MEDICLINIC GROUP OF COMPANIES MANUAL IN TERMS OF THE PROMOTION OF ACCESS TO INFORMATION ACT, NO 2 OF 2000

1.         LIST OF ACRONYMS AND ABBREVIATIONS

“Client” A natural or juristic person who receives services from Mediclinic.

“Data subject” The natural or juristic person to whom personal information relates

“DIO” Deputy Information Officer;       

“IO“ Information Officer;

“Manual” means the manual, together with all the annexures thereto as amended and made available at the offices of Mediclinic from time to time

“Mediclinic” means Mediclinic Pty Ltd (registration number -1969/009218/07)

“PAIA” Promotion of Access to Information Act No. 2 of 2000 (as Amended;

“POPIA” Protection of Personal Information Act No.4 of 2013;

“Processing” means any operation or activity or any set of operations whether or not by automatic means concerning personal information, including –

a)     The collection, receipt, recording organisation, collation, storage, updating or modification, retrieval, alteration, consultation or use;

b)     Dissemination by means of transmission, distribution or making available in other form; or

c)     Merging, linking, as well as restriction, degradation, erasure or destruction of information.

“Regulator” Information Regulator; and

“Requester” means any person or entity (including any data subject) requesting access to a record that is under the control of Mediclinic.

“Third-party” means any independent contractor, agent, consultant, sub-contractor or other representative of Mediclinic.

2.         PREAMBLE

Manual of the Mediclinic Group of Companies (as per the individual companies and entities on the attached list, herein represented by Mediclinic (Pty) Ltd) prepared in terms of section 51 of the Promotion of Access to Information Act, No 2 of 2000.

3.         ABOUT MEDICLINIC

Mediclinic is a diversified international private healthcare services group, established in South Africa in 1983, with divisions in Switzerland, Southern Africa (South Africa and Namibia) and the Middle East.

Mediclinic is focused on providing specialist-orientated, multi-disciplinary services across the continuum of care in such a way that the Group will be regarded as the most respected and trusted provider of healthcare services by clients, medical practitioners, funders and regulators of healthcare in each of its markets.

Mediclinic takes a sustainable, long-term approach to business, putting clients at the heart of its operations and consistently delivering high-quality healthcare services. In order to deliver on these priorities, the Group upholds the highest standards of clinical governance and ethical behaviour across its divisions; invests significant time and resources in recruiting and retaining skilled employees; makes considerable investment into its facilities and equipment; and respects the communities and environment in the areas in which it operates.

4.         PURPOSE OF PAIA MANUAL

   This PAIA Manual is useful for the public to-

4.1        check the categories of records held by a body which are available without a person having to submit a formal PAIA request;

4.2        have a sufficient understanding of how to make a request for access to a record of the body, by providing a description of the subjects on which the body holds records and the categories of records held on each subject;

4.3        know the description of the records of the body which are available in accordance with any other legislation;

4.4        access all the relevant contact details of the Information Officer and Deputy Information Officer who will assist the public with the records they intend to access;

4.5        know the description of the guide on how to use PAIA, as updated by the Regulator and how to obtain access to it;

4.6        know if the body will process personal information, the purpose of processing of personal information and the description of the categories of data subjects and of the information or categories of information relating thereto;

4.7        know the description of the categories of data subjects and of the information or categories of information relating thereto;

4.8        know the recipients or categories of recipients to whom the personal information may be supplied;

4.9        know if the body has planned to transfer or process personal information outside the Republic of South Africa and the recipients or categories of recipients to whom the personal information may be supplied; and

4.10     know whether the body has appropriate security measures to ensure the confidentiality, integrity and availability of the personal information which is to be processed.

5        CONTACT DETAILS

6.      INFORMATION REGULATORS GUIDE

An official PAIA Guide has been compiled which contains information to assist a person

wishing to exercise a right of access to information in terms of PAIA and POPIA. Copies of the PAIA Guides are available, in two official languages, English and Afrikaans for public inspection at our registered head office during normal business hours (08h30 – 16h30). The PAIA Guide is also available on the Regulator’s website https://inforegulator.org.za/paia-guidelines/, in all eleven (11) official languages and copies thereof, including braille, are available at the Office of the Information Regulator, for inspection, during normal office hours. The Information Regulator can be reached at:

7.         ENTRY POINT FOR REQUESTS

            PAIA provides that a person may only make a request for information, if the information is required for the exercise or protection of a legitimate right. Information will therefore not be furnished unless a person provides sufficient particulars to enable Mediclinic to identify the right that the requester is seeking to protect as well as an explanation as to why the requested information is required for the exercise or protection of that right. The exercise of an individual’s rights is subject to justifiable limitations, including the reasonable protection of privacy, commercial confidentiality and effective, efficient and good governance. PAIA and the request procedure contained in this Manual may not be used for access to a record for criminal or civil proceedings, nor should information be requested after the commencement of such proceedings.

The IO has been delegated with the task of receiving and coordinating all requests for access to records in terms of PAIA, in order to ensure proper compliance with PAIA and POPIA.

The IO will facilitate the liaison with the internal legal team on all of these requests. All requests in terms of PAIA and this Manual must be addressed to the IO using the details in paragraph 3 above.

8.      CATEGORIES OF RECORDS OF MEDICLINIC WHICH ARE AVAILABLE WITHOUT A PERSON HAVING TO REQUEST ACCESS

There is currently no description of categories of records which are automatically available in terms of section 52(2) of the Act.  Information that is obtainable via the Mediclinic website about Mediclinic is automatically available and need not to be formally requested in terms of this Manual. The following categories of records are automatically available:

• Mediclinic Group Corporate Profile
• Website of Mediclinic Group: https://www.mediclinic.com/en/home.html. The Mediclinic website is available to anybody who access the Internet setting out:
• Clinical Services
  • Overview of Clinical Services
  • Clinical Services Reports
• A summary of the Operating Divisions (Switzerland, Southern Africa, The Middle East)
• Careers Portal  
• Modern Slavery Statement
• Terms of Use
• Privacy Statement
• Cookie Policy
• Contact Details.
• Sustainable Development
  • Policies related to Business Conduct and Ethics
  • Anti-Bribery Policy
  • Ethics Contact Persons
  • Risk Management  
    • Tax Strategy
    • Protecting Information Assets
• Corporate Governance
  • Section 172 Statement

8.      DESCRIPTION OF THE RECORDS OF MEDICLINIC WHICH ARE AVAILABLE IN ACCORDANCE WITH ANY OTHER LEGISLATION  

         All records that are legally required to be kept by the company in terms of the following legislation are available:

• Basic Conditions of Employment Act 75 of 1997;
• Broad-Based Black Economic Empowerment Act 53 of 2003;
• Companies Act 71 of 2008;
• Compensation for Occupational Injuries and Diseases Act 130 of 1993;
• Competition Act 89 of 1998;
• Constitution of South Africa Act 108 of 1996;
• Electronic Communications and Transactions Act 25 of 2000;
• Employment Equity Act 55 of 1998
• Financial Advisory and Intermediary Services Act 32 of 2002;
• Financial Intelligence Centre Act 38 of 2001;
• Income Tax Act 58 0f 1962;
• Insolvency Act 24 of 1936;
• Regulation of Interception of Communications and Provision of Communication-related Information Act 70 of 2002;
• Labour Relations Act 66 of 1995
• National Health Act 61 of 2003
• Occupational Health and Safety Act 85 of 1993;
• Prevention and Combating of Corrupt Activities Act 12 of 2004;
• Promotion of Access to Information Act 2 of 2000;
• Promotion of Equality and Prevention of Unfair Discrimination Act 4 of 2000;
• Protection of Personal Information Act 4 of 2013;
• Skills Development Act 97 of 1997; 
• Skills Development Levies Act 9 of 1999; 
• Unemployment Insurance Act 30 of 1966; 
• Value-Add Tax Act 89 of 1991; 
• Any other legislation relevant to the business concerned

Although Mediclinic has used its best endeavours to supply the Requester with a complete list of applicable legislation, it is possible that the above list may be incomplete. Wherever it comes to Mediclinic’s attention that existing or new legislation allows a Requester access on a basis other than that set out in the Act, Mediclinic shall promptly update the list. If a Requester believes that a right to access to a Record exists in terms of the legislation listed above, or any other legislation, the Requester is required to indicate what legislative right the request is based on, to allow the Information Officer the opportunity of considering the request in light thereof.

