Medwell SA (Pty) Ltd
Registration number 2018/017293/07
In respect of the website at medwell.co.za
Effective 22 August 2026. Version 1.0.
1. Definitions
1.1 In this Notice, unless the context indicates otherwise:
1.1.1 “Medwell” means Medwell SA (Pty) Ltd, registration number 2018/017293/07, a private company incorporated in the Republic of South Africa;
1.1.2 “Notice” means this privacy notice, as amended from time to time in accordance with clause 16;
1.1.3 “PAIA” means the Promotion of Access to Information Act, 2 of 2000;
1.1.4 “POPIA” means the Protection of Personal Information Act, 4 of 2013;
1.1.5 “Regulator” means the Information Regulator established under section 39 of POPIA;
1.1.6 “Website” means the website hosted at medwell.co.za, including every page, form and subdomain of it;
1.1.7 “child”, “competent person”, “consent”, “data subject”, “de-identify”, “operator”, “personal information”, “processing”, “responsible party” and “special personal information” bear the meanings assigned to them in section 1 of POPIA;
1.1.8 “you” means the data subject to whom personal information processed under this Notice relates.
1.2 A reference to a statute is a reference to that statute as amended, and includes any regulation, code of conduct or guidance note issued under it.
1.3 The headings in this Notice are for convenience and do not affect its interpretation.
2. Application of this Notice
2.1 This Notice records the manner in which Medwell processes personal information collected through the Website, the purposes for which it is processed, the persons to whom it is disclosed, and the rights available to data subjects in respect of it.
2.2 This Notice applies to visitors to the Website and to persons who submit personal information through it.
2.3 This Notice does not apply to the clinical records of patients and residents in Medwell’s care. Those records are confidential in terms of section 14 of the National Health Act, 61 of 2003, are protected by control measures against unauthorised access as section 17 of that Act requires, and are processed in terms of POPIA and the ethical rules of the professional councils having jurisdiction over Medwell’s practitioners.
2.4 This Notice is issued in compliance with section 18 of POPIA and does not limit any right conferred by POPIA, PAIA or any other law.
3. Responsible Party
3.1 Medwell is the responsible party in respect of the personal information described in this Notice. Its registered address is 244 Jean Avenue, Norma Jean Square, Centurion, 0157.
3.2 Medwell and La Vie Care have merged and operate as a single group. Personal information previously submitted to La Vie Care in connection with the services described on the Website is now held by Medwell as responsible party. Medwell processes that information for the purpose for which La Vie Care collected it, and in terms of this Notice to the extent that this Notice is compatible with that purpose, as section 15 of POPIA requires. This Notice does not apply to any website operated by La Vie Care.
3.3 Medwell has designated an Information Officer, as section 1 of POPIA read with the definition of “head” in section 1 of PAIA requires. Requests, objections and complaints are directed to the Information Officer at the addresses in clause 14.1.
4. Categories of Personal Information Processed
4.1 Medwell processes the following categories of personal information collected through the Website:
4.1.1 identifying information, being your name;
4.1.2 contact information, being your email address and telephone number;
4.1.3 the content of any message, enquiry or request you submit, including any information about another person, and any information about health, that you elect to include in it.
4.2 Medwell does not request payment card details, identity numbers or bank account details through the Website, and no field on the Website is provided for them. Where such information is submitted in a message field notwithstanding, Medwell deletes it unless it is required for the purpose in clause 6.1.
4.3 Personal information collected by automated means is dealt with in clause 7.
4.4 Supply of the information in clause 4.1 is voluntary. Medwell cannot respond to an enquiry or arrange care without at least a name and one contact detail, and an enquiry submitted without them will not be answered. No law obliges Medwell to collect personal information through the Website.
5. Special Personal Information
5.1 An enquiry concerning care commonly discloses information about a person’s health. Information concerning a data subject’s health is special personal information for the purposes of section 26 of POPIA and is subject to the further conditions imposed by Chapter 3, Part B of that Act.
5.2 Medwell is a healthcare institution. Where information concerning health is submitted through the Website, Medwell processes it under section 32(1)(a) of POPIA, on the basis that the processing is necessary for the proper treatment and care of the data subject or for the administration of Medwell’s facilities and professional practice. Where the data subject has given consent to the processing, Medwell relies in addition on section 27(1)(a).
5.3 Where the enquiry concerns the health of a person other than the person submitting it, Medwell relies on section 32(1)(a) and, where applicable, section 27(1)(b) of POPIA. Medwell will notify that person that it holds information about them, and of the matters set out in section 18(1) of POPIA, as soon as reasonably practicable after the enquiry is received, unless a ground in section 18(4) applies. The person submitting the enquiry is asked to submit only the information needed to assess the care required.
5.4 Special personal information collected through the Website is not processed for the purposes of direct marketing.
5.5 Every person at Medwell who has access to information concerning health is subject to an obligation of confidentiality by virtue of profession, employment or written agreement, as section 32(2) of POPIA requires.
6. Purpose of Processing and Lawful Basis
6.1 Response to enquiries and the arrangement of care. Medwell processes the information in clause 4.1 in order to respond to your enquiry, to assess the care required, and to conclude and perform an agreement for the provision of care. The lawful basis is that the processing is necessary to carry out actions for the conclusion of a contract to which you are party under section 11(1)(b) of POPIA, and, in respect of the retention of a record of the enquiry and of Medwell’s answer to it, that the processing is necessary for pursuing Medwell’s legitimate interests under section 11(1)(f). Where you have given consent to a particular use, Medwell relies in addition on section 11(1)(a).
6.2 Delivery of the newsletter. Medwell processes the name, email address and telephone number submitted through the newsletter facility in order to send the newsletter to which you have subscribed. The lawful basis is your consent under section 11(1)(a) and section 69(1)(a) of POPIA. Every issue identifies Medwell as the sender, gives an address to which a request to stop may be sent, and carries an unsubscribe facility, as section 69(4) of POPIA requires. Consent may be withdrawn at any time. Medwell does not use the newsletter facility to market the goods or services of any other person.
6.3 Measurement of the Website and of advertising. Where you have given consent through the mechanism in clause 8.2, Medwell processes information about your use of the Website in order to measure which pages are of use to visitors and whether its advertising results in enquiries. The lawful basis is your consent under section 11(1)(a) of POPIA. Google’s tag manager is loaded on every page of the Website whether or not you give consent, and that request discloses to Google LLC the Internet Protocol address from which it is made, the address of the page and the address of any referring website. No cookie or other identifier is stored on your device, and no measurement or advertising information is collected, unless you accept the relevant category. Refusal of consent does not restrict your access to the Website.
6.4 Security and availability of the Website. Medwell processes the information in clauses 7.1, 7.2 and 7.3 in order to protect the Website against unauthorised access and abuse, to keep it available, and to detect and investigate attacks on it. The lawful basis is that the processing is necessary for pursuing the legitimate interests of Medwell under section 11(1)(f) of POPIA.
6.5 Compliance with law. Medwell processes personal information where the processing complies with an obligation imposed on it by law, including compliance with a subpoena, a court order, or a lawful demand from the Regulator or a professional council. The lawful basis is section 11(1)(c) of POPIA. Where Medwell is asked to disclose personal information but is under no legal obligation to do so, it discloses it only where the disclosure is necessary for the establishment, exercise or defence of a right or obligation in law.
6.6 Medwell does not process personal information collected through the Website for any purpose incompatible with those stated in this clause, and does not subject data subjects to a decision based solely on the automated processing of their personal information as contemplated in section 71 of POPIA.
7. Collection of Information by Automated Means
7.1 When the Website is accessed, the following is recorded automatically:
7.1.1 the Internet Protocol address from which the request originates;
7.1.2 the pages and resources requested, and the date and time of each request;
7.1.3 the address of any website that referred the request;
7.1.4 the type, version and operating system of the device and browser used.
7.2 Medwell’s security software records Internet Protocol addresses and unsuccessful attempts to authenticate to the Website.
7.3 A request for a page that does not exist is recorded, together with the Internet Protocol address from which the request was made, in order to identify and correct broken links and redirect failures.
8. Cookies and Similar Technologies
8.1 A cookie is a small file placed on a device by a website. Medwell employs cookies that are strictly necessary for the operation of the Website and, subject to clause 8.2, cookies and similar identifiers that measure use of the Website and the effect of Medwell’s advertising.
8.2 On first access to the Website a consent mechanism is presented. Cookies and similar identifiers falling outside the strictly necessary category are stored only upon your acceptance of the relevant category. The tag described in clause 6.3 is loaded whether or not you accept. Consent may be varied or withdrawn at any time by means of the preferences facility in that mechanism.
8.3 The Cookie Policy describes the cookies used on the Website, the service each belongs to, its purpose and its period of operation.
8.4 Cookies may also be blocked or deleted by means of your browser settings. The operation of parts of the Website may be affected if you do so.
9. Disclosure to Operators and Third Parties
9.1 Within Medwell, access to personal information is restricted to the personnel who require it for the purpose for which it was collected.
9.2 Medwell may disclose personal information collected through the Website to another company in the Medwell group where that company operates the facility or service the enquiry concerns, and only to the extent necessary to respond to the enquiry and arrange care.
