Privacy & POPIA

Placeholder Notice

This document is a placeholder privacy policy and POPIA notice intended to summarise the way Novelmed collects, processes and protects personal information in connection with Injury on Duty (IOD) services. Replace this text with the final legal copy provided by your legal team before publication.

Data We Collect

We collect only the personal data necessary to provide and manage IOD services and related communications. This may include:

• Contact details: names, email addresses, telephone numbers
• Organisation details: employer name, department and contact person
• Case-related documents: incident reports, referral forms, correspondence
• Limited medical details: diagnosis, treatment and fitness-for-work information necessary to process IOD claims (only when provided by a treating clinician)
• Technical and usage data: IP address, device and browser information, logs to support service operation

How We Use Your Information

Personal information is used to:

• Process and manage IOD referrals and claims
• Communicate with claimants, employers and treating clinicians
• Provide reports, dashboards and regulatory submissions where required
• Improve our services, perform analytics and detect fraud or misuse

Your Rights

You have rights in relation to your personal information, subject to applicable legal and regulatory retention obligations. These rights include:

• Right to access — request a copy of personal information we hold about you.
• Right to rectification — request correction of inaccurate or incomplete information.
• Right to deletion — request deletion where retention is not required by law or regulation.
• Right to restrict or object — in certain circumstances, request restriction of processing or object to processing.

Requests will be handled in accordance with POPIA and other applicable laws; some requests may be limited where we are required to retain records for compliance, audit or legal reasons.

POPIA Notice

We process personal information in line with the Protection of Personal Information Act (POPIA). Processing is necessary for the performance of our services, for compliance with legal obligations and where you have provided consent. We implement appropriate technical and organisational measures to protect personal information and maintain records of processing activities.

For POPIA-related enquiries, to exercise your rights, or to lodge a complaint, please contact our Data Protection Officer at info@novelmed.co.za.

Security and Data Retention

We implement security controls including encryption in transit and at rest, access controls, logging and periodic audits. Personal information will be retained only for as long as necessary to fulfil the purposes for which it was collected, or to meet legal and regulatory obligations (for example, statutory retention periods for medical or claims records).

Lawful Basis for Processing

We rely on lawful bases including consent, performance of a contract or service, compliance with legal obligations, and legitimate interests where appropriate. For special categories of medical information, processing will generally be carried out in compliance with applicable health data laws and POPIA safeguards.

International Transfers

Where data is transferred outside South Africa, we will ensure appropriate safeguards are in place (such as standard contractual clauses or equivalent protections) to protect personal information in accordance with POPIA.

Changes to This Policy

We may update this policy from time to time. The latest version will be published here with an updated "Last updated" date.