Privacy and practice policies

VERSION INFORMATION
These policies include the DrKTMed network service and financial schedule effective with this published version. Existing recorded acceptances and booking commitments retain their applicable versions.

1. RESPONSIBLE PARTY
Dr. Kamo Tjelele Medical Centre is responsible for personal information it determines how and why to process for Centre care and its platform functions. An independent network practice is responsible for its own care, professional records and claims processing. DrKTMed may process information on a practice's instructions as its operator for agreed technology services, or as a responsible party for its own defined functions. The actual responsibilities must be recorded in the relevant agreements; shared software does not transfer all clinical responsibility to the Centre.

Platform privacy and Information Officer enquiries are directed through admin@drkamotjelelemed.com. Each independent practice must identify its privacy contact. The Centre's Information Officer registration reference and PAIA Manual must be maintained and made available as required by law.

2. INFORMATION PROCESSED
Depending on the service and role, information may include identity and contact details; the network patient identity and practice relationships; authentication and security data; bookings, queues and actual attendance; health histories, consultation notes, diagnoses, treatment, prescriptions, certificates, referrals, tests and results; clinical communications and attachments; patient/representative authority and referral-access records; medical-scheme or insurance details and necessary claim information; invoices, payments and credits; professional qualifications, council registration and indemnity evidence; approved directory profile information; availability and staffing requests; and access, verification, security and communication-delivery logs. Health information is special personal information. Information must be limited to what is appropriate for the specified lawful purpose.

3. PURPOSES
Information is processed for the relevant party's authorised purposes: healthcare and care coordination; reliable patient and professional identification; appointments and referrals; secure health records and clinically appropriate documents; account and payment administration; practice-owned claims preparation; professional verification and directory services; opted-in staffing matching; professional, accounting and legal obligations; service communications; incident investigation; security and access audits; agreed practitioner administration; and practice operations. A listed purpose does not grant every user access or permit unrelated reuse of information.

4. LAWFUL PROCESSING, MINIMISATION AND ACCURACY
The Centre processes personal information only on an applicable lawful basis and for defined purposes. Only information reasonably required for those purposes should be collected or disclosed. Users should keep their details accurate. Consent is obtained where consent is required, but statutory health-record and other lawful processing obligations may continue even after a person withdraws consent for optional processing.

5. CLINICAL CONFIDENTIALITY
A patient uses one network identity across participating practices. Record access follows an authorised care relationship. When a referral is authorised and sent to its identified treating recipient, that recipient may access the patient's full available longitudinal clinical record across participating practices for assessment and care, including previous consultation notes, diagnoses, allergies, medication and prescription history, results, reports and referrals. The referral summary helps navigation and does not replace or restrict that full history to a summary. Separate permission is not required for every document within an already authorised full-record referral.

The referral records the patient's or lawful representative's authority, or another applicable lawful care basis, the recipient and practice, purpose and relevant dates. Mere network membership, directory browsing, shortlisting, a payment role or practice ownership does not grant access to every patient's clinical record. Legally protected third-party information and other restrictions required by law remain protected. The network cannot supply records that have never been made available to it.

Declining, cancelling or expiring a referral ends access granted solely by that referral, unless another valid care or specifically authorised review relationship supports access. Necessary ongoing care, appropriate handover and lawful record-retention duties remain. Retention of a record already lawfully obtained does not alone grant continuing access to the live network record. Access and disclosure decisions are auditable and retain the originating practice and practitioner.

Reading a shared record does not authorise a professional to diagnose, prescribe, certify, perform a procedure or sign a document outside their verified professional scope and applicable law. Reception, finance, staffing and other nonclinical staff receive only the information required for their authorised duties. An owner or administrator needs a separate lawful clinical or governance role to access clinical content.

6. RECIPIENTS AND OPERATORS
Where necessary and lawful, information may be provided to the identified treating professional and authorised care team; personnel with duties requiring it; laboratories and referral providers; the relevant medical scheme or insurer and that practice's authorised processor; payment providers; hosting and communication operators; professional advisers or auditors; or competent authorities where required by law. A referral authorises the identified recipient and purpose, not disclosure to the entire network.

Operators must have appropriate written security and confidentiality obligations. Each independent practice's processor, recipients and financial exports must remain attributable to that practice. Administrative ownership or a network staffing role does not authorise unrestricted chart access.

7. MEDICAL-AID CLAIMS
Each virtual practice processes its own medical-scheme or insurance claims, internally or through its nominated external processor. DrKTMed supplies available pro-forma invoices, actual attendance/completion information and ICD-10/coding summaries to authorised users for that practice's processing. Necessary member, dependant, coding and claim information may be disclosed only under the required authority and lawful purpose. The Centre's own configured claims workflow applies to Centre care; it is not the default claims processor for independent practices. Benefit verification is distinct from claim submission and final settlement.

8. EMAIL AND WHATSAPP
Transactional messages may contain appointment, queue, routing, payment or claim-status prompts. Detailed diagnosis and clinical information should ordinarily be accessed through the secure portal. Communication providers receive only the information reasonably required for delivery. WhatsApp is an alert/administrative channel, not the authoritative clinical record.

9. INFORMATION SECURITY
The Centre must implement reasonable technical and organisational safeguards appropriate to health information, including authentication, role-based access, encryption/protected storage where appropriate, access logging, secure transmission, backup/recovery, incident response, risk review, operator controls and continuing verification of safeguards. Security measures must be reviewed and updated when risks or deficiencies are identified.

10. SECURITY COMPROMISES
Suspected or confirmed security compromises are assessed and managed in accordance with POPIA, including notification to the Information Regulator and affected data subjects where required. Audit and incident evidence is retained.

11. INTERNATIONAL PROCESSING
Before personal information is transferred to or made accessible by a recipient outside South Africa, the Centre must assess and document the requirements of POPIA section 72 and applicable safeguards. This includes relevant hosting and communications providers.

12. RETENTION
Health records are retained for at least the minimum periods required by HPCSA guidance and applicable law. As a general professional minimum, patient records should not be destroyed sooner than six years after they become dormant, with longer periods applying in specified circumstances, including certain records relating to minors, incapacity, occupational health and other legal or clinical requirements. Billing and administrative records may have different statutory retention periods. Secure destruction is used when lawful retention ends.

13. DATA-SUBJECT RIGHTS
Subject to applicable law, a person may request access to or correction of personal information, object to certain processing, request deletion where lawful, and lodge a complaint. A request to delete information does not override a lawful or professional duty to retain health or financial records.

14. PAIA
Requests for access to records are handled in accordance with the Promotion of Access to Information Act and the Centre's current PAIA Manual.

15. CONTACT AND COMPLAINTS
Privacy / Information Officer: admin@drkamotjelelemed.com
Support: support@drkamotjelelemed.com
General: info@drkamotjelelemed.com
A data subject may also approach the Information Regulator of South Africa using its published channels.

REGULATORY BASIS
Protection of Personal Information Act 4 of 2013, including security safeguards and cross-border transfer requirements; Promotion of Access to Information Act 2 of 2000; National Health Act 61 of 2003 sections concerning records, confidentiality and access; HPCSA Booklets 5, 9 and 10; Information Regulator guidance and eServices requirements. The 2026 health-information regulations for certain responsible parties are considered where the Centre interacts with entities falling within their stated scope.\n

DRKTMED NETWORK UPDATE 2026-11-04-network-2 (privacy)

16. DIRECTORY, VERIFICATION AND STAFFING INFORMATION
Professionals may provide qualifications, council and registration details, professional category, practice number where applicable, service interests, experience, languages, biography, approved portrait/logo, practice location, hours and fees. Verification may require identity, current professional-registration and indemnity evidence, review results and expiry dates. Required evidence is held privately for authorised verification; it is not made public with the profile.

Public profiles may use a title, initials and surname. Only approved practice contact details, practice locations and verified practice payment instructions are intended for publication. Private cellular numbers, personal home addresses, identity evidence, policy documents and bank-verification evidence are not public directory content. Full treating-practitioner identity and practice details must be available when needed for informed care. Staffing contacts are released only through the authorised request/placement workflow to the verified parties who need them.

Availability and staffing-request data may be used to match a professional's opted-in availability, location, qualifications and stated work preferences to a verified request. A directory listing or request does not authorise unrelated marketing or disclosure to every network member. Where a staffing engagement is offered, the parties receive its worksite, responsible contact, duties, times and agreed payment terms before acceptance. Unnecessary continuous location tracking is not part of ordinary directory or referral consent.

End of DRKTMED NETWORK UPDATE 2026-11-04-network-2 (privacy).


