POPIA Policy
How Eugene Marais Neurophysiology Inc. aims to comply with POPIA.
1. Purpose
This POPIA Policy records how Eugene Marais Neurophysiology Inc., trading as MNeuro, aims to process personal information lawfully, fairly and responsibly under the Protection of Personal Information Act 4 of 2013.
2. Responsible party
Eugene Marais Neurophysiology Inc. is the responsible party for personal information processed through the website and practice operations, unless another healthcare provider or organisation determines the purpose and means of processing independently.
3. Conditions for lawful processing
The practice aims to apply accountability, processing limitation, purpose specification, further-processing limitation, information quality, openness, security safeguards and data-subject participation.
4. Special personal information
Health information, medical history and related clinical information may be processed where authorised by law, necessary for healthcare services, required for professional obligations, or supplied with an appropriate lawful basis.
5. Information Officer
The practice’s Information Officer is responsible for encouraging POPIA compliance, dealing with data-subject requests, maintaining appropriate internal measures and cooperating with the Information Regulator. Formal Information Officer details should be inserted once registration details are confirmed.
6. Operators and service providers
Third-party operators such as hosting providers, form providers, email providers, practice-management systems and technical support providers may process information only for agreed purposes and subject to reasonable confidentiality and security obligations.
7. Security compromises
Where there are reasonable grounds to believe that personal information has been accessed or acquired by an unauthorised person, the practice will take appropriate steps and make notifications where required by POPIA.
8. Requests and objections
Requests to access, correct, delete or object to processing should be sent to the practice using the details below. Identity verification may be required before a request is processed.
9. Complaints
Data subjects may also lodge a complaint with the South African Information Regulator where they believe personal information has been processed unlawfully.