1. Responsible party
The responsible party is Dr Nadir Kana Incorporated (Dr Nadir Kana Inc.), practising as Dr Nadir Kana at Netcare Milpark Hospital and Netcare Mulbarton Hospital, Johannesburg. The Information Officer (POPIA) can be contacted at privacy@drnadirkana.co.za. Please do not include clinical information in email correspondence. Full statutory details are on the legal disclosures page, and the practice's PAIA manual explains how to request records.
2. Information collected
- Identity and contact details of patients, parents or guardians, and referring practitioners
- Medical aid or insurer details needed for authorisation and billing
- Clinical history, referral letters, laboratory results and medical imaging (DICOM)
- Records of consent, including consent to offshore processing, guardian consent and your AI choice
- If you opt in to analytics: the pages visited, a random session identifier, the referring website and your country
3. Purpose and lawful basis
Information is processed for clinical review, treatment, communication with the referring practitioner, funder authorisation and billing, and compliance with legal and HPCSA record-keeping obligations. It is processed on the basis of your consent, the proper treatment and care of the patient, and the practice's legal obligations. It is not used for marketing and is never sold.
4. Health information (special personal information)
Health information is special personal information under Section 26 of POPIA. The practice processes it as a healthcare provider under Section 32, subject to the duty of professional confidentiality in the National Health Act, and only to the extent necessary for the proper treatment and care of the patient.
5. Children
Information about a child (under 18) is processed only with the prior consent of a competent person, such as a parent or legal guardian (POPIA Sections 34 and 35). The referral portal requires the parent or guardian to be named and to give explicit consent before a referral for a child can be submitted.
6. Operators
The practice uses the operators below to process information on its behalf. Each is bound by a written agreement requiring appropriate security safeguards and prompt notification of any security compromise (POPIA Sections 20 and 21).
| Operator | Role | Location |
|---|---|---|
| Vercel Inc. | Website and portal hosting | United States and European Union edge and server locations |
| Endpoint Media | Website development, maintenance and technical support | South Africa |
| Encrypted object storage provider | Storage of encrypted referral records and imaging | To be confirmed before launch |
| Google LLC (Google Analytics 4) | Anonymous page-visit statistics, only with your opt-in consent | United States |
| AI summarisation provider | Draft summaries of referral information, only with your consent | To be confirmed before launch |
7. Offshore hosting and cross-border transfers (Section 72)
This applies to everyone, including South African residents. This website and referral portal run on secure cloud infrastructure (Vercel) with servers outside South Africa, including in the United States and the European Union. Information you submit is encrypted and processed on that infrastructure under a written data processing agreement.
The practice relies on both of the following for these transfers:
- Binding data processing agreements with its hosting and storage providers that give protection substantially similar to POPIA (Section 72(1)(a)); and
- Your explicit consent, which the referral portal asks for before anything is submitted, after showing the categories of information involved (Section 72(1)(b)).
If you or your doctor are outside South Africa, sending records to the practice is also a transfer out of your country, and your country's data protection law (for example in Botswana, Zimbabwe or Zambia) may apply. If you are in the European Union or United Kingdom, the GDPR may apply, and the transfer is based on your explicit consent.
8. Security safeguards and breaches
- All connections to this website use TLS encryption.
- Referral submissions are encrypted with AES-256-GCM before storage.
- Clinical information is not sent by standard email.
- DICOM imaging can be de-identified in the referring doctor's browser before upload.
- Access to clinical records is restricted to authorised people and is logged.
If there are reasonable grounds to believe that personal information has been accessed by an unauthorised person, the practice will notify the Information Regulator and the affected people as soon as reasonably possible, as required by Section 22 of POPIA.
9. Artificial intelligence and automated decisions
AI tools are used only with your prior, specific consent, and you may decline without any effect on the quality, priority or timing of your care. AI does not make decisions about you: no decision with legal or similar effect is made by automated means alone (POPIA Section 71). Every AI-assisted output is reviewed and signed off by Dr Kana. See how the practice uses AI.
11. Retention
The practice follows HPCSA Booklet 9 and keeps records for as long as reasonably possible. As a minimum: adult records for six years after the record becomes dormant; records of patients treated as children until their 21st birthday plus six years; and records of mentally incompetent patients indefinitely. Records are not altered after entry; corrections are added with the date, author and reason. Destroyed records are recorded on a retained destruction certificate.
12. Your rights
You may ask for access to, or correction or deletion of, your personal information (subject to the practice's legal retention duties), object to processing on reasonable grounds, and withdraw consent where processing is based on consent. Requests for records follow the PAIA manual. You may lodge a complaint with the Information Regulator (South Africa) at inforegulator.org.za.
Last updated: