Legal

POPIA Compliance

Last updated: January 2025

Mint & Marine Dental Studio is committed to full compliance with the Protection of Personal Information Act, 4 of 2013 (POPIA) — South Africa's primary legislation governing the lawful collection, processing, storage, and sharing of personal information.

1. What is POPIA?

POPIA is South Africa's data protection law, modelled in part on the European General Data Protection Regulation (GDPR). It came into full effect on 1 July 2021 and regulates how organisations collect and use personal information. It gives individuals ("data subjects") meaningful rights over their personal information and places responsibilities on organisations ("responsible parties") that process that information.

2. Our Commitment

As a registered healthcare practice, we handle personal information with the highest degree of care. We are committed to the eight conditions for lawful processing set out in POPIA:

3. Personal Information We Process

In the course of providing dental services and operating this website, we may process the following categories of personal information:

• Full name and contact details (phone number, email address, physical address)
• Appointment and scheduling information
• Health and medical information relevant to dental treatment (collected and stored within our clinical systems)
• Medical aid / insurance details where applicable
• Payment records
• Website enquiry content

Special Personal Information (including health information) is processed only where required for the provision of healthcare, with your consent, or where permitted by applicable law.

4. Grounds for Processing

We process your personal information on one or more of the following lawful grounds:

• Consent: you have voluntarily provided your information for a specific purpose
• Contractual necessity: processing is necessary to deliver dental services you have requested
• Legal obligation: we are required by law to retain certain records (e.g. HPCSA regulations, tax legislation)
• Legitimate interest: to operate and improve our practice in a manner that does not unduly prejudice your rights

5. Your Rights as a Data Subject

Under POPIA, you have the following rights in respect of your personal information:

• Right of access: to request confirmation of whether we hold your information and to receive a copy
• Right to correction: to request that inaccurate, incomplete, or outdated information be corrected
• Right to deletion: to request the destruction or deletion of personal information we are no longer authorised to retain
• Right to object: to object to the processing of your information on grounds relating to your particular situation
• Right to withdraw consent: where processing is based on consent, to withdraw that consent at any time
• Right to complain: to lodge a complaint with the Information Regulator of South Africa

To exercise any of these rights, please contact our Information Officer using the details below. We will respond within a reasonable period and, in any event, within 30 days.

6. Data Retention

Personal information is retained for only as long as necessary for the purpose for which it was collected, or as required by applicable law. Patient health records are retained in accordance with the National Health Act and HPCSA guidelines (generally a minimum of five years from the date of last treatment, or until a minor patient reaches the age of 21, whichever is longer). On expiry of the retention period, records are securely and irreversibly destroyed.

7. Security Measures

We implement appropriate physical, administrative, and technical safeguards to protect personal information against loss, theft, unauthorised access, disclosure, copying, use, or modification. In the event of a security compromise, we will notify the Information Regulator and affected data subjects as required by POPIA.

8. Third Parties and Operators

Where we share personal information with third-party service providers ("operators") — such as our website host or accounting software — we ensure that appropriate data processing agreements are in place to govern the lawful handling of your information.

We do not sell personal information to third parties and do not share it for marketing purposes without your explicit consent.

9. Information Regulator

If you are not satisfied with how we have handled your personal information, you have the right to lodge a complaint with the Information Regulator of South Africa:

10. Contact Our Information Officer