PAIA Manual

1. Introduction and purpose

This Manual has been prepared in terms of section 51 of the Promotion of Access to Information Act 2 of 2000 (“PAIA”) for Letitia Groenewald Counselling Psychologist.

It explains:

• the identity and contact details of the private body;
• categories of records held by the practice;
• records that may be available without a formal PAIA request;
• records maintained in accordance with other legislation;
• how to request access to a record;
• how the practice processes personal information;
• categories of data subjects and personal information;
• recipients of personal information;
• planned or possible transborder processing;
• general information-security safeguards; and
• remedies available where a requester is dissatisfied with a PAIA decision.

Access to a record is not automatic.

A requester seeking access to the record of a private body must satisfy the applicable requirements of PAIA, including the requirements governing the exercise or protection of a right, the prescribed request procedure and any applicable statutory grounds for refusal.

2. Details of the private body

Name of practice: Letitia Groenewald Counselling Psychologist

Legal form: Sole-proprietor private psychology practice

Sole proprietor: Letitia Groenewald

Head of private body: Letitia Groenewald

Information Officer: Letitia Groenewald

Information Officer email: support@lgpsychology.co.za

Street / physical address:
79 Main Road
Plumstead
Cape Town
7800
South Africa

Postal address:
79 Main Road
Plumstead
Cape Town
7800
South Africa

General email: info@lgpsychology.co.za

Website: https://www.lgpsychology.co.za/

As the sole proprietor and head of the private body, Letitia Groenewald is the Information Officer for purposes of PAIA and POPIA.

Formal PAIA and privacy correspondence should be directed to:

support@lgpsychology.co.za

3. Information Regulator’s PAIA Guide

The Information Regulator publishes a Guide in terms of section 10 of PAIA to assist members of the public to understand and exercise their rights under PAIA and POPIA.

Among other matters, the Guide explains:

• the objects of PAIA and POPIA;
• the process for requesting access to records;
• prescribed forms;
• applicable fees;
• assistance available to requesters;
• remedies where access is refused; and
• the procedure for lodging complaints.

The current PAIA Guide and prescribed forms are available from the Information Regulator.

Information Regulator (South Africa)
Woodmead North Office Park
54 Maxwell Drive
Woodmead
Johannesburg
2191

Telephone: 010 023 5200
Toll-free: 0800 017 160
General enquiries: enquiries@inforegulator.org.za

The current forms include:

• Form 2: Request for Access to Record;
• Form 3: Outcome of Request and Fees Payable; and
• Form 5: Complaint Form.

The PAIA Guide may also be requested from the practice’s Information Officer.

4. Records available without a formal PAIA request

Certain information may be made available without requiring submission of a formal PAIA request.

Public website records may include:

• information about the practice;
• professional information concerning Letitia Groenewald;
• descriptions of services offered;
• location and contact information;
• publicly published fee or administrative information, where applicable;
• the Privacy & Cookie Policy;
• the Terms of Use;
• this PAIA Manual; and
• other general informational material published by the practice.

Information that may be supplied on ordinary request

General administrative information may be provided without invoking PAIA where the practice considers this appropriate and lawful.

The fact that some information is made voluntarily available does not mean that every record belonging to the same category is automatically accessible.

Clinical records, confidential information and information relating to another person remain subject to applicable confidentiality, PAIA, POPIA, health-law and professional requirements.

5. Records available in accordance with other legislation

The practice maintains or may maintain records in accordance with applicable South African legislation and regulatory requirements, including where relevant:

• Promotion of Access to Information Act 2 of 2000;
• Protection of Personal Information Act 4 of 2013;
• Health Professions Act 56 of 1974;
• National Health Act 61 of 2003;
• Medical Schemes Act 131 of 1998;
• Income Tax Act 58 of 1962;
• Tax Administration Act 28 of 2011;
• Electronic Communications and Transactions Act 25 of 2002;
• Consumer Protection Act 68 of 2008;
• Cybercrimes Act 19 of 2020; and
• other legislation applicable to the practice from time to time.

The inclusion of legislation in this section does not mean that every possible category of record arising under that legislation is necessarily held by the practice.