NETWORK DATA-HANDLING ADDENDUM — 4 NOVEMBER 2026
Network applications collect the person's name, contact details, organisation (where applicable), account credentials and the service requested. Professional applications may additionally require council, qualifications, verification evidence, permitted services and business contact information. Employment or staffing requests may include role and worksite needs. Patient health information is not required for a general staffing enquiry. Please use the secure clinical workflow rather than a general public form for medical information.
Information is used to operate accounts, authenticate users, process verification and network requests, maintain authorised records, prevent fraud and perform applicable legal obligations. Separate optional analytics remain governed by the Cookie Settings page. Data is shared only with authorised reviewers and necessary service providers (such as hosting, secure communications, verification and payment processors) for the relevant purpose, with lawful safeguards. Where cross-border processing occurs, applicable POPIA protections and agreements must be assessed. The organisation and the treating independent practice may each have distinct responsibilities for information processed within their own services.
The Centre's responsible-party contact information and a way to request access, correction, objection or other applicable rights are provided through Support & Contact. For concerns about personal information, contact that channel or the Information Regulator of South Africa. Records are retained only as needed for applicable professional, financial, statutory, contract, security and audit obligations under the applicable retention schedule; a public listing can be hidden without destroying records that must legally remain. No universal retention period for all health information is asserted. The published cookie notice's stated aggregate-measurement retention continues to govern that specific activity.

VERSION INFORMATION
These policies include the DrKTMed network service and financial schedule effective with this published version. Existing recorded acceptances and booking commitments retain their applicable versions.

1. PURPOSE OF TELEHEALTH
Telehealth uses electronic communications to deliver healthcare when the patient and practitioner are in different locations. DrKTMed may support secure video, audio, text, document exchange, appointment scheduling and related clinical communication. The same professional duties concerning competence, informed consent, confidentiality, recordkeeping and quality apply as in face-to-face care.

2. TELEHEALTH IS NOT A SUBSTITUTE FOR ALL IN-PERSON CARE
Telehealth is used only when the treating professional considers it clinically appropriate. The professional must consider symptom severity, the available history, the need for examination and whether remote care can be provided safely. A virtual consultation may be stopped, changed or followed by in-person assessment.

The treating professional must facilitate or refer for appropriate physical care when needed. DrKTMed primarily provides virtual care; a Centre in-person visit occurs only by a specifically confirmed arrangement. An independent network practice remains responsible for its own physical visits. An online listing is not confirmation of a physical appointment.

3. EMERGENCIES
DrKTMed is not an emergency service. In an emergency, urgent stabilisation and referral to an appropriate emergency facility take priority. A patient should not wait for an online consultation when delay could threaten life or cause serious harm.

4. PRACTITIONER COMPETENCE AND REGISTRATION
Only appropriately registered, verified and authorised professionals may provide a service through the relevant practice. The professional must act within their verified registration category, competence and legal scope. Telehealth does not reduce the professional standard. Directory tags, uploaded qualifications or access to another practitioner's records do not automatically enable restricted prescribing, certification, procedures or document signing.

5. PRACTITIONER-PATIENT RELATIONSHIP
The clinical relationship is between the patient and the professional/practice that agrees to provide the care, with the required informed consent. The patient is told the responsible practice and actual treating professional. A practitioner preference is subject to availability and suitability. A replacement or referral to another practice requires an identified and authorised care arrangement; network membership does not itself transfer a patient or their clinical records to every member.

6. REQUIRED SESSION CHECK-IN
Before a virtual consultation begins, DrKTMed records session-specific check-in evidence. The patient confirms identity, current physical location, agreement to telehealth and treatment, understanding that in-person care may be required, and whether any other person is present. The practitioner confirms identity/professional status, current physical location, and that the consultation environment is appropriately private. These checks support clinical safety and emergency referral and form part of the consultation record.

7. INFORMED CONSENT
By consenting to a virtual consultation, the patient confirms that:
• the identity of the treating practitioner and relevant practice details will be available;
• the practitioner may decide whether the condition is suitable for telehealth and may require face-to-face assessment;
• electronic transmissions may include consultation audio/video/text, scheduling, clinical documents, prescriptions, referrals and necessary records;
• reasonable security and authentication controls are used but no internet transmission can be guaranteed completely risk-free;
• material confidentiality risks of remote communications have been explained through this policy;
• only appropriate persons should be present and any additional person participating in the video consultation must be disclosed;
• necessary medical information may be transmitted to appropriate healthcare providers or other authorised parties where the patient has consented or law otherwise permits;
• the cost and funding method are shown through the booking/payment workflow; and
• the patient may withdraw from a virtual consultation and request or be referred for appropriate in-person care, subject to clinical and operational availability.

8. RECORDING
DrKTMed does not treat routine live consultation media as recorded merely because a video or audio call occurs. A consultation may not be recorded by the Centre or practitioner unless a separate approved recording workflow is used and express consent is obtained for the recording, storage, access and retention. Patients and practitioners should not make unauthorised recordings.

