On this page
This Privacy & Cookie Policy explains how Letitia Groenewald Counselling Psychologist, the sole-proprietor private psychology practice of Letitia Groenewald (“the practice”, “I”, “me” or “my”), collects, uses, stores, shares and protects personal information.
It applies when you visit www.lgpsychology.co.za, make an enquiry, book an appointment, become a client, communicate with the practice, or otherwise provide personal information to the practice.
The practice is committed to protecting your privacy, maintaining professional confidentiality and processing personal information in accordance with POPIA, applicable South African health legislation and the ethical requirements of the Health Professions Council of South Africa (HPCSA).
1. Responsible party and Information Officer
For purposes of POPIA, the responsible party is:
Letitia Groenewald
Sole proprietor trading as Letitia Groenewald Counselling Psychologist
Registered Counselling Psychologist
Information Officer: Letitia Groenewald
Information Officer / privacy email: support@lgpsychology.co.za
Physical address: 79 Main Road, Plumstead, Cape Town, 7800, South Africa
Website: https://www.lgpsychology.co.za/
Other practice contact addresses are:
General enquiries: info@lgpsychology.co.za
Professional/client correspondence: letitia@lgpsychology.co.za
Accounts and billing: accounts@lgpsychology.co.za
Privacy, POPIA and PAIA enquiries should preferably be directed to support@lgpsychology.co.za.
2. Personal information collected
The information collected depends on how you interact with the practice.
2.1 Enquiries and contact information
When you contact the practice, I may process information such as:
- your name and surname;
- email address and other contact details;
- information contained in your enquiry or correspondence;
- the reason you are seeking psychological support; and
- information necessary to respond to your enquiry or arrange an appointment.
You are encouraged not to include more sensitive clinical information than is reasonably necessary in an initial enquiry.
2.2 Client and clinical information
If you become a client, the practice may collect and maintain information including:
- identifying and demographic information;
- contact and emergency-contact information;
- identity number or date of birth where reasonably required;
- personal, developmental, social and family history;
- medical and mental-health history;
- presenting concerns, symptoms and difficulties;
- medication and treatment history;
- psychological assessment information;
- diagnoses or diagnostic information where applicable;
- treatment goals and treatment plans;
- clinical and psychotherapy notes;
- risk and safety information;
- consent and intake documentation;
- correspondence relating to psychological services;
- reports, motivations, referrals and letters; and
- information lawfully received from or communicated to other healthcare practitioners.
Information concerning your physical or mental health constitutes special personal information under POPIA and is treated with heightened confidentiality.
2.3 Appointment, medical-aid and billing information
For appointment administration, billing and medical-aid purposes, the practice may process:
- appointment dates and times;
- medical-scheme details;
- membership and dependent information;
- benefit and authorisation information;
- Prescribed Minimum Benefit (PMB) information where applicable;
- relevant diagnostic and tariff codes;
- invoices and statements;
- medical-aid claims and claim responses;
- payment and account information; and
- related administrative correspondence.
2.4 Information concerning children
Where psychological services are provided to a child, the practice may process personal information concerning both the child and parents, guardians or other persons appropriately involved in the child’s care.
Children’s personal information is processed only where authorised by POPIA and other applicable South African law.
Consent, confidentiality, parental responsibilities and the circumstances in which information concerning a minor may be disclosed are addressed more specifically during the practice’s intake and informed-consent process.
2.5 Information received from other sources
Where appropriate and lawfully permitted, personal information may also be received from:
- a parent, guardian or other authorised person;
- a referring psychologist or other healthcare practitioner;
- a GP or psychiatrist;
- a medical scheme or managed-care organisation;
- Healthbridge in relation to bookings, billing, claims and related administration; or
- another person or organisation where you have authorised disclosure or where another lawful basis exists.
Where POPIA requires notification concerning information collected indirectly, the practice will provide the required information in accordance with the Act.
3. Purposes for which information is processed
Personal information may be processed for purposes including:
- responding to enquiries;
- determining whether the practice is an appropriate service for your needs;
- arranging and administering appointments;
- providing psychological assessment and psychotherapy;
- maintaining appropriate clinical records;
- monitoring treatment and continuity of care;
- communicating about treatment or appointments;
- liaising with other healthcare practitioners where lawfully authorised;
- preparing reports, letters, referrals or motivations;
- submitting and administering medical-aid claims;
- administering PMB or other benefit applications where requested;
- invoicing, billing and payment administration;
- complying with legal, ethical and professional obligations;
- responding to complaints, regulatory requests or lawful legal processes;
- maintaining the security and integrity of practice systems; and
- establishing, exercising or defending legal rights where necessary.
