PAIA Manual

1. Contact details

2. Guide on how to use PAIA

1. The Information Regulator has compiled a guide, in terms of section 10 of PAIA, containing information to assist any person who wishes to exercise a right under PAIA or POPIA. The guide is available in each of the official languages from the Information Regulator's website at inforegulator.org.za.
2. A copy of the guide may also be inspected at the Business's address stated in clause 1, during normal business hours.

3. Records automatically available

1. The following records are available without a formal request under PAIA, on this website: the Terms of Service, the Privacy Policy, the Data Processing Agreement, the Legal Notice, this manual, and information about the Business's services and prices.

4. Records held in terms of legislation

1. The Business keeps records in accordance with the following legislation, to the extent that it applies to the Business:
   1. Companies Act 71 of 2008;
   2. Consumer Protection Act 68 of 2008;
   3. Electronic Communications and Transactions Act 25 of 2002;
   4. Income Tax Act 58 of 1962;
   5. Tax Administration Act 28 of 2011;
   6. Value-Added Tax Act 89 of 1991;
   7. Basic Conditions of Employment Act 75 of 1997;
   8. Labour Relations Act 66 of 1995;
   9. Promotion of Access to Information Act 2 of 2000; and
   10. Protection of Personal Information Act 4 of 2013.

5. Subjects and categories of records

1. The inclusion of a category of record in this manual does not mean that access to records in that category will be granted. Each request is assessed in terms of PAIA.
2. Patient appointment records are held by the Business as operator on behalf of the Practice concerned, which is the responsible party. Requests for access to such records should be directed to that Practice.

6. Processing of personal information

1. Purposes of processing. To provide the Roomcall service to Practices; to administer accounts and billing; to secure the service and prevent misuse; and to comply with legal obligations.
2. Categories of data subjects and personal information.
   1. Practices and their account users: names, email addresses, account settings, credentials (hashed), sign-in records, billing records and correspondence;
   2. Patients of Practices (processed as operator): names, telephone numbers, appointment details and reasons for visits;
   3. Website visitors: IP addresses, held temporarily for security; and
   4. Suppliers and personnel: contact, contractual and payment details.
3. Recipients. Hosting and database providers acting as operators, as listed in Annex 3 of the Data Processing Agreement; our email provider, Microsoft (Outlook.com), for correspondence; our email delivery service Resend, Inc., which sends automated account emails such as password reset links; our online reseller Paddle.com, which receives a practice's account email address when it subscribes; and public bodies where the law requires disclosure.
4. Planned transborder flows. The Business's application servers and primary database, including its backups, are hosted in Johannesburg, South Africa. Some supporting processing by service providers (technical logs, provider support, email, automated account emails sent by Resend, Inc. from Ireland, and subscription processing by Paddle.com) may take place outside South Africa, subject to the safeguards required by section 72 of POPIA.
5. Security measures. The Business maintains the security measures described in clause 10 of the Privacy Policy and Annex 2 of the Data Processing Agreement.

7. Request procedure

1. A request for access to a record must be made on Form 2 prescribed under the PAIA regulations, which is available from the Information Regulator's website, and submitted to the Information Officer at the email or physical address in clause 1.
2. The requester must provide sufficient detail to enable the record and the requester to be identified, state the form of access required, and, where the request is made on behalf of another person, provide proof of the capacity in which it is made. A requester who requires access to a record in order to exercise or protect a right must identify that right and explain why the record is required.
3. A data subject may request confirmation of whether the Business holds personal information about them, and a description of that information, free of charge, in terms of section 23 of POPIA.
4. The Business will decide on a request within 30 days after receiving it, and may extend that period once by up to a further 30 days in the circumstances set out in section 57 of PAIA, with notice to the requester.

8. Fees

1. A request fee, and an access fee for the search, preparation and reproduction of records, may be payable in the amounts prescribed in the PAIA regulations. The Information Officer will notify the requester of any fee before processing the request. A requester who seeks access to their own personal information does not pay the request fee.

9. Grounds for refusal

1. Access may be refused on the grounds set out in Chapter 4 of Part 3 of PAIA, including where access would involve the unreasonable disclosure of personal information about a third party, the disclosure of confidential or commercial information of a third party or of the Business, a breach of a duty of confidence, or a risk to the safety of individuals or the security of property or systems.

10. Remedies

1. The Business has no internal appeal procedure. A requester who is dissatisfied with a decision may, within 180 days after being notified of it, lodge a complaint with the Information Regulator in terms of section 77A of PAIA, or apply to a court in terms of section 78 of PAIA.

11. Availability of this manual

1. This manual is available on the Business's website and, on request, at the Business's address during normal business hours. It will be updated when the information in it changes.