9. CONFIDENTIALITY AND SECURITY
Both patient and practitioner should use a private environment as far as reasonably possible. Clinical information should be transmitted through the secure platform rather than ordinary social-media chat. Authentication, access control, protected storage, audit trails and secure transmission controls are used in accordance with the platform's security architecture.

10. WHATSAPP, EMAIL AND OTHER ALERT CHANNELS
Email and Meta WhatsApp may be used for appointment confirmations, five-minute reminders, waiting-room updates, practitioner-routing alerts and secure claim/payment prompts. They are not the authoritative consultation channel and should not contain unnecessary detailed clinical information. Clinical communications that form part of care are retained in the health record where required.

11. CLINICAL EVALUATION AND PRESCRIBING
A treating professional must conduct and document an adequate clinical evaluation and relevant history before treatment. An online questionnaire alone is not a substitute for an appropriate assessment. Prescribing and other restricted professional acts are available only to a person legally authorised for that act and service; the platform's technical ability to display a tool does not grant professional authority. Prescriptions and other documents must meet the applicable legal, professional and signature requirements.

12. QUALITY ASSURANCE
The Centre and practitioners must ensure that telehealth equipment and systems used for care are operational and fit for purpose. Quality and security checks should be carried out periodically, with evidence retained. Insufficient audio, video, information quality or connectivity is a reason to stop or change the consultation where patient safety could be compromised.

13. RECORDKEEPING
Telehealth consultations, relevant electronic communications, consent evidence, clinical evaluations, prescriptions, test results, referrals and other care-related material must be recorded and retained to the same professional standard as face-to-face care.

14. CONSENT EVIDENCE
DrKTMed stores the accepted policy version/hash, session check-in evidence, timestamps and relevant audit events. A copy or record of consent can be made available as part of the patient's record where required.

REGULATORY BASIS
HPCSA General Ethical Guidelines for Good Practice in Telehealth, Booklet 10 (revised December 2021 and listed in the HPCSA ethical guideline set updated 13 June 2025), especially sections on telehealth applicability, competence, clinical suitability, evaluation, informed consent, confidentiality, quality and security; HPCSA Booklets 4, 5 and 9; National Health Act 61 of 2003; POPIA; ECTA.\n

DRKTMED NETWORK UPDATE 2026-11-04-network-2 (telehealth)

15. NETWORK REFERRALS AND INDEPENDENT PRACTICES
The booking and consultation identify the practice and professional responsible for care. Independent practices retain clinical autonomy, set their own disclosed patient fees and process their own medical-scheme or insurance claims. A platform fee does not influence the clinical need for a consultation, test, medicine, referral or procedure.

The same patient identity may be used across participating practices. A separately authorised referral gives its identified treating recipient access to the full available clinical history for care, subject to lawful confidentiality restrictions. This is not unrestricted access for all network members. Access to that history does not expand any professional's scope of practice.

Centre-specific Express, scheduling, medical-aid, cancellation and service-recovery rules apply to Centre bookings. An independent practice must identify its own applicable service and booking terms before the patient commits. A virtual or directory booking does not promise that the Centre will provide an in-person visit; any Centre in-person care must be specifically arranged and confirmed.

End of DRKTMED NETWORK UPDATE 2026-11-04-network-2 (telehealth).

VERSION INFORMATION
These policies include the DrKTMed network service and financial schedule effective with this published version. Existing recorded acceptances and booking commitments retain their applicable versions.

1. HEALTH RECORD
The responsible treating practice creates and maintains a health record for the care it delivers. The record should contain the patient identity, relevant history, consultation date/time/place and mode, actual practitioner and practice, assessment, management plan, medicines, referrals, investigations/results, authority and consent evidence, and other information reasonably necessary for care. Relevant virtual, telephonic and other clinical interactions and correspondence are recorded as required. One network patient identity links available records without erasing their source practice or authorship.

2. RECORD INTEGRITY
Signed clinical notes and issued documents are not silently overwritten. Corrections or amendments must preserve an audit trail. Access is limited to authorised persons and is logged. Billing records should be distinguished from the clinical care record while remaining appropriately linked for lawful administration.

3. PROFESSIONAL DOCUMENTS
Certificates, prescriptions, referrals and reports are issued only after an adequate professional assessment and by a practitioner legally authorised to issue that document for the service. Each document identifies the actual responsible professional and practice as required. A patient cannot purchase or demand a predetermined certificate, prescription or diagnosis. Full-history record access and nursing/service-interest tags do not expand professional scope or confer a medical practitioner's powers on another profession.

