South Africa

POPIA and therapy notes

How a South African practice can talk about the client file, consent and a cross-border host without pretending to be certified.

Updated 4 October 2026.

Information, not legal advice. This page is a practical overview for practices. It is not a substitute for advice on your own contracts, insurance or registration.

Psychologists, registered counsellors and social workers in private practice in South Africa hold health information about clients. The Protection of Personal Information Act 4 of 2013 (POPIA) is the law that governs how that information is collected, stored, used and shared. The HPCSA’s ethical rules sit alongside it for practitioners registered with that council. Social workers also answer to the South African Council for Social Service Professions. This guide is a practical map. It is not a legal opinion on your practice.

Your role

In POPIA language, the practice that decides why the information is collected is the responsible party. A software company that stores the record on your instructions is an operator. Reach + Within is designed so that you remain the responsible party. We do not claim a POPIA certification. Whether your practice meets its duties depends on your notices, your access decisions and your contracts, not on a badge on a website.

Tell clients, in plain language, what you collect, why, how long you plan to keep it, and who else may see it. Health information is special personal information. Treat it as such in the notice and in who can open the file. A receptionist who books sessions does not need the session note. Admin and finance users in Reach + Within are not given clinical notes.

What belongs in the record

The HPCSA’s Booklet 9, Guidelines on the keeping of patient health records (the September 2022 text), describes a patient health record as the information a practitioner needs in order to care for the person. For a therapy practice that usually means identity and contact details, the reason for coming, relevant history, the assessment, the plan, session notes, consent, and correspondence that affects care. Write notes that the client could read. Keep them factual and dated. Sign them.

If you record a session, do it only with consent recorded on the file first. Assist can draft a note from that recording. You review the draft and you sign. Assist does not diagnose and does not sign the record. The same consent rules are set out, for both POPIA and UK GDPR, in the guide on recording therapy sessions.

How long to keep records

Booklet 9 says records should ideally be stored indefinitely where an electronic format makes that practical. If that is not practical, it says a record should be stored for at least six years from the date it becomes dormant, which is when the patient was last treated. There are longer periods for children, for some occupational cases, and for conditions that can appear many years later. Those sentences are quoted and linked in how long to keep therapy records. Do not invent a shorter period because a software default suggests one. Your notice should state the period you actually use.

Hosting in the Netherlands

Client data in Reach + Within is hosted in the European Union, in the Netherlands, including for South African practices. POPIA restricts sending personal information outside South Africa. A transfer needs a lawful ground, such as adequate protection in the destination country, a binding agreement, or consent that is specific enough. The security page states that the cross-border transfer is to the EU, which has adequate data protection laws, and that you remain the responsible party. Put the location in your client notice. If your compliance lead wants a particular clause, ask for the processing terms in writing rather than assuming a logo is enough.

Medical aid claims

Many South African practices expect a system to submit medical aid claims. Reach + Within does not do that yet. Medical aid claims are coming soon. Say that to clients and colleagues rather than implying it is already switched on. Invoicing and statements are available. A claim to a scheme is a different step. Bookem and other local systems publish medical workflows today. The comparison Reach + Within and Bookem sets the public prices and the gap out plainly.

HPCSA record keeping in daily practice

Booklet 9 also deals with altering records, privacy of storage, and access. Practical habits that match those themes:

• Correct a mistake with an audit trail, not by quietly deleting the original line.
• Protect logins. One person, one login. Shared passwords are not a role. Sign-in with a second factor is coming soon in Reach + Within.
• Backups matter, and so does knowing who can restore them.
• Choose software you can question. The checklist is POPIA compliant practice software: what to check.
• If a client asks for their information, have an export. Access is a right, with limited exceptions, not a favour.
• If you close the practice, Booklet 9 describes telling patients and arranging safe keeping. Read that section before you shut the door.
• Outcome scales are coming soon. Until they are available, do not promise a graphed PHQ-9 inside the product.

Registered counsellors and psychologists can read the profession pages for registered counsellors and psychologists. Social workers in private practice, not statutory case management for a department, can read software for social workers.

A notice you can actually hand over

A one-page notice is enough if it answers six questions. Who holds the information? What is in the file? Why is it there? How long will you keep it? Where is it hosted? How does someone ask for a copy or a correction? Add a separate sentence on recording if you offer it. Add a sentence that medical aid claims are not yet submitted from this software, if clients are likely to assume they are.

Review the notice when you change a processor, start recording, or move premises. POPIA is not a document you file once. It is the way the practice treats the file every week.

Operators, sub-processors and a recording

If a recording is transcribed by a named sub-processor, that name belongs on the list you can give a client or an information officer. The security pages of a product should say that transcription is done by a named party and that the choice to record sits on the file. Do not turn recording on for a whole practice by default. Offer it, record the answer, and proceed. A client who says no is not a difficult client. They are a person using a choice POPIA expects you to honour when consent is the ground you are relying on.

Ask your information officer, or the person who plays that role in a solo practice, to be able to answer three questions without opening a laptop full of folders. Where is the live record? Where is the backup? Who can export it if the practitioner is ill? Backups are only useful if someone other than a single login can reach them in a crisis that is operational, not clinical. This software is not an emergency service.

Children, families and couples

Booklet 9 sets a longer minimum for people who were under 18 when they were cared for: at least until the 21st birthday, because a minor can have time after turning 18 to bring a claim. If you see adolescents, do not apply the six-year adult habit without reading that exception. Families who receive an update should receive an approved report, not the session note. A secure report link is for that narrower purpose. Say in the consent form who may receive a report and what it will not include.

Couples need a written decision about whose information is whose. POPIA does not let you hand one person’s account to the other because they share a diary entry. Write the rule in the contract before the second session.

What to say about price and claims

Pricing for South African practices is on the South Africa pricing page, from R500 a month per clinician. Admin users are free. That sentence is about the software fee. It is not a medical aid rate. Claims submission is coming soon, and a quote for a rehab or treatment centre is a separate conversation with no public price. If a colleague asks whether this replaces a billing bureau, say no, not yet, and show them the comparison with systems that already publish medical workflows.