9.      DESCRIPTION OF THE SUBJECTS ON WHICH THE BODY HOLDS RECORDS AND CATEGORIES OF RECORDS HELD ON EACH SUBJECT BY MEDICLINIC

10.       PROCESSING OF PERSONAL INFORMATION

10.1     PRPOSE OF MEDICLINIC PROCESSING OF PERSONAL INFORMATION       

10.1.1   Mediclinic will only process data subject’s personal information for a specific, lawful and clear purpose and will ensure that it notifies the data subject, unless we consider that we need to use it for another reason and that reasons is compatible with the original purpose for which the information was collected.

10.1.2   It will ensure there is a legal basis for the processing of any personal information.

10.1.3   Mediclinic will retain personal information only for no longer that is necessary or permitted by applicable law. Once information is no longer required in accordance with our retention policies, it will be securely destroyed.  In some circumstances, we may anonymize personal information so that it can longer be associated with data subjects, in which case may use such information without further notice. 

10.1.4   Mediclinic may share your personal information with third parties and other appropriate persons within the Group. We require all such persons to respect the security of data subjects’ personal information and to treat it in accordance with the applicable laws.

10.2      DESCRIPTION OF THE CATEGORIES OF DATA SUBJECT AND OF THE INFORMATION CATEGORIES OF INFORMATION RELALTING THERETO:

* All the details regarding the processing activities per data subject category listed above can be obtained from the company’s website, the employee privacy notice is available to employees on the Connect employees system.   

10.3      THE RECIPIENTS OR CATEGORIES OF RECIPIENTS TO WHOM THE PERSONAL INFORMATION MAY BE SUPPLIED

We use different methods to collect personal information from and about you, including through:

• Direct interactions: You may provide certain personal information (such as your name, address, telephone and e-mail address) by filling in forms or by corresponding with us by post, phone, e-mail or otherwise. This includes personal data you provide when you register for e-mail alerts on this website; request information to be sent to you; complete and submit a survey; or provide feedback to us.
• Automated technologies or interactions: As you interact with our website, we may automatically collect technical data about your equipment, browsing actions and patterns. We collect this by using cookies. Please see our cookie policy on our website for further details. Through analytics, we use anonymised aggregated data such as statistical or demographic data.
• Third parties: We may receive personal data about you or aggregated technical data from external services providers contracted by Mediclinic to host or maintain certain sections our website.
• We may have to share your personal data with the persons set out below for the purposes set out in section 10. We require all such persons to respect the security of your personal information and to treat it in accordance with applicable law.

10.3.1   Internationally within Mediclinic

·       The Mediclinic Group is an international healthcare services group, with the Company’s registered office in the United Kingdom and its management offices based in South Africa. The Mediclinic Group has operating divisions, all of which are based outside the EU, in Switzerland (Hirslanden), South Africa and Namibia (Mediclinic Southern Africa) and the United Arab Emirates (Mediclinic Middle East). As such our information systems or those of service providers may be in different countries. This may result in the transfer of your personal information might end up in one of those information systems to another country, and that country may have a different level of data protection regulation than yours. By giving us personal information, you consent to this kind of transfer of your personal information. No matter what country your personal information is in, you can expect a similar degree of protection in respect of your personal information which will be processed in accordance with our privacy and data protection policy and applicable laws.

10.3.2    Agents or service providers

·       As explain above, we outsource the processing of certain functions and/or information to third parties. When we do outsource the processing of your personal information to third parties or provide your personal information to third-party service providers, we oblige those third parties to protect your personal information with appropriate security measures in accordance with our standards and applicable law.  

10.3.3   Business transfers

·       Third parties to whom we may choose to sell, transfer, or merge parts of our business or our assets. Alternatively, we may seek to acquire other businesses or merge with them. If a change happens to our business, then the new owners may use your personal information in the same way as set out in this privacy notice.

10.3.3    Legal requirements

·       We reserve the right to disclose any personal information we have concerning you if we are compelled to do so by a court of law, requested to do so by a governmental entity, or if we determine it is necessary or desirable to comply with the law or to protect or defend our rights or property in accordance with applicable laws. We also reserve the right to retain personal information collected and to process such personal information to comply with accounting, tax rules, regulations and any specific record retention laws.

·       We require all third parties to respect the security of your personal information and to treat it in accordance with the law. We do not allow our third-party service providers to use your personal information for their own purposes and only permit them to process your personal information for specified purposes and in accordance with our instructions.

10.4     TRANS BORDER FLOW OF PERSONAL INFORMATION 

Mediclinic and our service providers takes appropriate technical and organisational measures designed to ensure that personal information remains confidential and secure against unauthorised or unlawful processing against accidental loss, destruction or damage. Technical and organisational measures include:

·       Encryption of data in transit and at rest;

·       Identity and access management;

·       Infrastructure and operations security;

·       Vulnerability management; 

·       Business continuity planning;

·       Disaster recovery planning; and

·       Security awareness.

Further details of these measures are available upon request. We have put in place procedures to deal with any suspected data security breaches, and will notify data subjects and the Regulator of a suspected breach where we are legally required to do so.

11        REQUEST PROCEDURE

11.1      Completion of prescribed forms

Any request for access to a record in terms of PAIA must correspond with the PAIA Form 2: Request for Access to Record and should be specific in terms of the record requested. (See PAIA Form 2 Regulation 7  hereto.). A request for access to information which does not comply with the formalities as prescribed by PAIA will be returned to you. POPIA provides that a data subject may, upon proof of identity, request Mediclinic to confirm, free of charge, all the information it holds about the data subject and may request access to such information, including information about the identity of third parties who have or have had access to such information.

POPIA also provides that where the data subject is required to pay a fee for services provided to him/her, Mediclinic must provide the data subject with a written estimate of the payable amount before providing the service and may require that the data subject pays a deposit for all or part of the fee.

Grounds for refusal of the data subject’s request are set out in PAIA and are discussed below. POPIA provides that a data subject may object, at any time, to the processing of personal information by Mediclinic, on reasonable grounds relating to his/her particular situation, unless legislation provides for such processing. The data subject must complete the prescribed form attached hereto as POPIA Form 1: Objection to the Processing of Personal Information and submit it to the IO at the postal or physical address or electronic mail address set out above.

A data subject may also request Mediclinic to correct or delete personal information about the data subject in its possession or under its control that is inaccurate, irrelevant, excessive, out of date, incomplete, misleading or obtained unlawfully; or destroy or delete a record of personal information about the data subject that Mediclinic is no longer authorised to retain records in terms of POPIA’s retention and restriction of records provisions.

A data subject that wishes to request a correction or deletion of personal information or the destruction or deletion of a record of personal information must submit a request to the IO at the postal or physical address or electronic mail address set out above on the form attached hereto as POPIA Form 2: Request for Correction or Deletion of Personal Information .

11.2      Proof of Identity

Proof of identity is required to authenticate your identity and the request. You will, in addition to this prescribed POPIA Form 2, be required to submit acceptable proof of identity such as a certified copy of your identity document or other legal forms of identity.

11.3      Payment of the prescribed fees

11.4      Timelines for consideration of a request for access

Request will be processed within 30 (thirty) days, unless the request contains considerations that are of such a nature that an extension of the time limit is needed. The Information Officer will inform the requester of the decision, and the fees payable (if applicable) on a form corresponding with PAIA Form 3: Outcome of Request and of Fees Payable promulgated under PAIA Regulations (Link to form to be included).

Should an extension be required, you will be notified, together with reasons explaining why the extension is necessary. PAIA Form 3: Outcome of Request and Fees Payable.

11.5      Grounds for refusal of access and protection of information:

12.       REMEDIES AVAILABLE TO A REQUESTER ON REFUSAL OF ACCESS

If the IO decides to grant you access to the particular record, such access must be granted with thirty (30) days of being informed of the decision. There is no internal appeal procedure that may be followed after a request to access to information has been refused. The decision made by the IO is final. In the event that you are not satisfied with the outcome of the request, you are entitled to lodge an internal appeal, a compliant to the Regulator by using PAIA Form 5: Complaint Form , or apply to a court of competent jurisdiction.  

13.       AVAILABILITY OF THIS MANUAL

Copies of this manual are available from the IO for inspection, free of charge at the offices of Mediclinic at 25 Du Toit Street, Stellenbosch, 7600.

