Privacy policy
How we look after your personal and health information, in line with the Protection of Personal Information Act (POPIA), the National Health Act and HPCSA guidance. This notice is given to you under section 18 of POPIA before we collect your information.
Who we are
Osler & Beukes Dietitians is a dietetic practice in South Africa providing online nutrition consultations. We are the responsible party for your personal information under the Protection of Personal Information Act 4 of 2013 (POPIA). Our Information Officer is the practising dietitian and can be reached at the email address below.
What we collect
Contact details, date of birth, sex, address, occupation, medical aid details, emergency contact, and health information you or your dietitian record: medical history, allergies, medication, measurements, food intake, consultation notes, care plans and meal plans. We collect this directly from you when you create an account, complete your details, or during consultations. We only collect what is relevant and not excessive for your care, as required by section 10 of POPIA.
Why we collect it, and whether you must provide it
We process your information only to provide, record and follow up your nutrition care, to invoice you, and to meet our legal and HPCSA record keeping duties. Providing your personal details is voluntary, but we cannot create your account or treat you online without them. Clinical details required for safe dietetic care are a condition of treatment: if you choose not to provide information your dietitian needs, we may be unable to offer you online consultations. The National Health Act and HPCSA rules require us to keep health records.
Health information is special personal information
Your health and nutrition information is special personal information under sections 26 and 27 of POPIA. We process it with your consent and because it is necessary for your treatment by a healthcare professional, as permitted by section 32. Everyone who handles your information is bound by confidentiality.
Children
We do not create online accounts for anyone under 18. Where a child receives dietetic care, a parent or legal guardian must hold the account, record their details and give consent on the child's behalf in the account, as required by section 35 of POPIA. The date and time of guardian consent is recorded.
Who can see it
Only your treating dietitian and you, through your own account. You only see what your dietitian shares with you. We share information with another healthcare provider, such as your doctor, only with your permission or where the law requires it. Our service providers (hosting, email and booking) act as operators under section 21 of POPIA: they may only process your information on our instructions, must keep it confidential, and must tell us immediately if they suspect unauthorised access.
Where it is stored
Your information is stored with a secure cloud provider whose servers may be outside South Africa. We only use providers bound by law, binding corporate rules or binding agreements that offer protection substantially similar to POPIA, as required by section 72. Data is encrypted in transit and at rest.
How we protect it
In line with section 19 of POPIA we identify foreseeable risks and maintain safeguards against them: access is restricted by account and role so patients can only ever see their own records; every change to a clinical record is logged with who made it and when, and that log cannot be edited; accounts sign out automatically after a period of inactivity; and passwords found in known data breaches are rejected. We review these measures regularly and update them as risks change.
How long we keep it
Clinical records are kept for at least six years after your last consultation, or longer for minors (until age 21) and where the law requires, in line with HPCSA guidance. POPIA section 14 allows this where retention is required by law. After the retention period, records are securely destroyed.
Your rights
Under sections 23, 24 and 25 of POPIA you may: ask us, free of charge, to confirm whether we hold your personal information; request a copy or description of your records in an understandable form; ask us to correct or delete information that is inaccurate, irrelevant, out of date or no longer needed; and object to processing or withdraw consent at any time. Withdrawing consent does not affect records we must legally keep. Signed in patients can download their records instantly and send access, correction, objection, withdrawal or account closure requests from the privacy section of their account; we aim to respond within 30 days. You may also contact our Information Officer directly or use the prescribed forms (Form 1 for objections, Form 2 for corrections) on the Information Regulator's website. If we cannot agree on a correction, we will attach a note to your record showing that you requested one.
Cookies and local storage
We do not use advertising, tracking or analytics cookies. The site only stores what is strictly necessary to keep you signed in securely on your device. If this ever changes, we will ask for your consent first.
Changes to this policy
This policy was last updated on 9 October 2026. When we make material changes, signed in patients are asked to read and accept the new version, and the date and time of acceptance is recorded.
Direct marketing
We do not send marketing messages. If we ever wish to, we will only do so with your opt in consent as required by section 69 of POPIA, and every message will include a simple way to opt out.
If something goes wrong
If we have reasonable grounds to believe your information has been accessed by an unauthorised person, we will notify the Information Regulator as soon as reasonably possible and inform you directly, as required by section 22 of POPIA. Our notification will explain what happened, the possible consequences, what we have done about it, and what you can do to protect yourself.
Complaints
If you are unhappy with how we handle your information, please contact us first. You also have the right to lodge a complaint with the Information Regulator (South Africa): JD House, 27 Stiemens Street, Braamfontein, Johannesburg, 2001; enquiries@inforegulator.org.za; www.inforegulator.org.za.
Questions, access or correction requests? Email our Information Officer at smartbitenutritionco@gmail.com or read our online consultation policy.