Privacy policy

1. Who we are

Stellenbosch Oncology Centre (practice number 1343084) is the responsible party for your personal information. We work from two sites: Cabernet House, Brandwacht Office Park, Trumali Street, Stellenbosch 7600, and St Stephens Oncology, 6 Skool Straat, Northern Paarl, Paarl 7623. The practice is run and managed by Prime Oncology Solutions.

Our Information Officer is [Name, title]. You can contact them at admin@stellenboschoncology.co.za or on +27 21 007 0668.

2. The information we collect

• Personal details: your name, ID or passport number, date of birth, contact details, address and next of kin.
• Health information: your medical history, diagnosis, test and scan results, pathology reports, treatment plans, medicines and notes from your appointments.
• Medical scheme and account details: your scheme, membership number, main member details and authorisations.
• Website enquiries: the details you type into our contact form.

Health information is special personal information under POPIA. As healthcare professionals, we may process it to give you care, and we treat it as confidential at all times.

Giving us your information is voluntary, but without it we may not be able to treat you safely or claim from your medical scheme.

3. How we collect it

Mostly from you, at your first visit and during your care. We also receive information from your referring doctor, other doctors treating you, hospitals, laboratories, radiology practices and your medical scheme.

4. Why we use it

• To diagnose, plan and give you treatment, and to keep you safe during it.
• To discuss your care at our multidisciplinary team (MDT) meetings.
• To communicate with the other doctors and services involved in your care.
• To arrange appointments and contact you about your care.
• To obtain authorisations and submit claims to your medical scheme.
• To meet our legal and professional duties, including record keeping and reporting required by law.
• To reply to enquiries you send through this website.

5. What allows us to use it

POPIA requires a lawful reason for every use of personal information. Ours are:

• Your treatment and care. POPIA allows medical professionals and healthcare facilities to process health information where it is necessary for proper treatment and care, or for running the practice, under a duty of confidentiality.
• Our agreement with you. To provide the services you have asked for and to manage your account.
• The law. For example, keeping medical records, putting diagnosis codes on medical scheme claims, and reporting cancer diagnoses to the National Cancer Registry.
• Your consent. For anything outside your care, such as speaking to a family member, sending you news from the practice, or using your story or photograph. You can withdraw consent at any time.

We do not make decisions about you by automated means alone.

6. Who we share it with

We share only what is needed, and only with:

• your referring doctor, your GP and other healthcare professionals involved in your care;
• specialists who attend our MDT meetings;
• hospitals, laboratories, pathology and radiology practices, and pharmacies involved in your treatment;
• your medical scheme, its administrator, and the managed-care organisation it uses to authorise cancer treatment. Claims must carry a diagnosis code (ICD-10), and authorisations need clinical details;
• the National Cancer Registry, to which the law requires us to report every confirmed cancer diagnosis;
• service providers who support the practice, such as our practice management, billing and secure communication systems, under written confidentiality agreements;
• authorities, where the law requires it.

We share information with your family only with your permission, or where the law allows it.

[If any service provider stores information outside South Africa, name the country and the safeguards here.]

7. How we protect it

We keep paper and electronic records secure, limit access to staff who need it for their work, use passwords and secure systems, and train our team in confidentiality. If we believe your information has been accessed without permission, we will tell you and the Information Regulator as POPIA requires.

8. How long we keep it

We keep medical records for as long as the law and the Health Professions Council of South Africa (HPCSA) require. This is generally at least six years after your last visit, and longer for children and in some other cases. Website enquiries that do not become part of your medical record are deleted once they are no longer needed.

9. Marketing, and patients under 18

We do not send marketing messages unless you have opted in, and every message will tell you how to opt out. Appointment reminders and messages about your treatment are part of your care.

For patients under 18, we collect and share information with the consent of a parent or guardian, except where the law allows a young person to consent for themselves.

10. Your rights

• Ask whether we hold information about you, and ask for a copy of it.
• Ask us to correct information that is wrong or out of date.
• Ask us to delete information we no longer have a lawful reason to keep.
• Object to some types of use, such as being contacted for anything other than your care.
• Withdraw consent you have given, without affecting your care.
• Complain to the Information Regulator.

To use any of these rights, contact our Information Officer. Requests for access to records are handled under the Promotion of Access to Information Act (PAIA). We may need to confirm your identity first.

POPIA and your health information: how to use each right →

11. Our website

When you use our contact form, we use your details only to reply to you. [Confirm whether the live website will use cookies or analytics, and describe them here.]

12. Complaints

Please contact our Information Officer first, so that we can try to put things right. If you are not satisfied, you may complain to the Information Regulator (South Africa) at inforegulator.org.za. Its contact details are on our POPIA page.

13. Changes to this policy

We may update this policy from time to time. The latest version will always be on this page, with the date it took effect.