Home Privacy & POPIA
Privacy & POPIA
How Eyecare by Kim collects, uses and protects your personal information, including your health records, under the Protection of Personal Information Act 4 of 2013.
Draft — not yet in force
This page is a working draft. It has not been approved by Kim and has not been reviewed by an attorney. Patient health records are special personal information under section 26 of POPIA, so the wording carries real legal weight and must be signed off before this page goes live.
Every item in the list at the bottom of this page is a blank that has to be filled in with confirmed fact. Nothing on this page should be treated as a commitment the practice has made until that is done.
On this page
01 Who we are
Eyecare by Kim INC is an independent optometry practice at Shop 2, Candlewood Centre, 53 Victoria Ave, Hout Bay, Cape Town 7806. For the purposes of POPIA the practice is the responsible party for the personal information described on this page.
The practice is regulated by the Health Professions Council of South Africa, and the optometrist is bound by the HPCSA's ethical rules on patient confidentiality in addition to POPIA.
02 What we collect
Depending on how you deal with us, we collect:
- Identifying information. Your name, date of birth, identity number where required for a medical aid claim, address, phone number and email.
- Booking information. The appointment type, date and time you select, and anything you tell us when you book.
- Clinical information. Your examination findings, prescriptions, retinal and OCT images, eye pressure readings, symptoms, relevant medical history and medication, and notes made during consultations.
- Account information. What you were charged, what you paid, and your medical aid membership details if you claim through one.
- Website information. Whatever you type into the enquiry form on this site, and standard technical information your browser sends.
03 Why we collect it
We collect personal information to examine and treat your eyes, to dispense spectacles and contact lenses, to keep the clinical record the HPCSA requires us to keep, to bill you or your medical aid, to contact you about your appointments, and to recall you when a check-up is due.
We do not sell your personal information, and we do not use it for advertising.
04 Health records
Information about your health is special personal information under section 26 of POPIA and is subject to stricter rules than ordinary personal information. Section 32 permits a health practitioner to process it where that is necessary for the proper treatment and care of the patient.
In practice that means your clinical record is used to treat you and is seen only by the people who need it to do that or to administer your account. It is not disclosed to anyone else without your consent, unless the law requires it.
05 Who we share it with
We share personal information only where it is necessary, and only with:
- Your medical aid or its administrator, where you ask us to claim on your behalf.
- The optical laboratory that makes up your lenses, which receives your prescription and fitting measurements.
- Another health practitioner you are referred to, with your knowledge.
- Service providers who run the systems the practice uses, who may only process the information on our instruction.
- A court, regulator or other authority, where the law obliges us to.
To be completed before publication
The specific medical aids, laboratories and service providers must be named here, and each needs an operator agreement under section 21 of POPIA. None are named on this page yet because none have been confirmed.
06 How long we keep it
Clinical records are kept for the period required by the HPCSA and by law, which is longer than the practice would otherwise keep them, and longer for a record created while the patient was a minor.
To be completed before publication
The exact retention period must be stated here and confirmed against current HPCSA guidance. It is deliberately left blank rather than guessed.
07 How we protect it
Records are held digitally in the practice management system. Access is restricted to the people who need it, and the practice is moving to paperless record-keeping so that fewer copies exist in fewer places.
If personal information in our care is accessed by someone who should not have it, POPIA requires us to notify the Information Regulator and, where the law requires it, you.
08 Your rights
Under POPIA you may ask us what personal information we hold about you, ask us to correct or delete information that is wrong, incomplete or no longer needed, object to how we use it, and withdraw a consent you previously gave.
A right to deletion does not override a legal duty to keep a clinical record for a set period. Where those conflict, the retention duty wins, and we will tell you so.
To make a request, contact the practice using the details on the Visit us page.
09 Children
We examine children, so we necessarily process their personal information. That is done with the consent of a parent or guardian, who may exercise the rights above on the child's behalf.
10 Complaints
If you are unhappy with how the practice has handled your personal information, please raise it with us first. You also have the right to complain to the Information Regulator of South Africa.
Blanks Kim must fill before this page is published
- The Information Officer. POPIA requires one to be designated and registered with the Information Regulator. Their name and contact details go on this page.
- The retention period for clinical records, confirmed against current HPCSA guidance, and the longer period for records of minors.
- The medical aids the practice claims from.
- The optical laboratories and any other operators that receive patient information, and a signed operator agreement with each.
- The practice management system and where it stores data, including whether any of it leaves South Africa, which triggers section 72.
- Whether recalls and marketing go out by email or SMS, and how patients opt out.
- Whether the website sets any non-essential cookies. If it does, a cookie banner is required. The site currently has no cookie bar enabled.
- Review by an attorney before this page goes live.