POPIA Privacy Policy & Protection of Special Health Information
Last updated: October 2026
Drafted and published in accordance with the Protection of Personal Information Act (POPIA, Act 4 of 2013 Sections 18, 26, 27 & 32), the National Health Act (Act 61 of 2003 Sections 14–17), the Allied Health Professions Act (Act 63 of 1982), and HPCSA / AHPCSA statutory confidentiality rules.
1. Introduction, Responsible Party & Information Officer Details (POPIA Sections 1 & 18)
Dr Bongeka Khumalo Chiropractic Practice, trading as Dr Bongeka Khumalo - Chiropractor ('the Practice'), an independent chiropractic healthcare practice registered with the Allied Health Professions Council of South Africa (AHPCSA Registration No. A12499) and the Board of Healthcare Funders (BHF Practice No. 1029355), is the 'Responsible Party' as defined in Section 1 of the Protection of Personal Information Act (POPIA, Act 4 of 2013).
Our primary physical address is Spark Lifestyle Centre, 98 Cannon Avenue, 5th Floor Medical Suite, Overport, Durban, KwaZulu-Natal, 4067, alongside our weekly Monday clinic at KwaDukuza Mall (Stanger) and scheduled monthly satellite clinics in Empangeni, Pongola, Jozini, Ulundi, Mthatha, and Matatiele. The designated Information Officer is Dr Bongeka Khumalo, reachable via email at drbongekakhumalo@gmail.com or by telephone at 063 265 1223.
2. Processing of Special Personal Information & Health Records (POPIA Sections 26, 27 & 32)
Under Section 26 of POPIA, information concerning a data subject's physical or mental health, musculoskeletal assessment findings, radiographic reports, diagnostic codes (ICD-10), treatment notes, and medical aid membership details constitutes 'Special Personal Information'.
In terms of Section 32(1)(a) and Section 32(2) of POPIA, as read with Section 14 of the National Health Act (Act 61 of 2003), the Practice processes Special Personal Information lawfully as a registered healthcare facility bound by statutory and ethical obligations of professional confidentiality under the Allied Health Professions Act (Act 63 of 1982) and HPCSA / AHPCSA ethical guidelines for the proper assessment, treatment, rehabilitation, and administration of patients.
3. Categories of Personal Information Collected & Method of Collection (POPIA Sections 12 & 18)
We collect personal and health information directly from you (or from a parent/legal guardian where the patient is a minor) during appointment booking, intake registration, and clinical consultation across our Overport, KwaDukuza, and satellite clinic rooms:
• Identity & Contact Details: Full name, South African ID or passport number, date of birth, physical and postal address, telephone and WhatsApp number, email address, and emergency next-of-kin contact details. • Medical Aid & Financial Details: Medical scheme name (e.g., Discovery Health, GEMS, Bonitas, Momentum, Bestmed, Medihelp, POLMED, SAMWUMED), plan option, membership number, dependent code, main member details, and GP referral letters where required by your scheme. • Clinical & Musculoskeletal Records: Case history, orthopaedic and neurological examination findings, spinal and peripheral palpation records, dry needling and modality consent notes, previous X-ray/MRI/ultrasound reports, and referral letters.
4. Purpose of Processing & Medical Scheme Claim Switching (POPIA Sections 11 & 13; Medical Schemes Act 131 of 1998)
Your personal information is processed strictly for: (a) scheduling and confirming appointments at our Overport rooms or regional satellite clinics; (b) conducting safe clinical assessments, spinal manipulation, dry needling, soft tissue therapy, and rehabilitation; (c) coordinating diagnostic imaging (X-ray, ultrasound, MRI) or medical specialist referrals with your consent; and (d) issuing tax invoices and submitting healthcare claims containing mandatory ICD-10 diagnostic codes and BHF Practice No. 1029355 to your medical scheme in accordance with the Medical Schemes Act (Act 131 of 1998).
We never sell, rent, or distribute patient personal information to third-party marketers.
5. WhatsApp Communications, Cross-Border Data & Website Privacy (POPIA Sections 19–21 & 72)
When you voluntarily initiate contact with our reception desk via WhatsApp (+27 63 265 1223) or email (drbongekakhumalo@gmail.com), message routing metadata may pass through international servers operated by Meta Platforms or Google in accordance with Section 72 of POPIA. To protect your privacy, please use WhatsApp only for scheduling and logistical queries and avoid transmitting sensitive clinical imagery via unencrypted messages.
This static website does not use third-party advertising trackers or behavioural profiling cookies. Standard web server security logs are maintained solely to ensure website availability and security.
6. Statutory Retention of Patient Records & Security Safeguards (POPIA Sections 14 & 19)
In accordance with South African healthcare record-keeping standards (HPCSA Booklet 9 / AHPCSA guidelines), adult patient clinical records are retained securely for a minimum of six (6) years from the date of the last entry or when the record becomes dormant, and records of minor patients are retained until the patient reaches twenty-one (21) years of age.
Under Section 19 of POPIA, the Practice maintains physical access controls, locked clinical filing systems, and password-protected electronic devices to prevent loss, damage, or unauthorised access to patient files. In the event of any data security compromise, notifications will be issued to affected patients and the Information Regulator in compliance with Section 22 of POPIA.
7. Your Rights as a Data Subject & Contacting The Information Regulator (POPIA Sections 23–25 & 74)
You have the statutory right to request access to your personal and clinical records (using PAIA Form 2), request correction or deletion of inaccurate administrative details (POPIA Form 2), or object to processing on reasonable grounds (POPIA Form 1) by contacting our Information Officer, Dr Bongeka Khumalo, at drbongekakhumalo@gmail.com or 063 265 1223.
You also have the right to lodge a complaint with The Information Regulator (South Africa): Physical Address: JD House, 27 Stiemens Street, Braamfontein, Johannesburg, 2001 | Postal Address: P.O. Box 31533, Braamfontein, Johannesburg, 2017 | General Enquiries: enquiries@inforegulator.org.za | POPIA Complaints: POPIAComplaints@inforegulator.org.za | Website: https://inforegulator.org.za.