Protection of Personal Information Act 4 of 2013 (POPIA). Version 1.0, effective 23 October 2026.
> DRAFT for publication on 23 October 2026. Items marked [VERIFY] must be settled before publication.
1. Who we are
Healthcare On The Go runs workplace wellness days, on-site occupational health screening and mobile clinics for employers. This notice covers the screening system used at those events (sign-in, pre-registration links, station screening, certificates and reports) and the public website. Therapy On The Go (Pty) Ltd, registration number 2022/668078/07, trading as Healthcare On The Go [VERIFY: confirm that the Healthcare On The Go clinical service runs under TOTG] ("we", "us") is the responsible party for the personal information described in this notice, collected through https://healthcareonthego.co.za, our forms, our systems and our services.
- Information Officer: Tshepo Mokitimi, Chief Executive Officer [VERIFY: Information Officer registration on the Information Regulator eServices portal]
- Contact: info@therapyonthego.co.za (subject line "POPIA"), telephone +27 66 248 6595
- Address: [VERIFY: an address for service must be published here (POPIA s18(1)(b)). Recommended: a PO Box or the CIPC registered office, so that no operating street address is published (group rule of 8 Oct 2026).]
2. What we collect
- Pre-registration and attendance: name, ID or passport number, date of birth, sex, mobile number, email address, employer, occupation, requisition or employee number, site, and check-in times.
- Station screening results (special personal information): height, weight, BMI and waist; blood pressure and heart rate; glucose and cholesterol; urine and drug tests; TB screening; physical examination; vision, hearing, lung function, ECG and X-ray results; health and lifestyle questionnaires, including mental wellbeing and working-at-heights questionnaires.
- HIV testing: only with your separate, written, voluntary consent and counselling. HIV results are stored separately, are visible only to the testing nurse, and are never shared with your employer.
- Outcomes: fitness determination, restrictions, referral letters, certificate of fitness and its expiry date, and the name, registration number and signature of the practitioner.
- Staff and practitioner users: name, email address, role, registration number and an activity log of what each user viewed, changed or downloaded.
We collect information directly from you, from your employer or the organisation that booked a service for you, and from the practitioners who treat you. We collect only what we need for the purpose (s10).
3. Why we use it and our lawful basis
- To run the screening you or your employer booked and to keep the clinical record (s11(1)(b) and (c); health information under s32(1)(a) as a healthcare provider, and s27(1)(a) with your consent, which we record at registration).
- To issue the certificate of fitness your employer must hold under the OHS Act 85 of 1993 and its regulations (s11(1)(c); s32(1)(e)).
- To send you your own results through a private link, and to refer you when a result needs follow-up (s11(1)(d)).
- To give your employer anonymised group reports (for example how many people were screened, or the share referred). Groups smaller than five are suppressed so that no one can be identified.
- To keep the system secure and keep an audit trail of every access (s19).
Your employer receives only your fitness outcome, any restrictions and the certificate expiry date, plus anonymised group statistics. Your employer never receives your clinical results, questionnaire answers or HIV status unless you give written consent.
4. Who we share it with (operators and third parties)
- Healthcare App (Pty) Ltd (a group company): the screening software. From 23 October 2026 it hosts the records on Amazon Web Services in Cape Town, South Africa.
- Lovable and Supabase: hosted the legacy screening system until 23 October 2026. After migration that copy is retained only until the migration has been verified, and is then deleted [VERIFY: deletion date once K3 owner access is granted].
- Microsoft 365: email. Twilio SendGrid (United States): delivery of result-link emails.
- Laboratories and specialists, only for a test or referral that needs them.
Every operator processes information only on our instructions, under a written agreement that requires it to keep the information secure and confidential (s20 and s21). We do not sell personal information.
5. Transfers outside South Africa
The legacy system (until 23 October 2026) and the email delivery provider process information outside South Africa (the European Union and the United States). We rely on POPIA s72(1)(a) and (b): written agreements give substantially similar protection, and the transfer is needed to provide the service. From 23 October 2026 health records are hosted in South Africa.
6. How long we keep it
- Medical surveillance records and certificates of fitness: at least 40 years where an OHS Act regulation requires it. Otherwise 20 years after the screening (HPCSA Booklet 9, occupational records).
- Wellness-only screening that is not medical surveillance: 6 years after the event.
- Pre-registrations for an event you did not attend: 90 days after the event.
- Audit logs: 6 years.
When the retention period ends, we delete or de-identify the information, unless a law, a court order or a pending claim requires us to keep it longer (s14).
7. How we protect it
Encrypted connections (HTTPS); encryption of databases and backups at rest; multi-factor sign-in for staff; access limited to the people who need it for their role; audit logs of access to health records; secrets kept in a password vault; and encrypted, access-controlled backups. If we believe a security compromise has affected your information, we will tell you and the Information Regulator as soon as reasonably possible (s22).
8. Automated decisions
The system flags results against clinical thresholds for review. A registered practitioner reviews flags and makes every fitness decision. No decision about you is made solely by a computer.
9. Children
Screening is for employees aged 18 and over. We do not knowingly screen children through this system.
10. Your rights
- Ask whether we hold personal information about you and receive a copy of it (POPIA s23; PAIA).
- Ask us to correct or delete information that is inaccurate, irrelevant, excessive, out of date, incomplete, misleading or unlawfully obtained (s24).
- Object to processing that relies on our legitimate interest or on yours (s11(3)), and object to direct marketing at any time (s11(3)(b)).
- Withdraw your consent at any time. This does not affect processing that already happened, or processing that the law requires (s11(2)(b)).
- Not be subject to a decision based solely on automated processing that has legal or similarly significant effects (s71).
- Complain to the Information Regulator (details below).
To use any of these rights, email info@therapyonthego.co.za with the subject "POPIA request". We may ask you to prove your identity first. We respond within 30 days. Access requests are free for your own information. For copies of records under the Promotion of Access to Information Act, see our PAIA manual [VERIFY: link to the PAIA manual once it is published].
11. Cookies and similar technology
This website uses only the storage it needs to work, for example to keep you signed in. Where the hosting platform counts visits, it does so without advertising cookies or cross-site tracking. We do not use advertising or social-media tracking cookies.
12. Complaints
Please contact our Information Officer first, so that we can put things right. You may also complain to the Information Regulator (South Africa), JD House, 27 Stiemens Street, Braamfontein, Johannesburg, 2001. Website https://inforegulator.org.za. Complaints: POPIAComplaints@inforegulator.org.za. General enquiries: enquiries@inforegulator.org.za.
13. Changes to this notice
We will publish any change on this page with a new version number and effective date. If a change materially affects how we use your health information, we will tell you before it takes effect.
Group: Healthcare On The Go is part of the House of Experts group. Notice version 1.0, effective 23 October 2026.