9.3 Medwell engages the following operators, who process personal information on its behalf, on its written instruction, and subject to the obligations imposed by sections 20 and 21 of POPIA:
9.3.1 the provider of hosting services for the Website, in respect of the information in clauses 4.1, 7.1, 7.2 and 7.3;
9.3.2 The Rocket Science Group LLC, trading as Mailchimp, in respect of the delivery of the newsletter;
9.3.3 Google LLC, in respect of measurement, advertising measurement, tag management and the protection of the Website’s forms against automated abuse;
9.3.4 Meta Platforms, Inc., in respect of advertising measurement. Meta processes some of the information it receives for its own purposes and, to that extent, acts as a responsible party in its own right and not as Medwell’s operator;
9.3.5 Defiant, Inc., in respect of the security software described in clause 7.2.
9.4 Medwell may disclose personal information where the disclosure is required by law or by an order of a court, or where it is necessary for the establishment, exercise or defence of a legal claim.
9.5 Medwell does not sell personal information. Medwell does not supply personal information collected through the Website to any third party for the purpose of that party marketing its own goods or services to you, save that the operators in clauses 9.3.3 and 9.3.4 process the information they receive from the Website for their own purposes as described in their own terms, to which links appear in the Cookie Policy.
10. Trans-border Flows of Personal Information
10.1 The operators identified in clauses 9.3.2, 9.3.3, 9.3.4 and 9.3.5 store and process personal information on servers situated outside the Republic of South Africa, principally in the United States of America and in the European Union.
10.2 Medwell effects those transfers in reliance on section 72(1)(a) of POPIA, on the basis that each operator is subject to a binding agreement with Medwell which provides for an adequate level of protection, upholding principles for the reasonable processing of personal information substantially similar to the conditions for lawful processing prescribed by POPIA and including provisions relating to the further transfer of personal information. Where an operator processes personal information for its own purposes and not on Medwell’s instruction, Medwell relies on your consent to the transfer under section 72(1)(b), given through the mechanism in clause 8.2, and does not transfer that information unless that consent is given.
10.3 In respect of the transfers arising from clause 6.2 and clause 6.3, Medwell relies in addition on your consent under section 72(1)(b) of POPIA.
10.4 The United States of America has no general data protection law comparable to POPIA and is not the subject of any adequacy finding by the Regulator. Medwell’s reliance on section 72(1)(a) rests on the contractual terms described in clause 10.2 and not on the law of the recipient country. Personal information processed in the European Union is subject to the General Data Protection Regulation.
10.5 A data subject who does not wish personal information relating to them to be transferred outside the Republic may communicate with Medwell by telephone or at the address in clause 14.1 instead of using the forms or newsletter facility on the Website.
11. Retention of Records
11.1 Enquiries and the correspondence arising from them are retained for 24 months from the date of last communication, save that where the enquiry results in the provision of care, the information forms part of the client record and is retained in terms of Medwell’s records retention policy and the periods prescribed by the legislation applicable to health records.
11.2 Newsletter subscription records are retained until the subscription is cancelled. Following cancellation, a minimal record of the email address is retained for the sole purpose of giving effect to the cancellation.
11.3 The records described in clauses 7.1, 7.2 and 7.3 are retained for 12 months. A record of the consent given under clause 8.2 is stored on your own device for 180 days, and Medwell retains a log of the consent given, the categories accepted and the date, for 12 months, as evidence that consent was obtained.
11.4 Information about your use of the Website that identifies your browser or device is retained by Google Analytics for the period configured in Medwell’s Google Analytics property, which does not exceed 14 months, after which Google deletes it. Statistics derived from that information which do not identify any browser, device or person are retained by Google indefinitely.
11.5 Where a law or a professional obligation requires retention for a longer period, the record is retained for that period and for that purpose alone. Records are destroyed or de-identified in accordance with section 14(4) of POPIA once the applicable period has expired, in a manner that prevents their reconstruction in an intelligible form as section 14(5) requires.
12. Security Safeguards
12.1 Medwell maintains appropriate, reasonable technical and organisational measures as section 19 of POPIA requires, identifies reasonably foreseeable risks to the personal information in its possession, and verifies that its safeguards are effectively implemented. The Website is served over an encrypted connection, access to submitted information is restricted and controlled, and the Website is monitored by security software.
12.2 Electronic mail transmitted over the internet is not encrypted end to end. Clinical records, identity numbers and bank account details should not be transmitted to Medwell by electronic mail or through the Website. Contact Medwell at the number in clause 14.2 to arrange another way of sending them.
12.3 Where there are reasonable grounds to believe that personal information has been accessed or acquired by an unauthorised person, Medwell will notify the Regulator and the affected data subjects as soon as reasonably possible after discovering the compromise, as section 22 of POPIA requires, and will provide sufficient information for a data subject to take protective measures as section 22(5) requires. Notification of a data subject is delayed only on the ground permitted by section 22(3).
