Privacy Policy

1. Who We Are

The CareJunction is a paediatric specialist centre offering occupational therapy, speech therapy, and specialist education through our proprietary Companion Therapy System (CTS). We are based in Greenside, Johannesburg, Gauteng, South Africa.

2. Information Officer

In terms of POPIA, our designated Information Officer is: Samantha Ochse (Founder). Email: info@thecarejunction.com. Telephone: +27 83 276 9173. Address: Greenside, Johannesburg, South Africa.

3. What Personal Information We Collect

3.1 From parents, guardians, and caregivers

Full name, identity or passport number, contact details (telephone, email, physical address), relationship to the child, medical aid details (where applicable), and financial information for billing purposes.

3.2 From children

Full name, date of birth, gender, medical and developmental history, assessment results, therapy progress notes, educational records, and photographs or videos taken during sessions (with prior consent). Children's information is treated as special personal information under POPIA and is subject to additional safeguards.

3.3 From website visitors

Information submitted via contact and enquiry forms (name, email, telephone number, message content), device and browser information collected through cookies and analytics tools (only with your consent), and IP addresses for security purposes.

3.4 From staff and therapists

Employment-related personal information processed in terms of the employment relationship.

4. How We Use Personal Information

We process personal information only for lawful purposes directly related to our services: providing occupational therapy, speech therapy, and specialist education services; communicating with parents and caregivers about their child's progress and appointments; processing payments and managing accounts; fulfilling medical aid claims where applicable; maintaining clinical records as required by the Health Professions Council of South Africa (HPCSA) and other regulatory bodies; improving our website and services; responding to enquiries; and complying with legal obligations.

5. Lawful Basis for Processing

We rely on one or more of the following lawful grounds under POPIA: consent (where you have given us clear consent to process your or your child's information); contract (where processing is necessary to provide our services); legal obligation (where we are required by law to process information, such as HPCSA record-keeping requirements); and legitimate interest (where processing is necessary for our legitimate interests, provided these do not override your rights).

6. Special Personal Information

Given the nature of our services, we process health-related information about children. This constitutes special personal information under section 26 of POPIA. We process this information with the explicit consent of a parent or legal guardian, or where processing is necessary for the provision of healthcare services. Additional safeguards are in place to protect this information, including restricted access, encryption, and secure storage.

7. Children's Information

The CareJunction provides services to children, and we take the protection of children's personal information very seriously. In terms of section 35 of POPIA, we only process a child's personal information with the prior consent of a competent person (parent or legal guardian). We collect only the information necessary to provide our services effectively and safely. Access to children's records is strictly limited to authorised staff directly involved in the child's care and education.

8. Cookies and Website Tracking

Our website uses cookies and similar technologies. Essential cookies are used for site functionality and security (e.g. session management, CSRF protection) — these do not require consent. Analytics and marketing cookies (including Google Tag Manager and associated tools) are only activated after you have given your consent through our cookie consent banner. You can withdraw cookie consent at any time through the "Cookie settings" link in our website footer.

9. Sharing of Personal Information

We do not sell personal information. We may share personal information with: medical aid schemes (for claims processing, with your consent); referring practitioners and healthcare providers (with your consent and where clinically appropriate); regulatory bodies such as the HPCSA (where legally required); third-party service providers who assist us in operating our website and services, bound by appropriate data processing agreements; and law enforcement or government authorities where required by law.

Service providers we currently use

• Replit (website hosting)
• Neon (secure database)
• Google Cloud Storage (secure document storage)
• Resend (email delivery)
• Google (Tag Manager, analytics and advertising measurement, only with your consent; and Google Fonts)
• Meta and TikTok (advertising measurement, only with your marketing consent)
• WhatsApp (only when you choose to contact us through it)

10. Data Retention

We retain personal information only for as long as necessary to fulfil the purposes for which it was collected, or as required by law. Clinical and therapy records relating to a child are kept until the child's 21st birthday, and in all cases for at least six years after the last consultation, in line with HPCSA guidelines and the National Health Act. Financial records are retained as required by SARS and the Companies Act. Website enquiry data is retained for 12 months and then securely deleted, unless the enquiry leads to an ongoing relationship with The CareJunction.

11. Your Rights Under POPIA

You have the right to: request access to the personal information we hold about you or your child; request correction of inaccurate or incomplete information; request deletion of information (subject to legal retention requirements); object to the processing of your information on reasonable grounds; withdraw consent previously given (this does not affect the lawfulness of processing before withdrawal); and lodge a complaint with the Information Regulator if you believe your rights have been infringed. To exercise any of these rights, contact our Information Officer at info@thecarejunction.com. We will respond within a reasonable time, and in any event within 30 days.

12. Information Security

We take appropriate technical and organisational measures to protect personal information against unauthorised access, loss, destruction, or damage, including: encrypted data storage and transmission (HTTPS/TLS); role-based access controls limiting access to authorised personnel; CSRF protection and rate limiting on all forms; regular review of security practices; and staff training on data protection and confidentiality obligations.

13. Cross-Border Transfers

Our website and supporting systems are hosted by service providers outside South Africa, principally in the United States. Where personal information is transferred outside of South Africa, we ensure that the recipient is subject to a law, binding corporate rules, or a binding agreement that provides an adequate level of protection as required by section 72 of POPIA.

14. Changes to This Policy

We may update this Privacy Policy from time to time. The updated version will be published on our website with a revised effective date. Material changes will be communicated via our website or email where appropriate.

15. Contact Us

The CareJunction. Email: info@thecarejunction.com. Telephone: +27 83 276 9173. Address: Greenside, Johannesburg, South Africa.

Information Regulator (South Africa)

If you are not satisfied with our response, you may lodge a complaint with the Information Regulator. Email: inforeg@justice.gov.za. Website: https://inforegulator.org.za