4. MEDICAL CERTIFICATES
DrKTMed may issue uniquely identifiable certificates and provide a public verification function that confirms limited authenticity information without exposing unnecessary clinical detail. Revoked or superseded certificates remain auditable.

5. PRESCRIPTIONS
Electronic/computer-generated prescriptions are issued only where professionally and legally permitted and using the appropriate practitioner signature method. Where the law or professional rules require a personal/original or other specific form of signature for a medicine or document, DrKTMed must not substitute an inadequate generic typed signature.

6. RETENTION
Patient records are retained for at least the professional/legal minimum. The general HPCSA minimum is not less than six years from the date a record becomes dormant, with longer periods applying to certain categories, including records involving minors, incapacity, occupational health or other circumstances specified by law/professional guidance. Litigation, complaints, investigations or clinical need may require longer retention.

7. CONFIDENTIALITY AND ACCESS
A patient uses one network identity across participating practices. Record access follows an authorised care relationship. When a referral is authorised and sent to its identified treating recipient, that recipient may access the patient's full available longitudinal clinical record across participating practices for assessment and care, including previous consultation notes, diagnoses, allergies, medication and prescription history, results, reports and referrals. The referral summary helps navigation and does not replace or restrict that full history to a summary. Separate permission is not required for every document within an already authorised full-record referral.

The referral records the patient's or lawful representative's authority, or another applicable lawful care basis, the recipient and practice, purpose and relevant dates. Mere network membership, directory browsing, shortlisting, a payment role or practice ownership does not grant access to every patient's clinical record. Legally protected third-party information and other restrictions required by law remain protected. The network cannot supply records that have never been made available to it.

Declining, cancelling or expiring a referral ends access granted solely by that referral, unless another valid care or specifically authorised review relationship supports access. Necessary ongoing care, appropriate handover and lawful record-retention duties remain. Retention of a record already lawfully obtained does not alone grant continuing access to the live network record. Access and disclosure decisions are auditable and retain the originating practice and practitioner.

Reading a shared record does not authorise a professional to diagnose, prescribe, certify, perform a procedure or sign a document outside their verified professional scope and applicable law. Reception, finance, staffing and other nonclinical staff receive only the information required for their authorised duties. An owner or administrator needs a separate lawful clinical or governance role to access clinical content.

Patient record-access requests and lawful disclosures remain subject to applicable health-information, POPIA and PAIA requirements. Withdrawal of optional sharing does not authorise unlawful destruction of records or remove an applicable retention duty.

8. ELECTRONIC STORAGE AND TRANSMISSION
Electronic records must be protected by reasonable authentication, access-control, integrity, backup and transmission safeguards. Documents transmitted electronically should use secure channels appropriate to their sensitivity.

9. PATIENT COPIES
Where appropriate and lawful, patients may obtain copies of their records and issued documents through the secure platform or another authorised process.

REGULATORY BASIS
National Health Act 61 of 2003 sections 13–17; HPCSA Booklet 9 Guidelines on Patient Records (updated November 2022 and retained in the current guideline set); HPCSA ethical rules concerning official documents and prescriptions; POPIA; PAIA; ECTA.\n

DRKTMED NETWORK UPDATE 2026-11-04-network-2 (documents)

10. PRACTICE CLAIM DOCUMENTS AND RECORD PROVENANCE
Clinical records identify the actual treating practitioner, responsible practice and care delivered. The network may link available records through one patient identity while preserving the origin, authorship and amendment history of each record. A later practitioner may add an authorised note or correction with an audit trail but may not silently rewrite another practitioner's signed record.

Each virtual practice is responsible for its claim submission, through its own staff or nominated external processor. DrKTMed makes the available pro-forma invoices, factual attendance/completion evidence and ICD-10/coding summaries available to authorised users of that practice. A pro-forma is not a receipt, a submitted claim or proof of scheme settlement. Attendance evidence must describe the actual care mode and events; asynchronous care must not be represented as attendance at a live call that did not occur. Coding and financial corrections must not overwrite the signed clinical record.

Clinical chart access and billing-document access are separate permissions. Billing exports contain only information authorised and necessary for the identified practice and processing purpose. An external practice's records are not automatically copied to another practice's billing processor. Current and historic policy acceptances, referral authority and document provenance remain traceable.

End of DRKTMED NETWORK UPDATE 2026-11-04-network-2 (documents).