Your health,
our priority — anytime, anywhere.

Privacy

POPIA Privacy Notice

This Privacy Notice tells you how Dr Concierge collects and uses your personal information, in line with South Africa's Protection of Personal Information Act (POPIA, Section 18).

1. Who we are

Dr Concierge (Pty) Ltd is a private medical practice, with Dr. Khadija Lelo Latakgomo (HPCSA registered medical practitioner) as the responsible practitioner. We operate from two locations in Johannesburg (Grayston and The MARC).
Contact for privacy matters: [email protected]

2. What we collect

• Identity information: name, ID/passport number, date of birth
• Contact information: email, mobile number, physical address, emergency contact
• Medical aid information: scheme name, plan, member number
• Health information: medical history, current medications, allergies, lifestyle information you choose to share during care
• Booking and appointment information: appointment type, payment preference

3. Why we collect it (purpose)

To register you as a patient, schedule and manage appointments, provide healthcare services, communicate with you about your care, bill you or your medical aid, and meet our legal and professional obligations under the Health Professions Act and POPIA.

4. Whether providing your information is voluntary or mandatory

You are not required to provide your information. However, certain information (name, contact details, ID, consent) is necessary for us to register you and provide care. Without it, we may not be able to consult with you.

5. Who may receive your information

• Our care team (Dr. Lelo and authorised clinical staff)
• Your medical aid scheme, where you have authorised us to bill them
• Our operators: GoHighLevel (CRM and patient portal), Xneelo (hosting and email), and our calendar provider — all bound by written Operator Agreements under POPIA
• Referring or treating practitioners, only with your consent or where clinically necessary
• South African regulatory or legal authorities where compelled by law

6. Cross-border transfer

Some of our service providers (e.g. GoHighLevel) process data outside South Africa. Where this happens, we ensure the receiving party is bound to a level of protection at least equivalent to POPIA.

7. How we protect your information

Your information is transmitted over encrypted (HTTPS) connections and stored on platforms with industry-standard security controls. Access is limited to authorised members of your care team. We never sell your data.

8. How long we keep it

We retain your information for as long as required by South African law for medical records (currently a minimum of six years from the date of last entry, longer for minors), and only for as long as necessary thereafter.

9. Your rights under POPIA

• To know what we hold about you and to request a copy
• To correct or delete inaccurate or outdated information
• To object to certain processing, or to withdraw consent (where consent was the basis)
• To complain to the Information Regulator: inforegulator.org.za

To exercise any of these rights, please email [email protected].

Last updated: 5 June 2026. This Privacy Notice may be updated from time to time; the latest version always lives on this page.