The practice does not sell personal information.
Clinical or health information is not used for unrelated advertising or behavioural marketing.
4. Lawful processing
Personal information is processed only where permitted under POPIA and applicable law.
Depending on the circumstances, processing may be justified because:
- you have consented to it;
- it is necessary to conclude or perform the professional service relationship;
- processing is necessary to comply with an obligation imposed by law;
- processing protects a legitimate interest of you as the data subject;
- processing is necessary for the legitimate interests of the practice or another person, subject to your rights; or
- another lawful ground recognised by POPIA applies.
Consent is therefore not the sole basis on which personal information relating to psychological services is processed.
5. Special personal information and health information
POPIA provides additional protection for special personal information, including information concerning physical or mental health.
As a registered health professional, I may process health information where permitted by POPIA, including where processing is necessary for:
- the proper treatment and care of a client; or
- the administration of the professional practice,
subject to applicable confidentiality requirements.
Health information may therefore lawfully be processed for related purposes including treatment, clinical record-keeping, billing, medical-aid administration and continuity of care.
It will not be used for an unrelated purpose unless you consent to that use or the processing is otherwise authorised by law.
6. Providing personal information
Certain personal information is necessary for the safe and appropriate provision of psychological services, maintenance of appropriate clinical records, identification of clients, appointment administration and medical-aid processing.
Where information is required for these purposes and you elect not to provide it, the practice may be unable to commence or continue a particular service, submit a medical-aid claim, communicate effectively with you or comply with its professional or legal obligations.
Other information may be optional. Where material, you will be informed accordingly.
7. Confidentiality and disclosure
Psychological services are provided subject to professional confidentiality.
Personal and clinical information will not ordinarily be disclosed to another person without your consent.
Disclosure may nevertheless occur where:
- you have consented;
- disclosure is reasonably necessary for a service you have requested, such as a medical-aid claim;
- disclosure is permitted or required by law;
- a valid court order or other legally enforceable process applies;
- an applicable professional or ethical duty permits or requires disclosure, including certain circumstances involving serious risk of harm;
- disclosure is necessary to establish, exercise or defend a legal claim; or
- another lawful exception applies.
Where reasonably possible, disclosure will be limited to information necessary for the particular purpose.
8. Healthbridge: booking, billing and medical-aid administration
The practice uses Healthbridge, a division of Tradebridge (Pty) Ltd, for appointment management, billing, medical-aid claims and related healthcare administration.
Where Healthbridge processes patient information on the instructions of the practice:
- Letitia Groenewald Counselling Psychologist remains the responsible party under POPIA; and
- Healthbridge acts as an operator.
Depending on the services used, information processed through Healthbridge may include:
- identifying and contact information;
- appointment information;
- medical-scheme membership details;
- benefit and authorisation information;
- diagnostic and tariff codes;
- invoices and statements;
- claims and remittance information;
- payment or account information; and
- related administrative information.
The practice remains responsible for the lawfulness of the personal information it makes available to Healthbridge.
9. Website hosting: xneelo
The practice website is hosted by xneelo.
Where xneelo hosts or stores information generated through this website on behalf of the practice, the practice remains the responsible party and xneelo acts as an operator in respect of that hosted information.
Depending on the technical operation of the website, hosting services may process information such as:
- IP addresses;
- browser and device information;
- server and security logs;
- website enquiry information;
- technical usage information; and
- other information transmitted through the website.
xneelo maintains data-processing and security arrangements governing its processing of customer-hosted information.
The practice does not rely on website-hosting information to create psychological profiles of website visitors.
10. Other operators and service providers
The practice may make use of appropriately selected service providers where reasonably necessary to operate the practice.
Depending on the services actually in use, these may include providers of:
- electronic communications;
- secure data storage and backup;
- payment processing;
- virtual consultation technology;
- information-technology support;
- professional financial administration;
- professional indemnity insurance;
- legal or regulatory advice; and
- other necessary practice infrastructure.
Only information reasonably necessary for the relevant purpose will be made available.
Where a provider processes personal information as an operator on behalf of the practice, POPIA’s applicable contractual and security requirements apply.
Medical schemes, healthcare practitioners, regulators and other persons processing information for their own independent purposes are not necessarily operators of the practice.
11. Medical schemes and healthcare practitioners
Where you request use of medical-aid benefits, information reasonably necessary to administer a claim or authorisation may be provided to your medical scheme, its administrator or managed-care organisation.
This may include identifying information, membership details, dates of service, tariff codes, diagnostic codes and supporting information where lawfully required.
Information may also be communicated to a GP, psychiatrist or other healthcare practitioner where you consent or where another lawful ground for disclosure exists.
