Privacy Policy.

Dr. Arnold Douglas Incorporated ("the Practice", "we", "us", "our") is committed to protecting the privacy and personal information of every patient, prospective patient, and website visitor. This Privacy Policy explains how we collect, use, store, share, and safeguard your personal information in accordance with the Protection of Personal Information Act, No. 4 of 2013 ("POPIA") of the Republic of South Africa, the National Health Act, No. 61 of 2003, and the ethical rules of the Health Professions Council of South Africa (HPCSA).

1. Responsible Party (Information Officer)

The Practice is the Responsible Party as defined under POPIA. Dr. Arnold Douglas serves as the Information Officer, supported by a duly designated Deputy Information Officer registered with the Information Regulator of South Africa.

Contact:
Dr. Arnold Douglas Inc.
Suite 204, East Suites, Mediclinic Constantiaberg
Burnham Road, Plumstead, Cape Town, 7806
Email: info@drarnolddouglas.com
Tel: +27 21 761 0042

2. Personal Information We Collect

We collect only information that is necessary, relevant, and not excessive for the purposes of providing clinical care, scheduling, billing, and lawful communication. Categories include:

• Identifying information: full name, identity or passport number, date of birth, gender.
• Contact information: postal and physical address, email, telephone numbers.
• Special personal information (health data): medical history, clinical examination findings, diagnoses, surgical records, photographs, imaging, laboratory results, medication records, and SKNCODE™ assessment data. Under POPIA s.26–32, this is classified as Special Personal Information and is subject to the highest level of protection.
• Financial information: medical aid scheme details, banking details for refunds, billing history.
• Technical information: IP address, browser type, device data, and analytics from website visits.

3. Lawful Basis & Purpose of Processing

We process your personal information lawfully under one or more of the following grounds:

• Your explicit, informed consent — particularly for the processing of health information, clinical photography, and marketing communications.
• Compliance with a legal obligation imposed on the Practice (HPCSA record-keeping, tax law, medical scheme regulations).
• Protection of your legitimate medical interests in the course of providing care.
• Performance of a contract for clinical services.

4. Clinical Photography & Imaging

Photographic and three-dimensional imaging are integral to surgical planning and outcome assessment. Images are taken only with separate written consent. Identifiable images are never published, shared, or used for teaching, marketing, or social media without an additional, specific, and revocable written consent.

5. How We Store & Secure Your Information

We apply reasonable, appropriate, and continuously reviewed technical and organisational safeguards as required by POPIA s.19, including:

• Encrypted electronic medical records hosted on access-controlled, audited servers located in compliant jurisdictions.
• Transport-layer encryption (TLS 1.3) for all data transmitted through this website and patient portals.
• Role-based access controls — clinical records are accessible only to staff with a direct treatment relationship.
• Physical security at the rooms, including locked archives for any paper records.
• Routine staff training on confidentiality, the HPCSA ethical rules, and POPIA obligations.
• A documented incident-response procedure and a register of any security compromises.

6. Sharing of Information

We do not sell personal information. We share information only when necessary and lawful, with:

• Referring or co-treating practitioners, anaesthetists, theatres, pathology, and radiology providers involved in your care.
• Your medical aid scheme or administrator, strictly for the purposes of authorisation, claims, and audit.
• Regulatory bodies (HPCSA, SARS, the Information Regulator) where compelled by law.
• Vetted operators (e.g. practice management software, secure cloud storage) bound by written agreements imposing POPIA-equivalent obligations.

Any cross-border transfer of personal information complies with POPIA s.72 and only occurs where the receiving jurisdiction provides an adequate level of protection or where you have given explicit consent.

7. Retention

Clinical records are retained for a minimum of six (6) years from the date of last consultation in line with HPCSA Booklet 14, and longer where the patient is a minor (until the age of 21) or where required by other legislation. Non-clinical records (financial, marketing) are retained only as long as necessary for the purpose for which they were collected.

8. Your Rights Under POPIA

As a data subject you have the right to:

• Be notified that your information is being collected or has been accessed without authorisation.
• Request access to the personal information we hold about you.
• Request correction, deletion, or destruction of information that is inaccurate, irrelevant, excessive, out of date, or unlawfully obtained — subject to legal record-keeping duties.
• Object, on reasonable grounds, to the processing of your information.
• Withdraw consent at any time, without affecting the lawfulness of prior processing.
• Lodge a complaint with the Information Regulator.

Requests can be submitted in writing to info@drarnolddouglas.com using a POPIA Form 2 (Request for Access) where applicable.

9. Cookies & Website Analytics

This website uses strictly necessary cookies and limited analytics to understand site performance. No advertising or behavioural-profiling cookies are used. You may disable cookies in your browser without affecting access to clinical services.

10. Security Incidents

In the unlikely event of a security compromise involving your personal information, we will notify both the Information Regulator and you as soon as reasonably possible, as required by POPIA s.22, and will set out the nature of the compromise and the steps taken in response.

11. Information Regulator

JD House, 27 Stiemens Street, Braamfontein, Johannesburg, 2001
Email: inforeg@justice.gov.za
Website: https://inforegulator.org.za

12. Updates to this Policy

This Policy may be amended from time to time to reflect changes in law or practice. The current version is always available on this page and is dated above.