LIST OF COMPANIES / ENTITIES

• Curamed Holdings (Pty) Ltd
• Curamed Hospitals (Pty) Ltd t/a:
  • Mediclinic Heart Hospital
  • Mediclinic Kloof
  • Mediclinic Medforum
  • Mediclinic Muelmed
• Curamed Properties (Pty) Ltd
• D.J.H. Defty (Pty) Ltd t/a D.J.H. Defty Pharmacy
• ER24 EMS (Pty) Ltd t/a ER24
• ER24 Holdings (Pty) Ltd
• ER24 International (Pty) Ltd
• George Day Hospital (Pty) Ltd
• Medical Human Resources (Pty) Ltd
• Medical Innovations (Pty) Ltd
• Mediclinic Bloemfontein Investments (Pty) Ltd
• Mediclinic Bloemfontein Day Clinic Investments (Pty) Ltd
• Mediclinic Brits (Pty) Ltd t/a Mediclinic Brits
• Mediclinic Cape Gate Investments (Pty) Ltd
• Mediclinic Cape Gate Day Clinic Investments (Pty) Ltd
• Mediclinic Cape Town Investments (Pty) Ltd
• Mediclinic Constantiaberg Investments (Pty) Ltd
• Mediclinic Crescent Mental Health Services (Pty) Ltd t/a Mediclinic Crescent Mental Health Services
• Mediclinic Denmar Mental Health Services (Pty) Ltd t/a Mediclinic Denmar Mental Health Services
• Mediclinic Diagnostic Imaging Services (Pty) Ltd
• Mediclinic Durbanville Day Clinic Investments (Pty) Ltd
• Mediclinic Durbanville Investments (Pty) Ltd
• Mediclinic Emfuleni Investments (Pty) Ltd
• Mediclinic Ermelo (Pty) Ltd t/a Mediclinic Ermelo
• Mediclinic Finance Corporation (Pty) Ltd
• Mediclinic George Investments (Pty) Ltd
• Mediclinic Group Services (Pty) Ltd
• Mediclinic Hermanus (Pty) Ltd t/a Mediclinic Hermanus
• Mediclinic Highveld Investments (Pty) Ltd
• Mediclinic Hoogland Investments (Pty) Ltd
• Mediclinic Imaging Holdings (Pty) Ltd
• Mediclinic Imaging Equipment (Pty) Ltd
• Mediclinic International (RF) (Pty) Ltd
• Mediclinic Investments (Pty) Ltd
• Mediclinic Kimberley (Pty) Ltd t/a:
  • Mediclinic Kimberley
  • Mediclinic Gariep
• Mediclinic Klein Karoo Investments (Pty) Ltd
• Mediclinic Legae Investments (Pty) Ltd
• Mediclinic Lephalale (Pty) Ltd t/a Mediclinic Lephalale
• Mediclinic Limpopo Day Clinic (Pty) Ltd t/a Mediclinic Limpopo Day Clinic
• Mediclinic Limpopo Investments (Pty) Ltd
• Mediclinic Limpopo (Pty) Ltd t/a Mediclinic Limpopo
• Mediclinic Limpopo Trust t/a Mediclinic Limpopo
• Mediclinic Louis Leipoldt Investments (Pty) Ltd
• Mediclinic Midstream (Pty) Ltd t/a Mediclinic Midstream
• Mediclinic Milnerton Investments (Pty) Ltd
• Mediclinic Morningside Investments (Pty) Ltd
• Mediclinic Nelspruit Investments (Pty) Ltd
• Mediclinic Nelspruit Day Clinic Investments (Pty) Ltd
• Mediclinic Paarl (Pty) Ltd t/a Mediclinic Paarl
• Mediclinic Panorama Investments (Pty) Ltd
• Mediclinic Pathology (Pty) Ltd
• Mediclinic Pietermaritzburg Investments (Pty) Ltd
• Mediclinic Plettenberg Bay Investments (Pty) Ltd
• Mediclinic Potchefstroom (Pty) Ltd t/a Mediclinic Potchefstroom
• Mediclinic Precise (Pty) Ltd
• Mediclinic Properties (Pty) Ltd
• Mediclinic Renal Services (Pty) Ltd t/a
  • Mediclinic Bloemfontein Renal Clinic
    
