How we handle your information

1Who we are

The T Clinic is a private medical practice led by Dr Thys Heyns, offering aesthetic medicine, regenerative medicine, hormone therapy, and wellness care across three locations in South Africa: Bryanston (Johannesburg), Brooklyn (Pretoria), and Groblersdal (Limpopo).

For the purposes of the Protection of Personal Information Act, the responsible party is [CONFIRM: legal entity name and registration number], trading as The T Clinic, with its principal place of business at Shop 103, Bryanston Shopping Centre, Cnr William Nicol & Ballyclare Drive, 2191.

This policy applies to information collected through this website, in our clinics, by telephone, by email, by WhatsApp, and through any forms or assessments you complete.

2Information we collect

Information you give us directly

When you make a consultation booking, complete our hormone health assessment, fill in a clinic intake form, or contact us by any means, we may collect:

• Your name and surname
• Your contact details (email, phone number, postal address where relevant)
• Your date of birth, age, and gender
• Your medical history, current symptoms, medications, allergies, and lifestyle information relevant to your care
• The results of any clinical tests, blood work, or other assessments performed at the practice
• Photographs taken for treatment planning, before-and-after records, or clinical documentation, where you have given specific consent for these
• Payment information needed to process consultations and treatments
• Any other information you choose to share with us

Information collected automatically

When you visit our website, your browser sends standard technical information such as your IP address, browser type, the pages you view, and the time of your visit. We use this information only to ensure the website works correctly and to understand which pages are most useful to visitors. We do not use this information to identify you personally.

Special personal information

Some of the information we collect — particularly information about your physical and mental health — is classified under POPIA as special personal information. This requires a higher standard of protection. We collect and process this information only with your explicit consent, and only to provide you with the medical care you have asked us to provide.

3Why we collect it

We collect personal information for clearly defined purposes. We do not collect information we do not need, and we do not use the information you give us for purposes other than the ones listed below.

• To provide medical care — to take a clinical history, perform examinations, order appropriate investigations, and develop a treatment plan that is right for you
• To arrange and confirm appointments — to schedule consultations, send reminders, and follow up with you after treatment
• To process payments — to invoice you for services and process payments through our payment provider
• To meet our legal and regulatory obligations — including obligations under the Health Professions Act, the National Health Act, the Medicines and Related Substances Act, and the rules of the Health Professions Council of South Africa (HPCSA)
• To respond to your enquiries — when you contact us by any means
• To send you marketing and educational content — only where you have specifically asked us to (see Section 10)
• To improve our service — by understanding how patients find us and what information they need

4How we use it

Your personal information is used only by the people in our practice who need it to do their work — Dr Heyns, the clinical team, and the administrative team. We do not sell, rent, or trade your personal information. We do not share your information with third parties for their marketing purposes.

The legal basis for processing your information

Under POPIA, we process your information on one of the following bases:

• Your consent — for marketing communications, photographs for promotional use, and any processing of special personal information beyond what is necessary for your care
• Performance of a contract — when you book a consultation, you are entering a service contract with the practice; we need certain information to provide that service
• Legal obligation — where the law requires us to keep certain records (for example, clinical records under the National Health Act)
• Legitimate interest — for example, contacting you to confirm an upcoming appointment or to follow up after a procedure

5Who we share it with

We share your information only where it is necessary for your care or where we are legally required to do so. The categories of third parties who may receive your information are:

• Pathology laboratories — to process blood tests and other investigations you have agreed to
• Compounding pharmacies — when prescribed medications, peptides, or other compounded preparations need to be dispensed to you
• Specialist colleagues — when we refer you onward for care that falls outside our scope, and only with your prior knowledge
• Our medical aid and billing partners — where you have asked us to claim from your medical aid on your behalf
• Our IT and email service providers — under strict confidentiality agreements, to keep our systems working and secure
• Regulatory bodies — where required by law (for example, the HPCSA in the event of a complaint or audit)

Where information must be transferred outside of South Africa (for example, if our email or website hosting is provided by an international service), we ensure that the receiving party is subject to laws or contractual obligations that provide a similar level of protection to POPIA.

