Data Access, Correction & Deletion Policy

Updated: 15 May 2026
Privacy POPIA Patient Rights

1. Purpose

4FR Health respects each patient's right to understand, access, correct, and, where legally permissible, request deletion or limitation of personal information processed within the 4FR Health ecosystem.

This policy explains how requests relating to personal information are handled across our clinical, administrative, communication, booking, digital, and compliance processes.

Effective date: 15 May 2026.

2. Scope of this Policy

This policy applies to personal information processed by 4FR Health through systems and processes including, but not limited to:

  • Patient registration and onboarding forms.
  • Appointment bookings and Calendly-linked booking data.
  • WhatsApp messages, communication records, and submitted media.
  • Email communication and Microsoft 365 services.
  • Prescription requests and related administrative workflows.
  • Clinical records, consultation notes, referrals, reports, and uploaded documents.
  • Invoices, receipts, accounts, payment records, and medical-aid related information.
  • Website forms, mailing-list submissions, dashboards, operational logs, and internal notifications.
  • SharePoint, Vault, Microsoft Graph, and other approved storage or workflow systems used by 4FR Health.

3. Types of Requests

Patients and data subjects may request that 4FR Health consider:

  • Access: confirmation of whether personal information is held and how it is used.
  • Correction: correction or updating of inaccurate, incomplete, or outdated information.
  • Deletion: deletion of personal information where retention is no longer lawful, necessary, or required.
  • Restriction or limitation: limitation of certain processing where appropriate.
  • Communication preference updates: withdrawal from non-essential communication, where applicable.

4. When Deletion May Be Limited

Because 4FR Health is a healthcare provider, not all records can be deleted immediately or on request. Certain records may need to be retained for clinical, legal, accounting, regulatory, professional, security, audit, or dispute-resolution purposes.

Deletion, correction, or limitation may be declined or delayed where information is required for:

  • Continuity of clinical care and patient safety.
  • Medical record retention obligations.
  • Prescription, dispensing, referral, laboratory, or clinical governance requirements.
  • Accounting, billing, tax, audit, or medical-aid administration.
  • Legal claims, complaints, investigations, regulatory enquiries, or unresolved disputes.
  • Fraud prevention, cyber-security, access logs, and operational audit trails.

5. How to Submit a Request

Requests may be submitted by emailing: compliance@4fr.co.za

Where appropriate, general administrative enquiries may also be directed to: hello@4fr.co.za

Please include enough information for us to identify the relevant record or process, such as:

  • Your full name and contact details.
  • The type of request being made.
  • The system, form, message, document, or process involved, if known.
  • Any reference number, booking date, or communication date that may help us locate the record.

6. Identity Verification

To protect patient confidentiality, 4FR Health may request reasonable proof of identity or authority before disclosing, correcting, deleting, or limiting personal information. Requests made on behalf of another person may require proof of authorisation, guardianship, or legal standing.

7. Response Process

4FR Health will review each request, verify the requester where needed, identify applicable systems and records, and determine whether the requested action can be completed lawfully and safely.

Where full deletion is not legally or practically possible, 4FR Health may instead correct, restrict, archive, de-identify, or retain the information with appropriate safeguards, depending on the circumstances.

8. PAIA and Formal Access to Records

Routine personal-information requests may be submitted under this policy. Formal access-to-records requests under the Promotion of Access to Information Act must follow the PAIA process published by 4FR Health.

View the PAIA Manual & Access to Information documents for the formal request process.

9. Third-Party Systems and Service Providers

Some personal information may be processed through third-party systems used by 4FR Health for booking, communication, storage, billing, security, analytics, or administrative workflow purposes. Where appropriate, 4FR Health will take reasonable steps to action approved requests within systems under its control or to request assistance from relevant service providers.

10. Contact

Privacy and compliance requests: compliance@4fr.co.za

General practice enquiries: hello@4fr.co.za