POPIA Compliance Policy

Updated: 2026-08-19 14:44 SAST
POPIA Data Protection Patient Rights

1. Overview

4FR Health (Pty) Ltd is committed to protecting personal information as required by the Protection of Personal Information Act (POPIA) (Act 4 of 2013). This policy outlines how we lawfully collect, use, store, and safeguard personal information in the context of healthcare delivery and practice administration.

Effective date: 1 September 2025.

2. Information Officer

The designated Information Officer oversees POPIA compliance. Queries can be directed to: compliance@4fr.co.za

3. Lawful Processing

We process personal information on lawful grounds, which may include:

  • Consent from the data subject, where required.
  • Contractual necessity (e.g., providing requested healthcare services).
  • Legal obligations applicable to healthcare practice management.
  • Legitimate interests in operating and administering a healthcare practice responsibly.

4. Security Measures

We apply appropriate administrative, technical, and physical safeguards, including:

  • Password-protected practice systems and secure devices where applicable.
  • Locked storage for paper records.
  • Staff confidentiality obligations and related internal controls.
  • Role-based access to sensitive information (access limited to what is necessary).

5. Third-Party Disclosures

We share personal information only with service providers and recipients where necessary for care delivery, operations, or compliance. This may include laboratories, billing systems, and IT providers. Where third parties process information on our behalf, reasonable POPIA-aligned safeguards and confidentiality expectations apply.

6. Data Breach Notifications

If a personal information breach occurs that may compromise confidentiality, we will take reasonable steps to investigate, contain, and remediate the incident. Where required, affected individuals and the Information Regulator will be notified without undue delay.

7. Patient / Data Subject Rights

Subject to applicable law, you may:

  • Request access to your personal information.
  • Request correction or deletion where appropriate.
  • Object to processing in certain circumstances.
  • Lodge complaints with the Information Regulator.