Protection of Personal Information Act Compliance
How Botshilu Private Hospital Protects Your Personal Information
Our Commitment to POPIA
The Protection of Personal Information Act, 4 of 2013 (“POPIA”) is South Africa’s data protection law. It exists to ensure that organisations handling your personal information do so responsibly, transparently, and with respect for your right to privacy.
As a healthcare provider, Botshilu Private Hospital holds some of the most sensitive personal information imaginable, your medical history, your diagnoses, your treatment details, your family contacts, your financial information. We don’t take that lightly. POPIA compliance isn’t a box-ticking exercise for us. It’s a fundamental part of how we operate, and it reflects our belief that every patient is entitled to know exactly how their information is collected, used, stored, and protected.
What POPIA Means for You as a Patient
In practical terms, POPIA gives you specific rights regarding your personal information, and places specific obligations on Botshilu. Here’s what that looks like in the context of your care.
We only collect information we genuinely need. When you’re admitted to Botshilu, we collect personal details, medical history, medical aid information, next of kin contacts, and other information directly related to providing your care, processing your medical aid claims, and meeting our legal obligations. We don’t collect information for the sake of it, and we don’t use your information for purposes unrelated to your healthcare.
We tell you what we’re collecting and why. When you provide personal information, whether through admission forms, website enquiries, or other interactions, you have the right to know what’s being collected, why it’s being collected, and how it will be used. Our staff are trained to explain this, and our admission documentation includes the necessary consent and information provisions.
We keep your information accurate. Incorrect medical information can be dangerous. We take reasonable steps to ensure the personal information we hold about you is complete, accurate, and up to date. If your details change, contact numbers, address, medical aid, next of kin, please let us know so we can update our records.
We don’t share your information without good reason. Your personal information is shared only with healthcare professionals directly involved in your care, with your medical aid scheme for claims processing and benefit confirmation, with pathology and diagnostic partners (such as Ampath) as required for your treatment, and where we are legally obliged to do so. We do not sell, trade, or share your personal information with unrelated third parties for marketing or commercial purposes.
We protect your information. Botshilu has implemented physical, technical, and organisational security measures to safeguard your personal information against unauthorised access, loss, damage, or destruction. These measures include controlled physical access to the hospital and records storage areas, 24-hour security, password-protected computer systems, anti-virus and network security measures, and staff training on confidentiality and data protection obligations.
We don’t keep your information forever. Once your personal information is no longer needed for the purpose it was collected, or once the legally required retention period has expired, we destroy or delete it in a manner that prevents reconstruction. Medical records are retained for the periods prescribed by the National Health Act and related regulations.
Your Rights Under POPIA
POPIA gives you the following rights in relation to your personal information held by Botshilu:
The right to be informed that we hold personal information about you, and what that information is.
The right to request access to the personal information we hold about you.
The right to request correction of personal information that is inaccurate, incomplete, misleading, or not up to date.
The right to request deletion of personal information that is no longer necessary for the purpose it was collected, subject to legal retention requirements.
The right to object to the processing of your personal information in certain circumstances.
The right to withdraw consent previously given for the processing of your personal information, where consent was the basis for processing.
The right to lodge a complaint with the Information Regulator if you believe your personal information has been mishandled.
To exercise any of these rights, please contact our Information Officer using the details provided below.
How We Handle Data Breaches
In the event that we have reasonable grounds to believe your personal information has been accessed or acquired by an unauthorised person, we will notify the Information Regulator and you (unless your identity cannot be established) as soon as reasonably possible after discovering the breach. The notification will include sufficient information to allow you to take protective measures, a description of the possible consequences of the breach, and an account of the measures we have taken or intend to take to address the breach.
Special Personal Information
POPIA classifies certain categories of personal information as “special personal information” requiring additional protection. This includes information about a person’s health, religious or philosophical beliefs, race or ethnic origin, trade union membership, political persuasion, biometric information, and criminal behaviour.
As a hospital, we necessarily process health-related special personal information as part of providing your care. This processing is permitted under POPIA where it is necessary for the provision of healthcare services and is carried out by a healthcare professional or someone subject to obligations of confidentiality. We apply heightened safeguards to all special personal information in our possession.
Children’s Personal Information
POPIA provides additional protection for the personal information of children (persons under the age of 18). Where we treat minors, we collect and process their personal information with the consent of a parent or legal guardian, and in accordance with the additional protections required by the Act.
Our Information Officer
Botshilu has appointed an Information Officer registered with the Information Regulator, as required by POPIA. The Information Officer is responsible for encouraging compliance with POPIA across the hospital, dealing with requests from data subjects regarding their personal information, cooperating with the Information Regulator in relation to any investigations, and ensuring that Botshilu’s processing of personal information remains lawful and compliant.
Information Regulator
If you are not satisfied with how Botshilu has handled your personal information or responded to a request, you have the right to lodge a complaint with the Information Regulator of South Africa.
The Information Regulator Address: JD House, 27 Stiemens Street, Braamfontein, Johannesburg, 2001 P.O. Box 31533, Braamfontein, 2017 Telephone: 010 023 5207 Email: enquiries@inforegulator.org.za Website: www.justice.gov.za/inforeg
Contact Us
For any queries about POPIA compliance at Botshilu Private Hospital, to exercise your rights regarding your personal information, or to report a concern about how personal information is being handled, please contact:
Information Officer Email: info@phelangbonolo.co.za
Legal & Compliance Manager Wendy Massangaie Email: wendy.massangaie@phelangbonolo.co.za
Botshilu Private Hospital ERF 212, Block IA, Buitenkant Street Soshanguve, 0152 Gauteng
Tel: 012 798 7000 Email: info@phrlangbonolo.co.za