6. Subjects and categories of records held

6.1 Prospective clients and enquiries

Records may include:

• names and contact details;
• website enquiries;
• email correspondence;
• referral information;
• appointment enquiries; and
• information concerning the nature of the service sought.

6.2 Clients and psychological services

Records may include:

• intake documentation;
• informed-consent documentation;
• identifying and demographic information;
• health and psychosocial history;
• clinical and psychotherapy notes;
• psychological assessment information;
• treatment goals and plans;
• diagnostic information where applicable;
• risk and safety information;
• reports and professional letters;
• referral documentation;
• healthcare-practitioner correspondence; and
• other patient health records generated in the course of psychological services.

6.3 Minor clients

Records may include:

• information concerning the minor;
• parent or guardian information;
• consent or authority documentation;
• family or collateral information;
• clinical information;
• correspondence; and
• information relevant to lawful provision of psychological services.

6.4 Appointment administration

Records may include:

• appointment schedules;
• booking information;
• cancellations;
• rescheduling;
• reminders; and
• associated administrative correspondence.

Appointment-management information may be processed through Healthbridge.

6.5 Medical aid, PMB and billing

Records may include:

• medical-scheme information;
• membership and dependent details;
• authorisations;
• PMB records;
• claims;
• diagnostic and tariff codes;
• invoices and statements;
• remittance information;
• payment records;
• account correspondence; and
• associated Healthbridge records.

6.6 Healthcare practitioners and referral sources

Records may include:

• professional names and contact details;
• referral correspondence;
• clinical correspondence where authorised;
• reports; and
• related professional communications.

6.7 Suppliers, operators and service providers

Records may include:

• service agreements;
• contracts;
• operator and data-processing arrangements;
• correspondence;
• invoices;
• payment records; and
• information relating to service provision.

This category includes records relating to providers such as Healthbridge and xneelo where applicable.

6.8 Professional and regulatory compliance

Records may include:

• HPCSA registration information;
• professional-indemnity documentation;
• BHF and practice-registration records;
• Information Officer registration;
• POPIA compliance documentation;
• PAIA documentation;
• security and incident records;
• professional policies; and
• regulatory correspondence.

6.9 Financial and tax records

Records may include:

• accounting information;
• invoices;
• bank and payment records;
• expense documentation;
• tax records;
• supporting financial documents; and
• other records required for lawful financial administration.

6.10 Website and electronic records

Records may include:

• website enquiries;
• technical server or security logs;
• IP-address and browser information where generated by hosting infrastructure;
• cookie-related information where applicable;
• website content and configuration records; and
• security or access records.

The practice website is hosted using xneelo services.

7. Processing of personal information under POPIA

7.1 Purposes of processing

The practice processes personal information for purposes including:

• responding to enquiries;
• determining suitability for psychological services;
• providing psychological assessment and psychotherapy;
• appointment administration;
• maintaining patient health records;
• communication with clients;
• continuity of care;
• reports and referrals;
• billing and invoicing;
• medical-aid claims;
• PMB and benefit administration;
• regulatory and professional compliance;
• financial and tax administration;
• website operation and security;
• information-security management;
• complaint and legal-process management; and
• establishing, exercising or defending legal rights.

8. Categories of data subjects and personal information

Clients and prospective clients

Information may include:

• names;
• contact information;
• identity and demographic information;
• health information;
• clinical and psychological information;
• appointment information;
• medical-aid information;
• financial information; and
• correspondence.

Children

Information may include:

• identifying information;
• health and clinical information;
• family and developmental information;
• appointment and billing information; and
• information required for consent and lawful treatment.

Parents, guardians and relevant family members

Information may include:

• names;
• contact details;
• relationship to the client;
• authority or consent information;
• billing information; and
• lawfully processed collateral information.

Healthcare practitioners and referrers

Information may include:

• names;
• professional details;
• contact information;
• referral information; and
• professional correspondence.

Medical schemes and administrators

Information may include:

• scheme information;
• contacts;
• claims and authorisations;
• payment/remittance information; and
• correspondence.

Suppliers, operators and contractors

Information may include:

• names;
• contact details;
• organisational information;
• contracts;
• billing information; and
• correspondence.

