Protection of Personal Information Act (POPIA) Policy

1. Responsible Party & Information Officer

For the purposes of POPIA, the responsible party processing your personal data is the private medical aesthetics practice of Dr Larisha Pather.

2. What Personal Information We Collect

In operating our clinical consultation bookings and our Serene Skincare boutique dispensary, we collect only personal information that is adequate, relevant, and necessary for clinical care and fulfillment:

• Contact & Identification Data: Full legal name, identity number or passport number (for clinical records), telephone number, mobile WhatsApp contact, and email address.
• Physical Address & Delivery Coordinates: Residential or business delivery address, suburb, postal code, and delivery instructions for courier shipments dispatched via The Courier Guy.
• Transactional Data: Order records, payment reference tokens, product purchase history, invoice numbers, and Payflex payment installment status. (Note: Full debit or credit card credentials are processed directly by PCI-DSS certified payment gateways and never touch our servers).
• Digital & Technical Usage Data: IP address, device operating system, browser type, and local storage state (such as active shopping bag items).

3. Special Personal Information (Health & Clinical Data)

Under Section 26 and Section 32 of POPIA, personal information concerning a data subject's health, biometric data, or medical treatment constitutes Special Personal Information. Processing of such information is subject to strict statutory protections.

As a registered medical practitioner, Dr Larisha Pather processes clinical health information under the statutory exemption of Section 32(1)(a) of POPIA, specifically where processing is carried out by a medical professional for the direct provision of healthcare, diagnosis, or aesthetic treatment:

• Clinical History: Medical allergies, active medications, dermatological conditions, previous cosmetic procedures, bleeding tendencies, pregnancy status, and metabolic indicators.
• Treatment Charts: Injection mapping, units of neuromodulator (BTOX) administered, milliliters and lot numbers of hyaluronic acid dermal fillers, IV infusion compounding notes, and clinical progress assessments.
• Clinical Photography: Standardized medical before-and-after photographs taken for clinical documentation and dosage evaluation. Photographs are never published or shared for marketing purposes without explicit, signed, written consent.

4. Lawful Grounds & Purposes of Processing

We process personal information under the following lawful grounds recognised by Section 11 of POPIA:

5. Third-Party Operators & Couriers

We do not sell, rent, or trade patient personal data. We disclose personal information strictly to vetted third-party operators who perform technical or logistical services on our behalf under written confidentiality and POPIA Section 21 operator agreements:

• Logistics Partners (The Courier Guy): Name, recipient contact number, and delivery street address to facilitate nationwide delivery of skincare orders.
• Payment Processors (Payflex & Hosted Gateways): Encrypted transaction reference IDs to reconcile orders. Financial card details are held exclusively by PCI-DSS Level 1 compliant processors.
• Secure Hospital Infrastructure: In-clinic consultations operate within Netcare Parklands Hospital facilities, complying with hospital physical safety standards.
• Web Infrastructure & Hosting: Local South African server infrastructure with continuous TLS/HTTPS encryption, firewall monitoring, and automated backups.

6. Information Security Safeguards (POPIA § 19)

Dr Larisha Pather maintains appropriate, reasonable technical and organizational measures to prevent loss of, damage to, or unauthorized destruction of personal information, and unlawful access to or processing of personal information:

• End-to-End Encryption: 256-bit TLS (Transport Layer Security) encryption across all web interactions, cart transactions, and intake forms.
• Physical Security: Physical patient charts and diagnostic files are stored within locked clinical archives in Suite 2, Netcare Parklands Hospital, accessible exclusively by authorized medical personnel.
• Access Control: Strict role-based digital authentication, multi-factor authentication (MFA) on administrative portals, and automatic session timeouts.
• Breach Notification Protocol: In the event of an identified security compromise affecting personal information, we will notify both the Information Regulator and affected data subjects without unreasonable delay, in accordance with Section 22 of POPIA.

7. Medical Record Retention Periods

Personal information is retained only for as long as necessary to fulfill the purpose for which it was collected, or as required by South African statute:

• Adult Medical Records: Retained for a minimum of 6 (six) years from the date of the last treatment entry, as mandated by the Health Professions Council of South Africa (HPCSA) Ethical Guidelines.
• Minors' Medical Records: Retained until the patient reaches 21 years of age (or 6 years after the last entry, whichever is longer).
• E-Commerce & Financial Invoices: Retained for 5 (five) years in compliance with the Tax Administration Act No. 28 of 2011 and Companies Act.
• Marketing Contacts: Retained until the data subject unsubscribes or requests deletion of their contact profile.

8. Your Statutory Rights as a Data Subject

Under Chapter 3 of POPIA, you enjoy specific statutory rights regarding your personal information:

1. Right of Access: You may request confirmation of whether we hold personal information about you and receive a copy of that record in accordance with the Promotion of Access to Information Act (PAIA).
2. Right to Rectification: You may request the correction or update of inaccurate, incomplete, misleading, or outdated personal information (Form 2 under POPIA Regulations).
3. Right to Erasure / Destruction: You may request the deletion of personal information that is no longer necessary, subject to our statutory medical record retention duties under HPCSA regulations.
4. Right to Object: You may object to processing based on legitimate interest on reasonable grounds relating to your particular situation (Form 1).
5. Right to Withdraw Consent: Where processing is founded on consent (such as direct marketing newsletters), you may withdraw consent at any time without penalty.

To exercise any of these rights, please submit a written request to our Information Officer at info@drlarisha.co.za with the subject line "POPIA Data Subject Request".

9. The Information Regulator (South Africa)

If you believe that your personal information has been processed in contravention of POPIA and your concern has not been satisfactorily addressed by our Information Officer, you have the statutory right to lodge a formal complaint with the South African Information Regulator: