PATIENT PRIVACY & DATA PROTECTION POLICY
1. Practice Information & Information Officer
For any queries, access requests, or privacy concerns, contact our designated Information Officer:
- Entity: The Athletes Room Sports Medical Centre
- Physical Address: Ground Floor, Parkside, 12 Park Lane, Umhlanga Ridge, 4319, KwaZulu-Natal, South Africa
- Information Officer: Clinical Administration Desk / Practice Manager
- Direct Email: info@theathletesroom.com
- Direct Telephone / WhatsApp: +27 63 782 5373
2. Personal & Special Personal Information We Collect
In order to provide multidisciplinary healthcare, we collect and process:
- Contact & Identifying Details: Full name, South African ID or passport number, date of birth, residential address, telephone number, and email.
- Clinical & Health Data (Special Personal Information): Medical history, injury mechanisms, surgical history, diagnostic imaging reports, rehabilitation progress notes, clinical photographs (where clinically necessary and consented to), and multidisciplinary referral notes.
- Medical Scheme / Financial Details: Medical aid scheme name, membership number, dependent code, and billing details.
- Digital Interaction Data: Appointment requests, inquiry messages, and website telemetry collected via cookies.
3. Purpose of Processing
We process personal and health data strictly for legitimate clinical and operational reasons:
- Conducting clinical triage, diagnosis, treatment, and ongoing physical rehabilitation.
- Collaborative internal referral across our integrated team (Sports Physicians, Chiropractors, Physiotherapists, Biokineticists, Dietitians, Sports Psychologists, and Massage Therapists) to deliver coordinated care under one roof.
- Direct billing and issuing itemized statements with ICD-10 and statutory tariff codes for medical scheme reimbursement.
- Communicating appointment bookings, reminders, and follow-up clinical instructions.
- Complying with statutory reporting requirements under South African healthcare legislation.
4. Confidentiality & Information Security Safeguards
We maintain appropriate technical, physical, and organizational security measures to prevent unauthorized access, loss, or misuse of personal records:
- All electronic health records (EHR) and appointment data are stored within encrypted, access-controlled healthcare software adhering to ISO/IEC 27001 data security standards.
- All staff and independent practitioners operating within The Athletes Room are bound by strict professional non-disclosure agreements and HPCSA/AHPCSA ethical rules of confidentiality.
- Physical clinical files (where maintained) are secured in locked clinical storage suites accessible only by authorized personnel.
5. Third-Party Disclosures & Cross-Border Transfers
We will never sell or commercially trade your personal data. We disclose information strictly when:
- Explicitly authorized by the patient (e.g. sharing radiology reports with an orthopaedic surgeon or GP).
- Necessary for appointment coordination via our online scheduling infrastructure (Bookem) and secure medical billing switches.
- Mandated by a lawful court order, subpoena, or statutory health regulation.
6. Data Retention Periods
In compliance with HPCSA guidelines and the National Health Act, clinical records are retained for a minimum period of six (6) years from the date of the last consultation, or in the case of minors, until the patient reaches twenty-one (21) years of age.
7. Your Rights Under POPIA
As a data subject under South African law, you have the right to:
- Request confirmation of whether we hold personal information about you.
- Request access to, or copies of, your personal and clinical records (subject to statutory verification).
- Request correction, updating, or rectification of inaccurate or outdated information.
- Object to the processing of personal data on reasonable grounds (where not overridden by medical or statutory obligations).
- Lodge a complaint with the South African Information Regulator (inforegulator.org.za / POPIAComplaints@inforegulator.org.za).