Website visitors

Information may include:

• information voluntarily submitted through the website;
• IP address and limited technical information;
• browser/device information;
• server and security logs; and
• cookie-related information where applicable.

9. Recipients or categories of recipients

Subject to confidentiality and applicable law, personal information may be supplied to:

• Healthbridge, acting as an operator in relation to appointment management, billing, claims and related practice administration;
• xneelo, acting as an operator in relation to website hosting and associated infrastructure;
• medical schemes, administrators and managed-care organisations;
• GPs, psychiatrists, psychologists and other healthcare practitioners where lawfully authorised;
• payment and banking service providers;
• professional financial advisers where used;
• IT, storage, communication or backup providers acting as operators;
• professional-indemnity insurers;
• legal advisers;
• the HPCSA;
• the Information Regulator;
• courts, law-enforcement agencies or other authorities where lawful disclosure is required or permitted; and
• other recipients authorised by the data subject or by applicable law.

Listing a category of recipient does not mean that information is routinely supplied to every person falling within that category.

10. Healthbridge

The practice uses Healthbridge, a division of Tradebridge (Pty) Ltd, for appointment-management, billing, medical-aid claims and related healthcare administration.

Where Healthbridge processes patient information on instructions from the practice:

• Letitia Groenewald Counselling Psychologist remains the responsible party;
• Healthbridge acts as the operator; and
• the practice determines the purposes for which patient information is processed.

Information processed through Healthbridge may include:

• identifying information;
• contact information;
• appointment information;
• medical-scheme details;
• benefit and authorisation information;
• diagnostic and tariff codes;
• claims;
• invoices;
• remittance information; and
• billing or payment-related information.

11. xneelo website hosting

The website https://www.lgpsychology.co.za/ is hosted using xneelo hosting services.

Where xneelo processes website or visitor information on behalf of the practice in providing hosting services:

• the practice remains the responsible party; and
• xneelo acts as an operator.

Information processed in connection with hosting may include:

• IP addresses;
• device/browser information;
• server logs;
• security logs;
• website content;
• enquiry information transmitted through the site; and
• other technical information necessary to host, maintain and secure the website.

12. Planned or possible transborder flows

Some service providers or their subprocessors may process information outside the Republic of South Africa.

Healthbridge states that its software services may involve the use of international technology providers and associated cross-border processing.

xneelo currently operates data-centre infrastructure in Cape Town, Samrand in Gauteng and Germany. The geographic location applicable to particular information depends on the hosting service, configuration and providers involved.

Where personal information is transferred internationally, the practice will take reasonable steps to ensure compliance with section 72 of POPIA and other applicable requirements.

Where prior authorisation from the Information Regulator is required for a proposed processing activity under POPIA, the practice will comply with that requirement before undertaking the relevant processing on that basis.

13. General information-security safeguards

The practice maintains reasonable technical and organisational safeguards appropriate to the nature and sensitivity of the personal information processed.

These may include:

• controlled access to clinical information;
• password-protected systems and devices;
• authentication controls;
• secure transmission and encryption where appropriate;
• reputable practice-management and hosting infrastructure;
• backups;
• device and malware protection;
• confidentiality requirements;
• access on a need-to-know basis;
• operator/data-processing arrangements;
• secure deletion and destruction procedures;
• review of information-security risks; and
• procedures for investigating and responding to security compromises.

Particular care is applied to information concerning psychological and physical health because of its sensitivity and professional confidentiality.

14. Submitting a PAIA request

A formal request for access to a record under PAIA must be made using the prescribed Form 2: Request for Access to Record.

The requester must provide the information required by PAIA and the Regulations, including:

• sufficient particulars to identify the requester;
• proof of identity;
• proof of authority where the requester acts for another person;
• sufficient information to identify the requested record;
• the required form of access;
• the right that the requester seeks to exercise or protect; and
• an explanation of why the requested record is required for exercise or protection of that right.

Requests should be submitted to:

Letitia Groenewald
Information Officer
Letitia Groenewald Counselling Psychologist

Email: support@lgpsychology.co.za

Physical address:
79 Main Road
Plumstead
Cape Town
7800
South Africa

Form 2 may be obtained from the Information Regulator.

