Privacy Policy

Mediwell Medical and Dental Centre, Dainfern Square, cnr William Nicol Dr and Broadacres Dr, Fourways, is the responsible party for your personal information under POPIA. The practice decides why and how your information is processed.

The Medislim platform is the software the practice uses to run the programme. It processes your information as an operator: only on the practice's instruction and under confidentiality and security obligations. This policy covers your use of the Medislim website and app.

We collect and store the following categories:

• Account and contact details. Your name, email address, and phone number, verified through our sign-in provider when you create an account.
• Health information. Clinical measurements recorded by the practice or logged by you, such as weight, height, waist and hip measurements, blood pressure, heart rate, blood glucose, HbA1c, cholesterol, and thyroid results; screening answers; treatment eligibility assessments; programme enrolment status; your goals; and notes attached to your bookings. This is special personal information under POPIA and we treat it with the highest level of protection.
• Booking details. Appointments you make with the practice, including their status and any notes.
• Payment records. Your subscription plan, payment history, and secure payment references from our payment provider. We never see or store your card number.
• Access records. A log of actions taken on your records, including which staff member viewed your clinical record and when. This log protects you and is never deleted.

If the practice creates a record for you before you sign up, for example when you book as a new patient, we hold the contact details you gave the practice until you claim your account. Those details are then replaced with the verified details from your sign-in.

We do not use advertising trackers or analytics cookies. The only cookies we set are those needed to keep you signed in.

We process your information to:

• provide the Medislim programme: recording and tracking your clinical results, managing your goals, enrolment, and bookings;
• manage your account and keep it secure;
• process your subscription payments;
• communicate with you about your care, your account, and your bookings;
• meet legal obligations, including medical record-keeping duties.

Our legal grounds under POPIA are: your consent, given when you create your account; the need to perform the agreement we have with you; and our legal obligations as a medical practice. Health information is processed under the specific POPIA provisions that allow medical professionals and healthcare institutions to process it for the purpose of providing you with proper treatment and care (sections 27 and 32 of POPIA).

We do not sell your information and we do not use it for third-party marketing.

Within the practice, access is restricted by role. Clinical staff involved in your care can view your health records, and every time a staff member opens your clinical record, that access is logged. Administrative staff see only what their role requires, such as booking and membership details.

Service providers process information on our behalf, each under contractual confidentiality and security obligations:

• Clerk provides sign-in and account security, and holds your verified email address and phone number.
• Convex hosts our database, where the records described in section 2 are stored.
• Paystack processes payments. Paystack receives your email address and handles your card details directly; we only store secure references.

Beyond this, we disclose personal information only where a law requires it or where you ask us to.

Some of our service providers store information on infrastructure outside South Africa. Where that happens, POPIA section 72 applies: we only use providers that are bound by contractual obligations providing a level of protection substantially similar to POPIA, covering confidentiality, security, and restrictions on further transfer.

We keep different records for different periods:

• Clinical records must by law be retained for a minimum period after your last treatment, in line with the National Health Act and the guidance of the Health Professions Council of South Africa. We cannot delete them earlier, even at your request, but we can restrict them so they are locked away from day-to-day use.
• Account and profile information with no legal retention duty is deleted or de-identified when it is no longer needed, or when you make a verified deletion request.
• Payment records are kept as long as tax and financial laws require.
• Access and audit records are kept permanently. They contain actions and timestamps, not clinical content, and they are the evidence that your information was handled lawfully.

When a retention period lapses, the record is destroyed or de-identified. De-identified information can no longer be linked to you and is no longer personal information under POPIA.

Safeguards we apply include:

• encryption of your information in transit and at rest;
• role-based access controls so staff only reach what their role requires;
• logged access to clinical records, reviewable by the practice;
• verified sign-in through a dedicated authentication provider;
• an append-only audit trail of administrative and clinical actions.

If a security compromise affecting your personal information occurs, we will notify you and the Information Regulator as POPIA section 22 requires.

Under POPIA you have the right to:

• Access: ask what personal information we hold about you and receive a copy.
• Correction: ask us to correct or complete information that is inaccurate or out of date.
• Deletion: ask us to delete or de-identify your information. For clinical records this takes effect as restriction until the legal retention period lapses, as explained in section 6.
• Objection: object to processing, on reasonable grounds, where the processing is not required by law.
• Withdraw consent: withdraw consent you have given, without affecting processing that happened before withdrawal.

You can submit a deletion request from the Privacy and data page in the app, or make any request directly to the Information Officer using the details in section 9. We may ask you to verify your identity before acting on a request. The practice reviews each request and confirms the outcome to you.

If you are not satisfied with how a request was handled, you may complain to the Information Regulator (South Africa): Woodmead North Office Park, 54 Maxwell Drive, Woodmead, Johannesburg, 2191; email POPIAComplaints@inforegulator.org.za; website inforegulator.org.za.

The Medislim programme is intended for adults. Where the practice treats a person under 18, their information is processed with the consent of a parent, guardian, or other competent person, as POPIA requires.

The Information Officer for Mediwell Medical and Dental Centre is the head of the practice. You can reach the Information Officer through:

• Post or in person: Mediwell Medical and Dental Centre, Dainfern Square, cnr William Nicol Dr and Broadacres Dr, Fourways
• Phone: 011 300 2900
• Email: reception@mediwell.co.za, marked for the attention of the Information Officer

We may update this policy from time to time. Each version carries a version number and effective date at the top of this page. If a change is material, we will ask you to review and accept the updated policy the next time you use the app. Your continued use after the effective date means the updated policy applies. See also our Terms of Service.