12. Cross-border processing
Some technology providers used by the practice, or subprocessors used by those providers, may process or store information outside South Africa.
Healthbridge states that its services may involve international processing through technology service providers.
xneelo operates hosting infrastructure in South Africa and Germany and may also use subprocessors in providing its services. The location in which particular website information is processed therefore depends on the hosting service and infrastructure applicable to the practice.
Where personal information is transferred outside South Africa, the practice will take reasonable steps to ensure that the transfer complies with section 72 of POPIA, including through applicable contractual or other recognised safeguards.
Where a proposed processing activity requires prior authorisation from the Information Regulator under POPIA, the relevant processing will not be implemented on that basis until the applicable requirements have been satisfied.
13. Information security
The practice takes reasonable and appropriate technical and organisational measures to protect personal information against loss, damage, unauthorised destruction, unlawful access and unauthorised processing.
Depending on the system concerned, safeguards may include:
- restricted access to clinical and administrative information;
- password-protected devices and systems;
- secure authentication measures;
- encryption or secure transmission where appropriate;
- reputable practice-management and hosting providers;
- appropriate backup arrangements;
- device and anti-malware protection;
- confidentiality requirements;
- limiting access according to legitimate operational need;
- appropriate operator arrangements;
- secure deletion or destruction procedures; and
- procedures for investigating suspected security incidents.
No information system can be guaranteed to be completely without risk, but safeguards are maintained and reviewed in accordance with POPIA.
14. Security compromises
Where there are reasonable grounds to believe that personal information has been accessed or acquired by an unauthorised person, the practice will investigate and take appropriate remedial action.
Where section 22 of POPIA requires notification, the Information Regulator and affected data subject(s) will be notified in accordance with the Act.
15. Retention of information
Personal information is retained only for as long as is permitted or reasonably necessary for the purpose for which it was collected, subject to applicable legal, ethical and professional record-retention requirements.
Clinical health records are retained in accordance with applicable HPCSA requirements and guidance.
Where appropriate:
- health records are retained for the period required by professional guidance and applicable law;
- longer periods may apply to records concerning minors or where another lawful reason for retention exists;
- financial and tax documentation is retained for applicable statutory periods; and
- administrative and enquiry information is retained only for as long as reasonably necessary for the relevant purpose.
Once information is no longer lawfully required, it will be securely destroyed, deleted or de-identified where appropriate.
16. Your rights under POPIA
Subject to applicable legal limitations, you may:
- ask whether the practice holds personal information about you;
- request access to personal information;
- request correction or updating of inaccurate or incomplete information;
- request deletion or destruction where the practice is no longer entitled or required to retain it;
- object to certain processing;
- withdraw consent where the processing depends on consent;
- request applicable information concerning access to your personal information by third parties; and
- lodge a complaint with the Information Regulator.
Withdrawal of consent does not invalidate processing that lawfully occurred before consent was withdrawn and does not necessarily require destruction of information that another lawful basis requires or permits the practice to retain.
Privacy requests should be directed to:
Formal requests for access to records may also fall under the Promotion of Access to Information Act 2 of 2000 (PAIA). Please refer to the practice’s PAIA Manual.
18. Direct marketing
Clinical and health information is not used for direct marketing.
Any electronic direct marketing undertaken by the practice will be carried out in accordance with section 69 of POPIA, including applicable consent and opt-out requirements.
Messages concerning appointments, treatment, accounts, administrative matters or services already requested are not sent for direct-marketing purposes merely because they are communicated electronically.
19. Information Regulator
Privacy concerns may first be directed to the Information Officer at:
You also have the right to lodge a complaint with:
Information Regulator (South Africa)
Woodmead North Office Park
54 Maxwell Drive
Woodmead, Johannesburg, 2191
Telephone: 010 023 5200
Toll-free: 0800 017 160
General enquiries: enquiries@inforegulator.org.za
POPIA complaints: POPIAComplaints@inforegulator.org.za
20. Changes to this Policy
This Policy may be reviewed and updated where the practice’s services, technologies, legal obligations or personal-information processing activities change.
The current version will be published at:
https://www.lgpsychology.co.za/
with its latest revision date.
Material changes affecting existing clients may also be communicated through an appropriate practice channel where reasonably necessary.
21. Contact
General practice enquiries
info@lgpsychology.co.za
Professional/client correspondence
letitia@lgpsychology.co.za
Accounts and billing
accounts@lgpsychology.co.za
Information Officer, POPIA, privacy and PAIA matters
support@lgpsychology.co.za
Physical address
79 Main Road
Plumstead
Cape Town
7800
South Africa