Where appropriate, an ordinary request by an existing client may be addressed without requiring a formal PAIA process. Voluntary assistance does not remove or diminish rights under PAIA.

15. Fees

Fees applicable to PAIA requests are prescribed by law and may be amended from time to time.

The Information Regulator’s current fee schedule should be consulted when a request is received.

Where a prescribed request or access fee is payable, the requester will be notified in accordance with PAIA before further processing or access occurs.

This may include prescribed charges for:

• copies;
• electronic media;
• transcription;
• searching for and preparing records;
• postage or electronic transfer; and
• other authorised access costs.

16. Time for decision

A properly submitted PAIA request will ordinarily be decided within 30 days, subject to the provisions of PAIA.

The Act permits an extension of no more than a further 30 days in specified circumstances.

Where an extension is relied upon, the requester will be notified as required by PAIA.

17. Grounds for refusing access

PAIA contains specific grounds on which a private body must or may refuse access.

Depending on the circumstances these may include protection of:

• another person’s privacy;
• certain confidential information;
• commercial information;
• the safety of individuals or security of property;
• legally privileged material;
• protected research information; and
• other interests expressly protected by PAIA.

A record will not be refused merely because the practice regards it as inconvenient or prefers not to disclose it.

Any refusal must be supported by an applicable PAIA provision.

Where protected information can reasonably be separated from information that may be disclosed, the practice will apply PAIA’s severability requirements.

PAIA’s public-interest override will be applied where its statutory requirements are met.

18. Clinical and health records

Clinical and psychological records require particular care because they may contain:

• highly sensitive health information;
• information concerning another person;
• information supplied in confidence; and
• information whose disclosure may require careful clinical management.

A clinical record is not automatically exempt from PAIA merely because it is confidential.

Requests concerning clinical records are considered in accordance with PAIA, POPIA, the National Health Act, applicable HPCSA requirements and other relevant law.

Where third-party information is protected, it may be withheld or redacted where required or permitted by law while any reasonably severable part remains subject to the ordinary PAIA process.

Section 61 procedure

PAIA contains a specific procedure concerning certain records relating to a person’s physical or mental health or wellbeing.

Where access has otherwise been granted but the Information Officer reasonably believes direct disclosure might cause serious harm to the person’s physical or mental health or wellbeing, the procedure provided for in section 61 may be followed.

This can include consultation with a healthcare practitioner nominated by the relevant person and appropriate arrangements concerning access where PAIA requires this.

Section 61 is not a general basis for withholding psychological records simply because they are clinical in nature.

19. Decisions and remedies

The requester will be informed of the decision concerning the request in accordance with PAIA.

Where access is refused wholly or partly, the applicable ground for refusal will be identified as required by the Act.

There is no internal PAIA appeal against the decision of the head of a private body.

A dissatisfied requester may, subject to PAIA:

• lodge a complaint with the Information Regulator; or
• approach a competent court.

Information Regulator (South Africa)
Woodmead North Office Park
54 Maxwell Drive
Woodmead
Johannesburg
2191

Telephone: 010 023 5200
Toll-free: 0800 017 160
PAIA complaints: PAIAComplaints@inforegulator.org.za

The prescribed Form 5: Complaint Form is available from the Information Regulator.

20. Availability of this Manual

This Manual is available:

• on the practice website at https://www.lgpsychology.co.za/;
• at the principal place of business for public inspection during normal business hours, subject to reasonable arrangements necessary to protect client confidentiality and the functioning of the practice;
• to a person upon request and subject to any amount lawfully chargeable; and
• to the Information Regulator upon request.

Requests for a copy may be directed to:

support@lgpsychology.co.za

21. Updating this Manual

This Manual will be reviewed and updated where reasonably necessary, including where:

• applicable legislation changes;
• the practice’s processing activities materially change;
• material new technology or operators are introduced;
• categories of records materially change; or
• relevant guidance is issued by the Information Regulator.

Issued by:
Letitia Groenewald
Sole Proprietor, Head of Private Body and Information Officer
Letitia Groenewald Counselling Psychologist

Date: 7 September 2026