PAIA Manual - NetPractice

Version 2.0 · effective 15 September 2026. Prepared in terms of section 51 of the Promotion of Access to Information Act 2 of 2000 ("PAIA"). Supersedes the manual dated 22 December 2021.

Netpractice (Pty) Ltd is a private body under PAIA. This manual tells you what records we hold, how to ask for access to them, what it costs, and what to do if we say no. It also describes how we process personal information, as POPIA requires a manual to do.

1. Who we are and how to reach us

Organisation	Netpractice (Pty) Ltd
Registration number	2012/072246/07
What we do	We provide online practice management, medical billing, and claim submission software to registered healthcare practices in South Africa.
Information Officer	Mpatle Ditabo
Email	privacy@netpractice.co.za
Telephone	021 403 6358
Physical and postal address	Dock Road Junction, Corner Stanley & Dock Road, V&A Waterfront, Cape Town, 8001
Website	www.netpractice.co.za

Please contact us by email wherever possible. It is the fastest route and it gives both of us a record of the request.

2. The Information Regulator's PAIA guide

The Information Regulator has published a guide, in each official language, on how to use PAIA. You can get it from the Regulator:

Website	inforegulator.org.za
Physical address	JD House, 27 Stiemens Street, Braamfontein, Johannesburg, 2001
Postal address	P.O. Box 31533, Braamfontein, Johannesburg, 2017
Telephone	010 023 5200
General enquiries	enquiries@inforegulator.org.za
PAIA complaints	PAIAComplaints@inforegulator.org.za

3. Records we make available without a request

We have not published a notice under section 52(2) of PAIA. The following records are nevertheless available without a formal PAIA request:

Our Terms of Service, Privacy Policy, and Operator Agreement, including superseded versions on request.
This manual.
Product information, pricing, and support material published on our website.
Company registration details, directors, and our memorandum of incorporation, available from the CIPC via BizPortal.
For our customers: your own practice's data held in the Service, which you can export at any time from within the product or by asking us.

4. Records we hold

You may request access to the records below. Listing a record here does not mean we will grant access to it - the grounds for refusal in section 7 of this manual apply.

Customer and practice records

Subscription and account records for practices using the Service, including registration details and the version of our Terms each practice accepted.
Invoices, statements, receipts, payment allocations, and credit records.
Support correspondence, tickets, and call records.

Data held in the Service on behalf of practices

Patient demographic, clinical, and billing records entered by a practice.
Claims submitted to medical schemes and the responses received.

Important. We hold these records as an Operator for the practice concerned, not as the Responsible Party. We cannot give a third party access to a practice's patient records. If you are a patient, direct your request to your practice. See section 9.

Company and statutory records

Memorandum of incorporation, share register, and statutory registers.
Minutes and written resolutions of directors and shareholders.
Records of the appointment of directors, auditors, and officers.

Financial and tax records

Annual financial statements, management accounts, and audit records.
Accounting records, banking records, and asset registers.
VAT, PAYE, income tax, and other returns and assessments.

Personnel records

Employment contracts, personnel files, payroll and benefit records.
Disciplinary and performance records.
Skills development, employment equity, and health and safety records.

Supplier, partner, and operational records

Contracts with suppliers, sub-operators, resellers, and partners.
Insurance policies and claims.
Internal policies, including our information security and data protection policies.
Technical and system records, including access logs and audit trails.

Records we hold because the law requires it

Records kept under, among others, the Companies Act 71 of 2008, the Income Tax Act 58 of 1962, the Value-Added Tax Act 89 of 1991, the Tax Administration Act 28 of 2011, the Basic Conditions of Employment Act 75 of 1997, the Labour Relations Act 66 of 1995, the Employment Equity Act 55 of 1998, the Compensation for Occupational Injuries and Diseases Act 130 of 1993, the Unemployment Insurance Act 63 of 2001, the Electronic Communications and Transactions Act 25 of 2002, the Consumer Protection Act 68 of 2008, POPIA, and PAIA.

5. How to request access

5.1. Use Form 2 ("Request for Access to Record", prescribed by Regulation 7 of the PAIA regulations). You can download it from the Information Regulator's website at inforegulator.org.za, or ask us and we will email it to you.

5.2. Send the completed form to privacy@netpractice.co.za, or by post to the address in section 1.

5.3. Your request must:

give enough detail about the record for us to identify it;
give the form of access you want, and an address or email at which we can reach you;
identify the right you are seeking to exercise or protect, and explain why the record is required to exercise or protect it;
if you are asking on someone else's behalf, include proof of your authority to do so.

5.4. We will respond within 30 days of receiving the request. We may extend that period by a further 30 days where the request is for a large number of records or requires a search through records held elsewhere; if we do, we will tell you in writing and explain why.

5.5. We will tell you our decision in writing, and if we refuse, we will give reasons and explain your remedies.

6. What it costs

6.1. PAIA allows a private body to charge a request fee and an access fee. The amounts are prescribed in the PAIA regulations, not set by us.

