POPIA Compliance Statement

1. Our Commitment

As a paediatric specialist centre providing occupational therapy, speech therapy, and specialist education, we process sensitive information about children on a daily basis. We recognise the trust that parents and guardians place in us and take our responsibilities under POPIA — and under the broader constitutional right to privacy (section 14 of the Constitution) — very seriously.

2. Information Officer

In terms of section 55 of POPIA, we have designated the following Information Officer: Samantha Ochse (Founder). Email: info@thecarejunction.com. Telephone: +27 83 276 9173. Address: Greenside, Johannesburg, South Africa.

3. The Eight Conditions for Lawful Processing

POPIA sets out eight conditions that must be met when processing personal information. Here is how The CareJunction complies with each:

3.1 Accountability (Condition 1)

We take responsibility for all personal information in our possession or under our control. Our Information Officer ensures compliance with POPIA across the organisation. Staff members with access to personal information receive training on their data protection obligations.

3.2 Processing Limitation (Condition 2)

We collect personal information only for specific, explicitly defined, and lawful purposes. We obtain consent from parents or legal guardians before processing children's information. We collect only the minimum information necessary to provide our services. Personal information collected via our website (contact forms, enquiry forms) is limited to what is needed to respond to the enquiry.

3.3 Purpose Specification (Condition 3)

We process personal information for clearly defined purposes: providing therapy and education services, communicating with families about their child's progress, managing accounts and billing, complying with HPCSA and other regulatory requirements, and improving our services. We do not use personal information for purposes unrelated to our services without obtaining additional consent.

3.4 Further Processing Limitation (Condition 4)

We do not process personal information for secondary purposes that are incompatible with the original purpose of collection. Where we wish to use information for a new purpose (such as anonymised case studies for training), we obtain specific consent.

3.5 Information Quality (Condition 5)

We take reasonable steps to ensure that personal information is complete, accurate, and up to date. Parents and guardians are encouraged to notify us of any changes to their or their child's information. Our customer portal allows registered users to review and update their personal details.

3.6 Openness (Condition 6)

This POPIA Compliance Statement, together with our Privacy Policy, is publicly available on our website. We inform data subjects at the point of collection about what information we collect, why we collect it, and how it will be used. Our Information Officer's details are publicly available for any enquiries.

3.7 Security Safeguards (Condition 7)

We implement appropriate technical and organisational measures to protect personal information, including: encrypted data transmission (HTTPS/TLS) across our website; CSRF protection and rate limiting on all forms; role-based access controls restricting access to personal information to authorised personnel only; secure authentication for staff and customer portals; regular security reviews; and secure storage of clinical and educational records. In the event of a data breach that poses a risk to data subjects, we will notify the Information Regulator and affected individuals as required by section 22 of POPIA.

3.8 Data Subject Participation (Condition 8)

Data subjects (or their parents/guardians, in the case of children) have the right to: request confirmation of whether we hold their personal information; request access to their personal information; request correction or deletion of their information; and object to the processing of their information. Requests can be directed to our Information Officer at info@thecarejunction.com. We will respond within 30 days.

4. Processing of Children's Information

We recognise that children are entitled to additional protection under POPIA (section 35). We process children's personal information only with the consent of a competent person (parent or legal guardian). Additional safeguards apply to children's clinical and educational records, including stricter access controls and restricted sharing. We do not disclose children's information to third parties except where required for clinical referrals (with parental consent), regulatory compliance, or legal obligations.

5. Special Personal Information

The nature of our services means we regularly process health information, which is classified as special personal information under section 26 of POPIA. We process this information on the basis of explicit consent from a parent or legal guardian, or where it is necessary for healthcare service provision. We maintain strict confidentiality around all clinical information.

6. Direct Marketing

We do not engage in unsolicited direct marketing. Where we send communications (such as WhatsApp broadcasts or email updates), we do so only to individuals who have opted in or who have an existing relationship with The CareJunction. You may opt out of any marketing communications at any time by contacting us at info@thecarejunction.com.

7. Website Cookies and Tracking

Our website uses a cookie consent mechanism. Non-essential cookies (including analytics and marketing cookies via Google Tag Manager) are only activated after you have provided your consent. Essential cookies required for the functioning and security of the website do not require consent but are disclosed in our Privacy Policy. You can manage or withdraw your cookie preferences at any time.

8. Cross-Border Data Transfers

Where personal information is transferred outside of South Africa (for example, through third-party hosting or analytics services), we ensure that adequate protections are in place as required by section 72 of POPIA. This may include ensuring the recipient jurisdiction has adequate data protection laws, or putting in place binding agreements with data processors.

9. PAIA Manual

In terms of section 51 of the Promotion of Access to Information Act, 2000 (PAIA), private bodies must make a PAIA Manual available describing the records they hold and how to request access. We are finalising our PAIA Manual and will publish it on this website. In the meantime, requests for access to information may be sent to our Information Officer at info@thecarejunction.com.

10. Complaints

If you believe that The CareJunction has not complied with POPIA or has infringed your rights, you may: contact our Information Officer at info@thecarejunction.com; or lodge a complaint with the Information Regulator of South Africa. Information Regulator — Email: inforeg@justice.gov.za. Website: https://inforegulator.org.za. Telephone: 012 406 4818.

11. Review and Updates

This POPIA Compliance Statement is reviewed annually and updated as necessary to reflect changes in legislation, our services, or our data processing practices. The latest version is always available on our website.