medical

Suite 310, Medstone
19
The High Street

Umhlanga, 4319

South Africa

Email: operations@ahamedical.co.za

AHA Medical is the “Responsible Party” as defined under POPIA and is accountable for lawful processing of personal information.

2. Categories of Personal Information Collected

We collect only information that is reasonably necessary for lawful healthcare and administrative purposes.

2.1 Personal Information (PI)

  • Full name and surname
  • Identity or passport number
  • Contact details (address, telephone, email)
  • Demographic information (age, sex/gender, education)
  • Height, weight and relevant physiological measurements
  • Medical aid scheme details
  • Membership numbers and dependant codes
  • Billing information

2.2 Special Personal Information (SPI)

  • Medical history
  • Clinical notes
  • Assessment findings
  • Diagnostic information
  • Biopsychosocial evaluation data
  • Information required for DBC rehabilitation enrolment and treatment

Health information constitutes “Special Personal Information” under POPIA and is afforded enhanced statutory protection.

3. Purpose of Processing

Personal information is processed for lawful healthcare-related purposes including:

  • Registration for medical aid benefits
  • Enrolment in DBC rehabilitation programmes
  • Interdisciplinary treatment planning
  • Booking, monitoring and follow-up
  • Clinical assessment and outcome measurement
  • Medical scheme authorisation processes
  • Communication (calls, emails, secure platforms)
  • Internal patient record management
  • Audit, compliance and regulatory reporting
  • Risk management and medico-legal compliance

Website submissions do not substitute formal clinical consultation.

4. Voluntary Disclosure & Consequences

Provision of personal information is voluntary. However, failure to provide required personal or health information may:

  • Prevent enrolment in DBC rehabilitation
  • Prevent clinical assessment
  • Prevent submission of medical scheme authorisation
  • Limit our ability to provide treatment

This is in accordance with Section 18 of POPIA.

5. Lawful Basis for Processing

We process personal information based on:

  • Voluntary informed consent
  • Performance of a healthcare contract
  • Compliance with legal obligations
  • Legitimate healthcare interests
  • Protection of vital interests
  • Processing of special personal information as permitted under Sections 26–33 of POPIA

Formal informed consent for treatment is obtained separately in accordance with HPCSA Booklet 10.

6. Confidentiality & Ethical Obligations

In accordance with HPCSA Booklet 5:

  • All patient information is confidential.
  • Disclosure occurs only:
    • With patient consent;
    • Where legally required;
    • Where ethically justified;
    • For authorised healthcare coordination.

All employees, practitioners and contractors are bound by confidentiality obligations.

7. Sharing of Information

  • Information may be shared with:
  • Medical aid schemes for DBC enrolment and authorisation
  • Referring or treating healthcare professionals
  • Laboratories or allied health providers
  • Regulatory authorities (where required by law)
  • Legal representatives (where lawfully required)

We do not sell personal information.

8. Cross-Border Storage & Transfers

Personal information may be stored or processed outside South Africa when:

  • Using secure cloud-based systems
  • Communicating via international email platforms

In terms of Section 72 of POPIA, we ensure recipients provide equivalent protection to that required under South African law.

9. Security Safeguards

In compliance with Section 19 of POPIA and HPCSA recordkeeping standards, we implement reasonable technical and organisational measures including:

  • Access control and authentication procedures
  • Secure electronic medical record systems
  • Encryption where applicable
  • Confidentiality undertakings
  • Risk assessment procedures
  • Secure physical storage of records

While safeguards are implemented, no electronic transmission is completely secure.

10. Data Retention

In accordance with HPCSA Booklet 9:

  • Patient records are retained for a minimum of six (6) years from the date they become dormant, or longer if required by law.
  • Records relating to minors are retained until the minor reaches majority age plus the prescribed retention period.
  • Website enquiry data (where no patient relationship is established) is retained only as reasonably necessary for follow-up and compliance.

11. Eligibility & Funding Disclaimer

The website eligibility screening tool:

  • Is an indicative internal assessment only
  • Does not constitute diagnosis
  • Does not create entitlement to treatment
  • Does not guarantee medical scheme funding
  • Does not constitute pre-authorisation

Final authorisation decisions are made solely by the medical aid scheme.

12. Your Rights Under POPIA

You have the right to:

  • Request access to your personal information
  • Request correction of inaccurate information
  • Object to processing (where lawful)
  • Request deletion where legally permissible
  • Request anonymisation where deletion is not possible

Access requests require completion of a formal request form and identity verification. A reasonable administrative fee may apply where permitted by law.

13. Mandatory Reporting

In certain circumstances, we may be legally obligated to disclose information including:

  • Court orders
  • Statutory reporting requirements
  • Protection of vulnerable persons
  • Public health reporting

Such disclosures are made strictly in accordance with applicable law.

14. Direct Communication

  • By submitting information, you consent to being contacted for:
  • Appointment scheduling
  • Administrative follow-up
  • Programme information

We do not conduct unrelated direct marketing without consent.

15. Complaints & Contact Details

Information Officer
Ashleigh Hall & Associates (Pty) Ltd

Email: operations@ahamedical.co.za

If unresolved, complaints may be directed to:

The Information Regulator (South Africa)

33 Hoofd Street, Forum III, 3rd Floor, Braampark

P.O. Box 31533, Braamfontein, Johannesburg, 2017

Tel: +27 (0)10 023 5207

Email: inforeg@justice.gov.za

Website: https://justice.gov.za/inforeg/contact.html