  • Mediclinic Brits Renal Clinic
  • Mediclinic Gariep Renal Clinic
  • Mediclinic Highveld Renal Clinic
  • Mediclinic Limpopo Renal Clinic
  • Mediclinic Milnerton Renal Clinic
  • Mediclinic Morningside Renal Clinic
  • Mediclinic Pietermaritzburg Renal Clinic
  • Mediclinic Potchefstroom Renal Clinic
  • Mediclinic Victoria Renal Clinic
  • Mediclinic Vergelegen Renal Clinic
  • Mediclinic Soweto Renal Clinic
• Mediclinic Renal Services Investments (Pty) Ltd
• Mediclinic (Pty) Ltd t/a:
  • Mediclinic Bloemfontein
  • Mediclinic Bloemfontein Day Clinic
  • Mediclinic Cape Gate
  • Mediclinic Cape Gate Day Clinic
  • Mediclinic Cape Town
  • Mediclinic Constantiaberg
  • Mediclinic Durbanville
  • Mediclinic Durbanville Day Clinic
  • Mediclinic Emfuleni
  • Mediclinic Geneva
  • Mediclinic George
  • Mediclinic Highveld
  • Mediclinic Hoogland
  • Mediclinic Klein Karoo
  • Mediclinic Legae
  • Mediclinic Legae Mental Health Services
  • Mediclinic Louis Leipoldt
  • Mediclinic Milnerton
  • Mediclinic Morningside
  • Mediclinic Nelspruit
  • Mediclinic Nelspruit Day Clinic
  • Mediclinic Neuro Clinic
  • Mediclinic Panorama
  • Mediclinic Pietermaritzburg
  • Mediclinic Plettenberg Bay
  • Mediclinic Sandton
  • Mediclinic Vereeniging
  • Mediclinic Vergelegen
  • Mediclinic Vergelegen Day Clinic
  • Mediclinic Welkom
  • Mediclinic Worcester
• Mediclinic Sandton Investments (Pty) Ltd
• Mediclinic Secunda Investments (Pty) Ltd
• Mediclinic Southern Africa (Pty) Ltd
• Mediclinic Stellenbosch (Pty) Ltd t/a Mediclinic Stellenbosch
• Mediclinic Stellenbosch Day Clinic (Pty) Ltd t/a Mediclinic Stellenbosch Day Clinic
• Mediclinic Thabazimbi (Pty) Ltd t/a Mediclinic Thabazimbi
• Mediclinic Tzaneen Investments (Pty) Ltd
• Mediclinic Tzaneen (Pty) Ltd t/a Mediclinic Tzaneen
• Mediclinic Upington (Pty) Ltd t/a Mediclinic Upington
• Mediclinic Vereeniging Investments (Pty) Ltd
• Mediclinic Vergelegen Investments (Pty) Ltd
• Mediclinic Vergelegen Day Clinic Investments (Pty) Ltd
• Mediclinic Welkom Investments (Pty) Ltd
• Mediclinic Winelands (Pty) Ltd t/a:
  • Mediclinic Winelands Orthopaedic Hospital
  • Mediclinic Winelands Day Clinic
• Mediclinic Worcester Investments (Pty) Ltd
• Newcastle Private Hospital (Pty) Ltd t/a:
  • Mediclinic Newcastle
  • Mediclinic Newcastle Day Clinic
  • Kintsugi Psychiatric Hospital
• Practice Relief (Pty) Ltd
• Victoria Hospital Investments (Pty) Ltd
• Victoria Hospital (Pty) Ltd t/a Mediclinic Victoria
• Victoria Hospital Pharmacy (Pty) Ltd t/a Victoria Hospital Pharmacy
• Wits University Donald Gordon Medical Centre (Pty) Ltd t/a Wits Donald Gordon Medical Centre
• WDGMC Pharmacy (Pty) Ltd t/a WDGMC Pharmacy
• Welkom Medical Centre (Free State) (Pty) Ltd t/a:
  • Welkom Medical Centre Sub Acute Hospital
  • Welkom Medical Centre Day Clinic

* Please note this list is not exhaustive and may be updated from time to time as required.

13. UPDATING OF THE MANUAL

The Information Officer of Mediclinic will on a regular basis update this manual as required.

Issued by  

Clinton Lottering

Information Officer

Particulars of Company and authorised officer