Privacy notice

Protection of Personal Information Act 4 of 2013 (POPIA). Version 1.0, effective 23 October 2026.

> DRAFT for publication on 23 October 2026. Items marked [VERIFY] must be settled before publication.

1. Who we are

Advanced Physical Therapy is a sports recovery, physiotherapy and rehabilitation network. It connects athletes, clubs, events, employers and medical schemes with HPCSA-registered physiotherapists. Advanced Physical Therapy (Pty) Ltd, registration number 2016/518271/07 [VERIFY: CIPC lists this company as dormant. If Therapy On The Go (Pty) Ltd runs the network, change this line to "Therapy On The Go (Pty) Ltd, 2022/668078/07, trading as Advanced Physical Therapy"] ("we", "us") is the responsible party for the personal information described in this notice, collected through https://advancedphysio.co.za, our forms, our systems and our services.

• Information Officer: Tshepo Mokitimi, Chief Executive Officer [VERIFY: Information Officer registration on the Information Regulator eServices portal]
• Contact: info@advancedphysio.co.za (subject line "POPIA"), telephone +27 66 248 6595
• Address: [VERIFY: an address for service must be published here (POPIA s18(1)(b)). Recommended: a PO Box or the CIPC registered office, so that no operating street address is published (group rule of 8 Oct 2026).]

2. What we collect

• Athletes and members: name, email address, mobile number, event registrations, resource downloads and the recovery or injury details you choose to enter.
• Health information (special personal information): injury logs, recovery inputs and anything you type to the mTshepana assistant about an injury.
• Physiotherapists who apply to join: name, contact details, HPCSA number, qualifications, work history and availability; uploaded documents (CV, ID, certificates, professional indemnity, bank confirmation letter); banking details for payment; and the signed network agreement.
• Organisations: contact details and the event or enterprise request you send us.

We collect information directly from you, from your employer or the organisation that booked a service for you, and from the practitioners who treat you. We collect only what we need for the purpose (s10).

3. Why we use it and our lawful basis

• To provide recovery resources, bookings and events you request (s11(1)(b)); health information only with your consent (s27(1)(a)).
• To check, onboard and pay physiotherapists, including verifying HPCSA registration (s11(1)(b) and (c)).
• To answer enquiries from organisations (s11(1)(b)).
• To send communications you opted in to (s69).

When you ask the mTshepana assistant a question, we process your message to generate general information. mTshepana does not diagnose, and its answers are not a substitute for a physiotherapist. In an emergency call 112.

4. Who we share it with (operators and third parties)

• Supabase Inc.: database, sign-in and document storage, hosted in the European Union (Ireland).
• AI model provider used by mTshepana to answer questions [VERIFY: name the provider and its region].
• Xneelo (Pty) Ltd: website hosting in South Africa.
• Twilio SendGrid (United States): delivery of service emails. Microsoft 365: email.
• Healthcare App (Pty) Ltd (a group company): booking and practice software.

Every operator processes information only on our instructions, under a written agreement that requires it to keep the information secure and confidential (s20 and s21). We do not sell personal information.

5. Transfers outside South Africa

Our database and document storage are in the European Union (Ireland), and emails may be processed in the United States. We rely on POPIA s72(1)(a) and (b): written agreements give substantially similar protection, and the transfer is needed to provide the service. Health records will move to South African hosting as the network moves onto the group platform.

6. How long we keep it

• Physiotherapist applications that are not accepted: 12 months after the decision. ID copies and bank letters of applicants who are not accepted: deleted within 90 days.
• Active network physiotherapists: for the period of the agreement plus 5 years.
• Athlete injury logs and recovery inputs: until you delete your account, or 3 years after your last activity.
• Clinical records created by a treating physiotherapist: as required by HPCSA Booklet 9 (at least 6 years after the last entry).

When the retention period ends, we delete or de-identify the information, unless a law, a court order or a pending claim requires us to keep it longer (s14).

7. How we protect it

Encrypted connections (HTTPS); encryption of databases and backups at rest; multi-factor sign-in for staff; access limited to the people who need it for their role; audit logs of access to health records; secrets kept in a password vault; and encrypted, access-controlled backups. If we believe a security compromise has affected your information, we will tell you and the Information Regulator as soon as reasonably possible (s22).

8. Automated decisions

mTshepana gives general information only and makes no decisions about you. Physiotherapist applications are reviewed by a person.

9. Children

Junior athletes may use our resources only with a parent's or guardian's consent (s35). A parent or guardian can ask us at any time to see or delete a child's information.

10. Your rights

• Ask whether we hold personal information about you and receive a copy of it (POPIA s23; PAIA).
• Ask us to correct or delete information that is inaccurate, irrelevant, excessive, out of date, incomplete, misleading or unlawfully obtained (s24).
• Object to processing that relies on our legitimate interest or on yours (s11(3)), and object to direct marketing at any time (s11(3)(b)).
• Withdraw your consent at any time. This does not affect processing that already happened, or processing that the law requires (s11(2)(b)).
• Not be subject to a decision based solely on automated processing that has legal or similarly significant effects (s71).
• Complain to the Information Regulator (details below).

To use any of these rights, email info@advancedphysio.co.za with the subject "POPIA request". We may ask you to prove your identity first. We respond within 30 days. Access requests are free for your own information. For copies of records under the Promotion of Access to Information Act, see our PAIA manual [VERIFY: link to the PAIA manual once it is published].

11. Cookies and similar technology

This website uses only the storage it needs to work, for example to keep you signed in. Where the hosting platform counts visits, it does so without advertising cookies or cross-site tracking. We do not use advertising or social-media tracking cookies.

12. Complaints

Please contact our Information Officer first, so that we can put things right. You may also complain to the Information Regulator (South Africa), JD House, 27 Stiemens Street, Braamfontein, Johannesburg, 2001. Website https://inforegulator.org.za. Complaints: POPIAComplaints@inforegulator.org.za. General enquiries: enquiries@inforegulator.org.za.

13. Changes to this notice

We will publish any change on this page with a new version number and effective date. If a change materially affects how we use your health information, we will tell you before it takes effect.

Group: Advanced Physical Therapy is part of the House of Experts group. Notice version 1.0, effective 23 October 2026.