13. Rights of Data Subjects
13.1 A data subject has the right, in terms of POPIA:
13.1.1 to be notified that personal information about them is being collected, and that it has been accessed or acquired by an unauthorised person (sections 18 and 22);
13.1.2 to request confirmation, free of charge, of whether Medwell holds personal information about them, and to request a record or description of that information and of the third parties who have had access to it, against any prescribed fee (section 23);
13.1.3 to request the correction or deletion of personal information that is inaccurate, irrelevant, excessive, out of date, incomplete, misleading or obtained unlawfully, and the destruction of a record that Medwell is no longer authorised to retain (section 24(1)(a) and (b));
13.1.4 to object, in the prescribed manner and on reasonable grounds relating to their particular situation, to the processing of their personal information where Medwell relies on section 11(1)(d), (e) or (f) of POPIA, in which case Medwell may no longer process that information (sections 11(3)(a) and 11(4));
13.1.5 to withdraw a consent previously given, which does not affect the lawfulness of processing carried out before the withdrawal (section 11(2)(b));
13.1.6 not to have their personal information processed for the purposes of direct marketing by means of unsolicited electronic communication, and to require that such processing cease (sections 69(1) and 11(3)(b));
13.1.7 not to be subject to a decision based solely on the automated processing of their personal information which results in legal consequences for them or affects them to a substantial degree (section 71);
13.1.8 to submit a complaint to the Regulator, in the prescribed manner and form, regarding an alleged interference with the protection of their personal information (section 74);
13.1.9 to institute civil proceedings in respect of an alleged interference with the protection of their personal information (section 99);
13.1.10 to register a pre-emptive block against direct marketing on the registry administered by the National Consumer Commission, and to demand that Medwell stop any direct marketing communication (section 11 of the Consumer Protection Act, 68 of 2008).
13.2 A right under clause 13.1 is exercised by written request to the Information Officer at an address in clause 14.1, using the form prescribed under POPIA where one is prescribed. Medwell responds as soon as reasonably possible and in any event within 30 days of receipt, save that where a request is for access to a record in terms of PAIA, Medwell may extend that period once as section 57 of PAIA permits and will tell you if it does. Medwell may require reasonable proof of identity before giving effect to a request.
13.3 Where Medwell is unable to give effect to a request because a law requires the retention of the information, Medwell will identify the obligation relied upon.
13.4 A request for access to a record in terms of PAIA is made on the prescribed form and is dealt with in accordance with Medwell’s PAIA manual, which sets out the procedure, the applicable grounds of refusal and any prescribed fee. The manual is available for public inspection at Medwell’s principal place of business during normal business hours, and on request at the address in clause 14.1.
14. Requests, Complaints and Contact Details
14.1 The Information Officer. All requests, objections and complaints concerning personal information are addressed to:
The Information Officer, Medwell SA (Pty) Ltd
Email: privacy@medwell.co.za
Physical: 244 Jean Avenue, Norma Jean Square, Centurion, 0157
Post: P.O. Box 786, Irene, 0062
14.2 General enquiries. Telephone +27 10 006 5538 or email info@medwell.co.za.
14.3 The Information Regulator (South Africa). Woodmead North Office Park, 54 Maxwell Drive, Woodmead, Johannesburg, 2191. Telephone 010 023 5200, toll free 0800 017 160. General enquiries: enquiries@inforegulator.org.za. POPIA complaints: POPIAComplaints@inforegulator.org.za. PAIA complaints: PAIAComplaints@inforegulator.org.za.
15. Personal Information of Children and of Adults Unable to Consent
15.1 The Website is not directed at children and Medwell does not knowingly collect the personal information of a child through it.
15.2 Where an enquiry concerns the care of a child, Medwell processes the child’s personal information with the prior consent of a competent person as section 35(1)(a) of POPIA permits, and where that information concerns the child’s health, under section 32(1)(a) of POPIA.
15.3 Where an enquiry concerns the care of an adult who is unable to give consent, Medwell processes that person’s personal information under section 11(1)(d) and section 32(1)(a) of POPIA, on the basis that the processing protects a legitimate interest of that person and is necessary for their proper treatment and care.
16. Amendment of this Notice
16.1 Medwell may amend this Notice from time to time to reflect changes in its services, its operators or the applicable law. The version number and effective date recorded at the head of this Notice identify the current version.
16.2 Where an amendment materially affects the manner in which personal information already collected is processed, Medwell will publish notice of the amendment on the Website before it takes effect. An amendment does not extend the purposes for which personal information already collected may be processed beyond what section 15 of POPIA permits.