6.2. We will send you the current prescribed schedule together with a quote before doing any work that attracts a fee. You do not incur a fee without being told first.

6.3. A request fee is not payable by a personal requester - someone asking for a record about themselves.

6.4. Where the fee exceeds the prescribed threshold we may ask for a deposit before processing the request, and we may withhold the record until the balance is paid.

6.5. Customers of the Service do not pay a fee for a copy of their own practice's data or their own agreement documents. Just ask us.

7. When we may refuse

PAIA obliges us to refuse a request in some circumstances and permits it in others. The grounds that most often apply to us are:

Someone else's privacy (section 63). We must refuse access to a record that would unreasonably disclose personal information about a third party, including our employees and the patients of our customers.
Commercial information of a third party (section 64). Trade secrets, financial or commercial information, or information supplied in confidence whose disclosure could harm a third party's commercial or negotiating position.
Our own commercial information (section 68). Our trade secrets and confidential commercial information, including the design of our software.
Confidential information held for a third party (section 65), where disclosure would breach a duty of confidence.
Safety of individuals and protection of property (section 66), including records whose disclosure would prejudice the security of our systems or our customers' data.
Legally privileged records (section 67).
Research information (section 69), ours or a third party's, where disclosure would expose the researcher or the subject matter to serious disadvantage.

We will grant access where PAIA requires it despite one of these grounds - for example, in the public interest under section 70.

8. If we refuse

8.1. There is no internal appeal against a decision of a private body.

8.2. You may lodge a complaint with the Information Regulator under section 77A of PAIA, within 180 days of the decision, using the prescribed form. Contact details are in section 2.

8.3. You may also apply to court under section 78 of PAIA for appropriate relief, within 180 days of the decision.

9. How we process personal information

Our Privacy Policy is the full description of how we process personal information and is part of this manual. In summary:

Whose information we process

Customers - the practices, practitioners, and staff who use the Service.
Prospective customers who contact us or ask for a demonstration.
Patients of our customers, whose information we process as an Operator on the practice's instruction.
Our own employees, contractors, and job applicants.
Suppliers, sub-operators, partners, directors, and shareholders.

Why we process it

To provide, support, and improve the Service.
To submit claims to medical schemes on a practice's instruction.
To invoice our customers and collect payment.
To communicate with customers about their account and the Service.
To employ and manage our own staff.
To manage supplier and partner relationships.
To comply with our legal, tax, and regulatory obligations.
To market our own products to prospective customers, subject to their right to object.

What categories we process

Identifying and contact details: names, identity or passport numbers, dates of birth, addresses, telephone numbers, email addresses.
Professional details: HPCSA and practice numbers, qualifications.
Health information, as an Operator for a practice: diagnosis and procedure codes, consultation notes, and related clinical detail. This is Special Personal Information under section 26 of POPIA.
Medical scheme membership and dependant details.
Account, billing, banking, and payment information.
Employment information about our own staff.
Technical information: IP addresses, device and browser details, and access logs.

We do not process biometric information, and we do not process information about religious or philosophical beliefs, race or ethnic origin, trade union membership, or political persuasion.

Who we give it to

Our sub-operators, each named in the Privacy Policy along with what it does and where it processes. On a practice's instruction, the medical schemes and scheme administrators being claimed against, reached through the switching providers we currently use - MediLink, Allegra, SwitchOn, and a direct connection to Metropolitan Health. Our professional advisors. And regulators or law enforcement where the law requires.

Transfers outside South Africa

Patient information is hosted primarily in South Africa. Some sub-operators process information outside the Republic, and we transfer it only on a basis permitted by section 72 of POPIA. The sub-operator table in the Privacy Policy names the locations.

Security

We take appropriate, reasonable technical and organisational measures to secure personal information, as required by section 19 of POPIA. These are described in section 6 of our Operator Agreement.

Your POPIA rights

You may ask us to confirm what personal information we hold about you, to correct or delete it, or to object to its processing. Write to privacy@netpractice.co.za. If you are dissatisfied with our response you may complain to the Information Regulator. Section 13 of the Privacy Policy sets this out in full.

If you are a patient of a practice that uses Netpractice, that practice is the Responsible Party for your records. Send your request to the practice. If you send it to us, we will refer it to the practice and support them in answering it.

10. Availability of this manual

This manual is available:

on this website, at netpractice.co.za/paia-manual;
by email on request from privacy@netpractice.co.za;
for inspection at our offices during business hours; and
to the Information Regulator on request.

To keep a copy, print this page to PDF from your browser.

11. Updates

We review this manual at least annually and whenever our processing or the law changes materially. Each version carries a version number and effective date.

Version	Effective	Note
2.0	15 September 2026	Rewritten for Netpractice. Replaces the generic 2021 PDF template, corrects the record categories to what we actually hold, names the Information Officer, and aligns the POPIA section with the Privacy Policy and Operator Agreement.
1.0	22 December 2021	Original manual, issued as a PDF. Available on request from privacy@netpractice.co.za.