At Dr Concierge SA (Dr Concierge (Pty) Ltd), your privacy is part of your care. If anything in this policy is unclear, please contact our Information Officer (details at the bottom) before you sign any consent form. We’d rather answer a question than have you sign something you’re unsure about.
1. Who we are
- Responsible Party (data controller): Dr Concierge (Pty) Ltd, trading as Dr Concierge SA.
- Treating practitioner: Dr Lelo, registered with the Health Professions Council of South Africa (HPCSA).
- Practice locations: Sandton (Grayston) and Johannesburg (The MARC).
- Website: drconciergesa.com
- Contact: [email protected] · WhatsApp +27 62 683 6248
2. What personal information we collect
To deliver safe, lawful medical care and run our practice, we collect:
- Identity & contact details: full name, ID or passport number, date of birth, gender, home and postal address, phone number, email, emergency contact.
- Medical aid & billing information: scheme name, plan, membership number, main member details, and (where relevant) bank or card details for cash payments.
- Health information (special personal information under POPIA): medical history, current symptoms, medication, allergies, family history, lifestyle factors, vital signs, results of consultations, diagnoses, referrals, lab and imaging reports, prescriptions, sick notes, and telehealth consultation records.
- Communication records: WhatsApp messages, emails, SMS, portal messages, and call logs relating to your care, booking or billing.
- Consent records: the date, version and content of any consent you give us (for example, telehealth consent or marketing opt-in).
- Website & portal usage data: IP address, device and browser type, pages viewed, and cookies (see section 10).
3. Why we collect it (lawful purpose)
We only process your information for clearly defined purposes, in line with POPIA. These include:
- Providing medical consultations, treatment, prescriptions, referrals and follow-up care.
- Booking, rescheduling and reminding you of appointments.
- Submitting claims to your medical aid and issuing invoices/statements.
- Keeping accurate clinical records as required by the HPCSA and the National Health Act.
- Communicating with you about your care via WhatsApp, email, SMS or the patient portal.
- Complying with our legal, regulatory, tax and professional obligations.
- With your separate opt-in: sending you health tips, clinic updates, or new service announcements.
4. How we obtain your consent
Most of your information is collected directly from you when you register, complete intake forms, attend a consultation, or message us. Where the law requires it — particularly for health information, telehealth, and marketing communications — we ask for your explicit, informed consent through a tick-box or signed form. You can withdraw consent at any time (see section 9); withdrawing marketing consent will not affect your clinical care.
5. Who we share your information with
We do not sell your data. We share it only where it is necessary, lawful, and protected by confidentiality. Recipients may include:
- Other healthcare providers you are referred to (specialists, pathologists, radiologists, pharmacies, hospitals) — with your knowledge.
- Your medical aid scheme or administrator, where you have authorised claims submission.
- Our service providers (“operators” under POPIA), who process information on our behalf under written agreements:
- GoHighLevel (“GHL”) — our customer relationship management, patient portal, appointment workflows, and WhatsApp/SMS/email automations. Please note: GHL is hosted in the United States — see section 6 on cross-border transfers.
- Payment processors, accounting providers, IT and cybersecurity providers, and our professional advisors (legal, accounting).
- Regulatory or legal bodies — HPCSA, the Information Regulator, SARS, courts or law enforcement — where we are legally required to disclose information.
6. Cross-border data transfer
Some of our service providers, including GoHighLevel, store data on servers outside South Africa, primarily in the United States. POPIA permits this where the receiving country provides adequate protection, where the operator is bound by binding contractual safeguards, or where you have consented. We rely on the contractual safeguards in our agreements with these providers and, where required, your explicit consent. If you would prefer your information not to be processed by a US-hosted provider, please tell us before signing up — we will discuss the alternatives available (note that this may limit certain digital conveniences such as automated reminders).
7. How we protect your information
- Access to clinical records is restricted to Dr Lelo and authorised practice staff who need it to do their job.
- Our portal and CRM accounts use strong passwords, multi-factor authentication, and encryption in transit (HTTPS/TLS).
- Operators are contractually required to apply appropriate technical and organisational security measures.
- Paper records (where they exist) are kept in locked storage at the practice.
- Staff are trained on patient confidentiality and POPIA obligations.
No system is 100% secure. If a security compromise affects your personal information, we will notify you and the Information Regulator as required by POPIA.
8. How long we keep your information (retention)
- Clinical / medical records: at least 6 years from the date of last consultation, in line with HPCSA guidelines. Records of minors are kept until the patient turns 21, and records relating to mental health or occupational health may be kept longer where the law requires.
- Billing and tax records: at least 5 years, as required by SARS.
- Marketing data: until you opt out, after which we remove your details from active marketing lists (we keep a minimal record of the opt-out itself).
- Website analytics & cookies: see section 10.
Once retention periods expire, we securely destroy or de-identify the information.
9. Your rights under POPIA
You have the right to:
- Be told what personal information we hold about you.
- Request access to that information, and a copy of it.
- Request that we correct or delete information that is inaccurate, irrelevant, excessive, out of date, misleading or unlawfully obtained.
- Object to processing, or withdraw a consent you previously gave.
- Opt out of direct marketing at any time, with no impact on your clinical care.
- Lodge a complaint with the Information Regulator (details below).
To exercise any of these rights, email our Information Officer at [email protected]. We may ask you to verify your identity before we act on the request. We will respond within a reasonable period, and within any timeframe POPIA requires.
10. Cookies and website tracking
Our website and patient portal use cookies and similar technologies to keep you logged in, remember your preferences, measure how the site is used, and improve performance. You can disable cookies in your browser settings, but some parts of the portal may not work properly without them. We do not use cookies to build advertising profiles about you.
11. Children
For patients under 18, we collect and process information with the consent of a parent or legal guardian, unless the law allows the minor to consent on their own (for example, certain reproductive or HIV-related care, in line with the Children’s Act).
12. Marketing communications
We will only send you health tips, clinic updates or promotional messages if you have opted in. Every marketing message includes a clear way to opt out (reply STOP on WhatsApp/SMS, or click the unsubscribe link in emails). Opting out of marketing does not affect appointment reminders, billing messages or clinical follow-ups, which form part of your care.
13. Updates to this policy
We may update this policy from time to time to reflect changes in the law, our services, or our service providers. The “Last updated” date at the top of this page will always show the current version. For material changes, we will also let you know via email or through the patient portal.
14. Contact & complaints
Information Officer:
Dr Lelo
Email: [email protected]
General enquiries: [email protected] · WhatsApp +27 62 683 6248
Information Regulator (South Africa):
JD House, 27 Stiemens Street, Braamfontein, Johannesburg, 2001
Email: [email protected]
Website: inforegulator.org.za
Dr Concierge SA — Health. Handled.