This is general information to help you ask the right questions. It isn't legal advice. Speak to your Information Officer or a lawyer about your own clinic.

South Africa's Protection of Personal Information Act (POPIA) applies to every clinic that holds information about clients. For rehabs and practices, most of what you hold is health information, which POPIA treats with extra care. Here's a practical checklist.

1. Know what kind of information you hold

POPIA calls health information special personal information. Processing it is prohibited unless an exception applies, such as the client's consent or the specific allowances POPIA makes for health professionals and institutions providing care (see sections 26, 27 and 32 of the Act). The Information Regulator has also published regulations on processing health information.

Check: do you know which of your records are health information, and on what basis you process each type?

2. Name your Information Officer

Every responsible party has an Information Officer. By default it's the head of the organisation, and they must be registered with the Information Regulator. Deputies can be appointed.

Check: is your Information Officer registered, and does your team know who it is?

3. Keep security proportionate to the risk

Section 19 requires appropriate, reasonable technical and organisational measures to protect personal information. For a clinic this usually means: individual logins (no shared passwords), access by role, an audit trail, secure devices, and a plan for what happens if something goes wrong.

Check: does every staff member have their own login? Can admin staff open clinical notes? Could you tell who viewed a file last week?

4. Know where your data goes

Section 72 sets conditions for sending personal information outside South Africa, for example where the recipient is bound by laws or an agreement that give adequate protection. Many cloud systems host data abroad.

Check: do you know which country your software hosts data in, and do you have the vendor's agreement in writing?

5. Have an operator agreement

When a software vendor processes information on your behalf, POPIA calls them an operator (sections 20 and 21). You need a written contract that requires them to keep the information secure and confidential.

Check: have you signed an operator agreement with each system that holds client data?

6. Get consent right, especially for recordings

If you record sessions, for notes or for AI drafting, get clear, written, informed consent first, and let clients say no without consequence. Consent for group or family sessions needs everyone in the room.

Check: is recording consent stored on each client's file, and can clinicians skip recording?

7. Plan for access requests and exit

Clients can ask what information you hold about them. You also need to be able to leave a vendor without losing your records, and keep records for as long as professional rules require (check current HPCSA guidance on keeping patient records).

Check: can you export a client's full record? Can you export everything if you change systems?

Questions to ask any software vendor

Where is the data hosted, and does any of it leave that country?
Who at the vendor can see client records, and is that logged?
Can each role in my clinic see only what it needs?
Will you sign an operator agreement?
Is client data ever used to train AI models?
Can I export everything if I leave?

How Reach + Within answers them

Client data is hosted in the EU (Netherlands). Reach + Within is an independent company. Each clinic's data is kept in its own private workspace that no other clinic, including the rehab where it was built, can ever see. Every person has their own login and role; PA and accounts users can't open clinical notes, even with a direct link. The audit trail records who viewed or changed what, and when. Recording consent is kept on the client's file, and recording follows it. You can cancel any time and export your data.

Ask us for our operator agreement and the details of how we handle cross-border transfers. Then talk to your Information Officer about whether that meets your clinic's needs.

Reviewed by a member of our clinical team. Sources: Protection of Personal Information Act 4 of 2013 (gov.za); Information Regulator health information regulations (inforegulator.org.za).

POPIA and clinical records in a treatment centre: a practical checklist