Protection of Personal Information Act 4 of 2013 (POPIA). Version 1.0, effective 23 October 2026.
> DRAFT for publication on 23 October 2026. Items marked [VERIFY] must be settled before publication.
1. Who we are
We provide occupational health, medical surveillance, wellness screening, drivers' medicals, executive health and mobile healthcare services to employers and individuals in South Africa. Therapy On The Go (Pty) Ltd, registration number 2022/668078/07 ("we", "us") is the responsible party for the personal information described in this notice, collected through https://www.therapyonthego.co.za, our forms, our systems and our services.
- Information Officer: Tshepo Mokitimi, Chief Executive Officer [VERIFY: Information Officer registration on the Information Regulator eServices portal]
- Contact: info@therapyonthego.co.za (subject line "POPIA"), telephone +27 66 248 6595
- Address: [VERIFY: an address for service must be published here (POPIA s18(1)(b)). Recommended: a PO Box or the CIPC registered office, so that no operating street address is published (group rule of 8 Oct 2026).]
2. What we collect
- Contact and booking details: name, email address, mobile number, company name, the service you want, preferred date and location, and anything you write in a booking or contact form.
- Identity details: full name, South African ID or passport number, date of birth and sex, used to identify you correctly and to issue certificates.
- Employment details: employer, occupation or job category, site and years in the position, where an employer books an assessment for you.
- Health information (special personal information): medical history, medication, screening and test results (for example blood pressure, glucose, cholesterol, urine, vision, hearing, lung function, ECG and X-ray reports), questionnaires, clinical notes, fitness outcomes, restrictions and referrals.
- HIV testing: only with your separate, written, voluntary consent and pre- and post-test counselling. HIV results are kept apart from other records, are visible only to the testing nurse or doctor, and are never shared with your employer.
- Practitioner records: name and HPCSA or SANC registration of the practitioner who examined you, and signatures on certificates.
We collect information directly from you, from your employer or the organisation that booked a service for you, and from the practitioners who treat you. We collect only what we need for the purpose (s10).
3. Why we use it and our lawful basis
- To provide the health service you or your employer booked and to keep a clinical record of it (POPIA s11(1)(b) contract, s11(1)(c) legal duty; health information under s32(1)(a) as a healthcare provider, and s27(1)(a) with your consent).
- To issue a certificate of fitness to your employer where the Occupational Health and Safety Act 85 of 1993, its regulations or the Mine Health and Safety Act require medical surveillance (s11(1)(c); s32(1)(e)).
- To refer you to a doctor or specialist when a result needs follow-up (s11(1)(d), your legitimate interest).
- To invoice your employer or medical scheme and keep accounting records (s11(1)(b) and (c)).
- To answer enquiries and send service messages. We send marketing only if you opted in (s69).
Your employer receives your fitness outcome (fit, fit with restrictions, temporarily unfit or unfit), any work restrictions, and the certificate's expiry date. Your employer does not receive your clinical results, history or HIV status unless you give written consent. Employers see group reports only in anonymised form, and groups smaller than five people are suppressed.
4. Who we share it with (operators and third parties)
- Healthcare App (Pty) Ltd (a group company): clinical and booking software. It hosts health records on Amazon Web Services in Cape Town, South Africa.
- Microsoft 365: email and documents.
- Vercel Inc. (United States): hosting of this website. It also passes booking and contact form messages to our mailbox.
- Twilio SendGrid (United States): delivery of service emails.
- Accredited pathology laboratories, radiology providers and specialists, only when a test or referral needs them.
- Our professional advisers, auditors and authorities (for example the Department of Employment and Labour or SARS), where the law requires it.
Every operator processes information only on our instructions, under a written agreement that requires it to keep the information secure and confidential (s20 and s21). We do not sell personal information.
5. Transfers outside South Africa
The website and email delivery providers named above process contact and form details in the United States and the European Union. We rely on POPIA s72(1)(a) and (b): these providers are bound by agreements that give a level of protection substantially similar to POPIA, and the transfer is needed to answer your request. Health records are hosted in South Africa.
6. How long we keep it
- Occupational medical surveillance records: at least 40 years where an OHS Act regulation requires it (for example the Hazardous Chemical Agents and Noise-Induced Hearing Loss regulations). Otherwise 20 years after the service, as HPCSA Booklet 9 recommends for occupational records.
- Other clinical records: at least 6 years after the last entry. For a child, until the 21st birthday or 6 years after the last entry, whichever is later.
- Booking enquiries that did not lead to a service: 12 months.
- Invoices and accounting records: 5 years (Tax Administration Act and Companies Act).
When the retention period ends, we delete or de-identify the information, unless a law, a court order or a pending claim requires us to keep it longer (s14).
7. How we protect it
Encrypted connections (HTTPS); encryption of databases and backups at rest; multi-factor sign-in for staff; access limited to the people who need it for their role; audit logs of access to health records; secrets kept in a password vault; and encrypted, access-controlled backups. If we believe a security compromise has affected your information, we will tell you and the Information Regulator as soon as reasonably possible (s22).
8. Automated decisions
Screening software may flag a result for review. A registered practitioner makes every fitness decision. No decision about you is made solely by a computer.
9. Children
Some services, such as home visits, may involve children. We treat a child's information only with the consent of a parent or guardian (s35), or where the law allows it.
10. Your rights
- Ask whether we hold personal information about you and receive a copy of it (POPIA s23; PAIA).
- Ask us to correct or delete information that is inaccurate, irrelevant, excessive, out of date, incomplete, misleading or unlawfully obtained (s24).
- Object to processing that relies on our legitimate interest or on yours (s11(3)), and object to direct marketing at any time (s11(3)(b)).
- Withdraw your consent at any time. This does not affect processing that already happened, or processing that the law requires (s11(2)(b)).
- Not be subject to a decision based solely on automated processing that has legal or similarly significant effects (s71).
- Complain to the Information Regulator (details below).
To use any of these rights, email info@therapyonthego.co.za with the subject "POPIA request". We may ask you to prove your identity first. We respond within 30 days. Access requests are free for your own information. For copies of records under the Promotion of Access to Information Act, see our PAIA manual [VERIFY: link to the PAIA manual once it is published].
11. Cookies and similar technology
This website uses only the storage it needs to work, for example to keep you signed in. Where the hosting platform counts visits, it does so without advertising cookies or cross-site tracking. We do not use advertising or social-media tracking cookies.
12. Complaints
Please contact our Information Officer first, so that we can put things right. You may also complain to the Information Regulator (South Africa), JD House, 27 Stiemens Street, Braamfontein, Johannesburg, 2001. Website https://inforegulator.org.za. Complaints: POPIAComplaints@inforegulator.org.za. General enquiries: enquiries@inforegulator.org.za.
13. Changes to this notice
We will publish any change on this page with a new version number and effective date. If a change materially affects how we use your health information, we will tell you before it takes effect.
Group: Therapy On The Go is part of the House of Experts group. Notice version 1.0, effective 23 October 2026.