Privacy & POPIA

Who we are

NovelMed (Pty) Ltd is the controller of personal information processed in connection with our Injury on Duty (IOD) services. Our Information Officer and primary data contact is:

Information Officer
NovelMed (Data Protection Office)
Email: info@novelmed.co.za
Phone: +27 12 880 5640
Address: Building 2, Walker Creek Office Park, 90 Florence Ribeiro Ave, Brooklyn, Pretoria

Note: This policy should be reviewed by a POPIA-compliant legal adviser to ensure it fully reflects NovelMed's processing activities and regulatory obligations.

What personal information we collect

We collect only the personal information necessary to provide and administer IOD services. This may include:

• Identity and contact details: name, date of birth, ID number, postal and email addresses, telephone numbers;
• Employment and employer details: employer name, department, employee number and occupational role;
• Case and claims information: incident reports, referral forms, clinical notes, diagnostic and treatment information supplied by treating clinicians;
• Payment and financial information: banking or invoice details where required for billing or reimbursements;
• Technical information: IP address, device and browser information, cookies and usage logs for site operation and analytics.

Why we collect personal information

We process personal information to:

• Provide and manage IOD referrals, clinical coordination and claim administration;
• Communicate with claimants, employers, treating clinicians and funders about claims and case progress;
• Fulfil contractual and legal obligations, including regulatory reporting and auditing;
• Improve our services, undertake analytics and detect fraud or misuse of systems.

Under POPIA, our lawful bases for processing include consent, performance of a contract or service, compliance with legal obligations, and legitimate interests where appropriate (subject to balancing tests and safeguards for special personal information such as health data).

How we store and protect information

We implement appropriate technical and organisational measures to protect personal information, including but not limited to:

• Access controls and role-based permissions for systems that store personal data;
• Encryption in transit (TLS) and encryption at rest where technically appropriate;
• Regular backups, vulnerability management and periodic security reviews;
• Contractual controls and due diligence when working with third-party service providers.

Only authorised personnel who need access to perform their duties will be granted access to personal information.

Who we share personal information with

We may share personal information with:

• Employers and claim funders for the purpose of processing and settling claims;
• Treating clinicians and other healthcare providers involved in case management;
• Third-party service providers who perform services on our behalf (for example, secure data hosting, analytics or payment processors) under written contracts that require them to protect personal data;
• Regulatory bodies, auditors or courts where required by law or to protect our legal rights.

We will not sell personal information to third parties.

International transfers

If personal information is transferred outside South Africa, we will ensure appropriate safeguards are in place (for example, contractual clauses, binding corporate rules or other legally recognised protections) to preserve the protections required by POPIA.

Retention of personal information

We retain personal information only for as long as necessary to fulfil the purposes for which it was collected, to meet legal and regulatory obligations (including record-keeping for claims and medical information), or to resolve disputes. Specific retention periods are determined by the nature of the information and applicable law. If you require details of retention periods that apply to your information, contact our Information Officer at info@novelmed.co.za.

Your rights under POPIA

Subject to legal limitations and exemptions, data subjects have the following rights:

• Right to access — request confirmation and a copy of personal information we hold about you;
• Right to rectification — request correction of inaccurate or incomplete information;
• Right to deletion — request deletion of personal information where retention is no longer necessary and not required by law;
• Right to object or restrict processing — in certain circumstances you may object to or ask us to restrict processing;
• Right to withdrawal of consent — where processing is based on consent, you may withdraw consent (this will not affect processing carried out prior to withdrawal);
• Right to data portability — request a copy of your personal information in a commonly used, machine-readable format where technically feasible.

To exercise any of these rights, contact our Information Officer at info@novelmed.co.za. We will respond to requests in accordance with POPIA and applicable timelines.

How to lodge a complaint

If you have a complaint about our handling of personal information, please contact our Information Officer first so we can attempt to resolve it:

Information Officer
Email: info@novelmed.co.za
Phone: +27 12 880 5640

If you remain dissatisfied, you may lodge a complaint with the South African Information Regulator. Further information and contact details are available at: https://inforegulator.org.za.

Cookies and website tracking

Our website uses cookies and similar technologies for essential site functionality, analytics and performance. You may control or block cookies using your browser settings; doing so may affect site functionality. For analytics we may use third-party providers who process pseudonymised usage data. Please contact us if you need details of the specific tracking technologies in use.

Changes to this policy

We may update this policy from time to time. When we make material changes we will update the "Last updated" date above and, where appropriate, notify affected data subjects.