PRIVACY POLICY

Last updated: 6 October 2026

About this policy

Lucy Ferrao — Tokai Physio respects your privacy. This policy explains how we handle personal information when you visit our website, submit an enquiry or contact the practice. It is intended to be read in accordance with South Africa’s Protection of Personal Information Act, 2013 (POPIA). Clinical care and patient records are subject to applicable healthcare confidentiality and record-keeping requirements. Contact the practice for details of its record-handling arrangements.

Who to contact

For privacy enquiries or requests concerning your personal information, email team@tokaiphysio.co.za or use the practice contact details below. Your request will be directed to the person responsible for handling privacy matters.

Information we collect

Our website enquiry form collects your name, contact number, email address and enquiry type. We also receive information you choose to provide by email or telephone. Website hosting and form systems may record technical information such as your IP address, browser details, submission date and security logs. Please avoid sending medical records, identity documents or detailed health information through the general website enquiry form.

How we use your information

We use enquiry information to respond to you, discuss services, arrange appointments and maintain a record of our correspondence. Technical information is used to operate, maintain and protect the website and prevent spam or misuse. We process information where necessary to respond to your request, take steps towards providing services, meet legal obligations, or pursue legitimate interests permitted by POPIA. Where consent is required, we will request it separately.

Providing information and marketing

Submitting an enquiry is voluntary. The form’s required contact fields allow us to identify your request and respond; without them, we may be unable to assist through the form. An appointment request does not confirm a booking. Submitting an enquiry does not subscribe you to marketing. Any electronic direct marketing will be handled in accordance with applicable consent and opt-out requirements.

Who receives your information

Authorised practice personnel may access enquiries. Website form submissions are stored in WordPress using Gravity Forms and sent to the practice’s notification mailbox at info@lucyferrao.co.za. Website hosting, email and technical support providers may process information as needed to provide their services, under appropriate confidentiality and security arrangements. Information may also be disclosed where legally required. We do not sell your personal information.

Storage and transfers

Enquiry information may be held in the website database, email systems and backups. Where a service provider processes information outside South Africa, any transfer must satisfy the applicable requirements of POPIA, including appropriate protection for the information. You may contact us for further information about the providers involved in processing your enquiry.

How long we retain information

We retain personal information for as long as reasonably necessary to deal with your enquiry, maintain appropriate business records and meet applicable legal or professional obligations. When it is no longer needed, information should be securely deleted or de-identified, subject to backup cycles and lawful retention requirements. Patient record retention is governed separately by applicable healthcare requirements. A practice-specific retention schedule is not published on this website; contact the practice for information about your records.

Security

We take reasonable organisational and technical steps to protect personal information against unauthorised access, loss or misuse. No website or email system can guarantee absolute security. If a security compromise occurs, we will assess it and follow applicable notification obligations.

Cookies and external links

WordPress may use cookies required for site operation and administrator sign-in. Your browser settings allow you to manage or delete cookies, although this may affect some functions. This policy does not authorise advertising or analytics tracking; if such tools are introduced, the notice and any required consent controls will be updated. External websites linked from this site have their own privacy practices.

Your privacy rights

Subject to POPIA and applicable limitations, you may ask whether we hold personal information about you, request access, ask for correction or deletion, object to certain processing, or withdraw consent where processing relies on consent. Withdrawal does not affect processing lawfully carried out beforehand. We may need to verify your identity before responding. Contact the practice using the details below to exercise these rights.

Complaints

Please contact us if you have a privacy concern. You may also lodge a complaint with South Africa’s Information Regulator. Visit inforegulator.org.za/complaints/ for the current complaint procedure, or email POPIAComplaints@inforegulator.org.za.

Changes to this policy

We may update this policy when our website or information practices change. The latest version will be published on this page.

Patient confidentiality

Clinical information is confidential. Disclosure requires appropriate patient authorisation or a lawful exception, such as a statutory duty, court order or serious public-health threat. Only relevant information should be shared. Confidentiality continues after care ends and after death. Family members, employers and insurers do not automatically have access.

Clinical record retention

The following describes HPCSA guidance, rather than a confirmed practice-specific retention schedule. Contact the practice about the retention period applicable to your records. HPCSA Booklet 9 recommends indefinite retention where practical; otherwise, at least six years after the last treatment. Children’s records should be retained at least until age 21, while also considering the general minimum. Longer periods apply to certain cases, including patients lacking mental capacity, occupational-health records and legal obligations. Clinical records must not be deleted solely because website consent is withdrawn.

Patient photographs and publicity

Clinical photography and public use of patient material are separate matters. HPCSA guidance requires written informed consent for public disclosure of patient photographs or case information, subject to justified exceptions. For minors, applicable parent or guardian consent and the child’s assent must be considered. A website enquiry does not grant permission for publicity.

Professional guidance

These provisions draw on HPCSA patient-record guidance and its ethical guidelines. This page is not an HPCSA certification of the practice.

Website services and communications

The practice does not currently offer telehealth or use WhatsApp for patient communications, patient photos or videos, newsletters or website analytics. Website forms are for general enquiries and appointment requests. If these arrangements change, the relevant notices and consent processes will need to be updated.

Practice contact details

Telephone: +27 83 260 3247
Address: Tokai Medicross, C/o Tokai Rd & Keyse River Dr,
Dreyersdal, Cape Town, 7945
Email: team@tokaiphysio.co.za
Website: www.tokaiphysio.co.za