6How long we keep it

We keep your information for as long as we need it for the purposes it was collected, and for as long as we are required to under South African law.

• Clinical records — kept for a minimum of six years from the date of last contact, in line with HPCSA Booklet 14 (Guidelines on the Keeping of Patient Records)
• Records relating to minors — kept until the patient reaches age 21, or for six years after last contact, whichever is longer
• Financial records — kept for five years, in line with the Tax Administration Act and the Companies Act
• Newsletter subscriber data — kept until you unsubscribe; we remove it from our systems within 30 days of an unsubscribe request
• Hormone Health Assessment submissions and other website enquiries — if you do not become a patient, your enquiry is kept for 12 months and then deleted

When the retention period ends, we either delete your information securely or anonymise it so that you can no longer be identified.

7How we keep it safe

We take reasonable and appropriate technical and organisational measures to protect your personal information from loss, misuse, unauthorised access, alteration, and disclosure. These include:

• Password-protected practice management systems with access limited to authorised staff
• Encrypted communication for sensitive information sent by email
• Secure, locked physical storage for paper records
• Regular software updates and security patches on all practice systems
• Confidentiality obligations on every member of the team, in writing
• A clear procedure for responding to any suspected security incident

If a security breach occurs that affects your personal information, we will notify the Information Regulator and any affected individuals as required by POPIA, without undue delay.

8Your rights

POPIA gives you specific rights in relation to your personal information. You have the right:

• To know what information we hold about you — and to receive a copy of it
• To correct any information that is inaccurate or out of date
• To have your information deleted in certain circumstances (subject to legal retention obligations that apply to clinical records)
• To object to the processing of your information for direct marketing — at any time, without giving a reason
• To withdraw consent that you previously gave us, at any time
• To complain to the Information Regulator if you believe we have not handled your information correctly

To exercise any of these rights, please contact our Information Officer using the details in Section 13. We will respond within a reasonable period, and in any event within 30 days of receiving your request.

9Cookies and the website

Our website uses a small number of cookies that are strictly necessary to make the site work. These cookies do not identify you personally and are not used for tracking or advertising.

We do not use third-party advertising cookies. We do not share data with social media platforms for advertising purposes. If we add any analytics tools in future to understand how the website is used, they will be configured to anonymise visitor data and we will update this policy first.

You can disable cookies in your browser settings. The website will continue to work, but some convenience features may not.

10Marketing and newsletters

We send marketing communications — newsletters, health information, educational content, and details of our services — only to people who have specifically agreed to receive them.

Your agreement to receive marketing is separate from your agreement to be contacted about a consultation. You can be contacted about a booking without agreeing to receive newsletters, and you can choose to receive newsletters without affecting your consultation arrangements in any way.

How we record your consent

When you opt in to our newsletter — whether through the hormone health assessment, a website signup form, or a tick-box on any other form — we record the date you opted in and the form you used. This becomes your consent record under POPIA.

How to unsubscribe

Every marketing email we send includes an unsubscribe link. You can also email us directly to be removed from our marketing list. Unsubscribing has no effect on your status as a patient or on any other communication from us about your care.

What we will never do

• We will never sell, rent, or trade your email address or contact details
• We will never add you to our newsletter list without your explicit, informed consent
• We will never send you marketing on behalf of third parties

11Children

Our services are intended for adults. We do not knowingly collect personal information from children under the age of 18 through our website. If a child is a patient of the practice (for example, as part of family care), their information is collected only with the consent of a parent or legal guardian, and is handled with the additional protections that POPIA requires for minors.

12Changes to this policy

We review this policy regularly and may update it from time to time — for example, when the law changes, when we introduce new services, or when our processes change.

The current version is always available on this page, with the date of the last review shown at the top. If we make a significant change that affects how we use your information, we will let you know directly and, where required, ask for your renewed consent.

13How to contact us

If you have any questions about this policy, want to exercise any of your rights, or want to make a complaint, please contact our Information Officer.

We aim to respond to all privacy enquiries within 30 days of receiving them.