Privacy notice
This notice explains how BayOrtho, the practice of Dr Ben Garrett, collects, uses, shares and protects your personal information, as required by the Protection of Personal Information Act 4 of 2013 (POPIA).
It applies to patients, people who contact the practice through the website, by phone or by email, referring practitioners, and anyone else whose information we hold.
Last updated: [CONTENT PENDING]
1. Who we are
The responsible party for your personal information is Dr Benjamin Garrett, Specialist Orthopaedic Surgeon, trading as BayOrtho.
| Practice | BayOrtho, Dr Ben Garrett (sole practitioner) |
|---|---|
| HPCSA registration | MP 0537624 |
| Practice number | 0561967 |
| Physical address | Cure Day Hospital, [CONTENT PENDING] Westview Village Office Park, Westview Drive, Newton Park, Gqeberha (Port Elizabeth), 6045 |
| Postal address | [CONTENT PENDING] |
| Telephone | 050 216 6348 |
| admin@bayortho.co.za |
Information Officer: Dr Ben Garrett. Questions about this notice, or requests about your information, can go to him at [CONTENT PENDING] or [CONTENT PENDING].
[CONTENT PENDING]
2. What information we collect
We collect only what we need to treat you, run the practice and meet our legal duties. Most of it comes from you directly; some comes from others involved in your care.
| Category | Examples |
|---|---|
| Identity and contact details | Name, ID or passport number, date of birth, address, phone numbers, email address, next of kin or emergency contact |
| Medical aid and account details | Scheme name, membership number, main member details, authorisation numbers, payment records |
| Health information (special personal information) | Medical history, symptoms, examination findings, X-rays and scans, test results, diagnoses, operation and treatment records, medication and allergies |
| Injury-on-duty details | Employer details and claim information, where you are seen for an injury on duty |
| Website and enquiry information | What you send through the contact form or by email, and [CONTENT PENDING] |
| Children’s information | Where we treat a child, the information above, provided by a parent or guardian |
Where it comes from besides you: referring doctors and physiotherapists, radiology and pathology practices, hospitals including Cure Day Hospital, your medical scheme, and, for injury-on-duty cases, your employer and the Compensation Fund or its agent.
Is it compulsory? You do not have to give us your information, but without it we may not be able to treat you safely, submit claims for you, or reply to your enquiry. Some information is required by law, for example by the National Health Act 61 of 2003 and the Medical Schemes Act 131 of 1998.
3. Why we use it
We use your information to diagnose and treat you, and only for purposes that fit that care or the running of the practice.
| Purpose | Lawful basis under POPIA |
|---|---|
| Consultations, diagnosis, surgery and follow-up care | Needed to provide your treatment; health information is processed by a health professional under a duty of confidentiality (section 32) |
| Booking appointments, reminders and replying to enquiries | Your consent, or needed to respond to your request |
| Claiming from your medical scheme and managing your account | Needed to fulfil our agreement with you; medical scheme processing (section 32) |
| Injury-on-duty claims | Required by the Compensation for Occupational Injuries and Diseases Act |
| Keeping clinical records, meeting HPCSA rules and other laws | Legal obligation |
| Defending a legal claim or complaint | Legitimate interest in establishing or defending a right (section 27) |
| Quality improvement, clinical audit and teaching | Only with identifying details removed, or with your consent |
We do not use your information for marketing, and we do not sell it. [CONTENT PENDING]
4. Who we share it with
We share your information only when your care, your claim or the law needs it, and only as much as is needed.
- Other health professionals involved in your care, such as your GP, referring doctor, physiotherapist, anaesthetist, radiologist or pathologist
- Hospitals where you are treated, including Cure Day Hospital, Edge Day Hospital and Life Mercantile Hospital
- Your medical scheme or its administrator, to claim for your treatment
- The Compensation Fund or its agent, and your employer, for injury-on-duty claims
- Service providers who work for the practice, such as our billing and claims system ([CONTENT PENDING]), switching provider (Healthbridge), IT support, email and cloud storage ([CONTENT PENDING]), and our accountant. They may use your information only to provide their service to us, and must keep it confidential and secure under written agreements.
- Our professional indemnity provider and legal advisers, if a claim or complaint arises
- The HPCSA, a court or another authority, where we are legally required to
We do not otherwise disclose your health information without your written consent, a court order, or where the law requires it.
5. Information stored outside South Africa, and our website
Cross-border transfers: Some of our service providers, such as email or cloud storage, may store information on servers outside South Africa. We only use providers in countries with adequate data protection laws, or who are bound by agreements that protect your information to the standard POPIA requires (section 72). [CONTENT PENDING]
Website and contact form: When you use the contact form, we receive the details you enter and use them only to reply. Please do not send detailed medical information through the form or by email.
Cookies: [CONTENT PENDING]
6. How we protect it and how long we keep it
Security: We keep paper records locked away and electronic records password-protected, with access limited to people who need it to do their work. [CONTENT PENDING] If we believe your information has been accessed without authority, we will tell you and the Information Regulator as soon as reasonably possible, as POPIA requires (section 22).
How long we keep it, following HPCSA guidelines on patient records:
| Record | Kept for at least |
|---|---|
| Adult patients | 6 years after the record becomes dormant |
| Children | Until the patient turns 21 |
| Patients who are mentally incapacitated | Their lifetime |
| Occupational injury or exposure (including injury on duty) | 20 years after treatment |
| Website enquiries that do not lead to a consultation | [CONTENT PENDING] |
After that, records are destroyed securely, for example by shredding or permanent deletion, unless a law or a pending claim requires us to keep them longer.
7. Your rights
You have the right to:
- know whether we hold information about you, and ask for a copy of it
- ask us to correct information that is wrong, out of date or incomplete
- ask us to delete information we no longer have a lawful reason to keep (clinical records must still be kept for the periods in section 6)
- object to how we use your information, where the law allows
- withdraw your consent where we rely on it, without affecting anything done before
- be told if your information has been compromised
- complain to the Information Regulator
Your medical records: you may ask for a copy of your own records. Patients aged 12 and over may request their own; for a child under 16, a parent or guardian may apply with the child’s written authorisation. We may charge a reasonable fee for copies, as set out in our PAIA manual.
How to ask: contact the Information Officer at [CONTENT PENDING]. We may ask you to confirm your identity first, and will respond within [CONTENT PENDING].
8. Complaints and changes to this notice
If you are unhappy with how we have handled your information, please contact the Information Officer first so we can try to put it right.
You may also complain to the Information Regulator:
- Website: inforegulator.org.za
- POPIA complaints: POPIAComplaints@inforegulator.org.za
- Address: Woodmead North Office Park, 54 Maxwell Drive, Woodmead, Johannesburg, 2191
[CONTENT PENDING]
We may update this notice from time to time. The latest version will always be on our website, with the date it was last updated at the top.