LEGAL
Privacy Notice
Website visitors and patients
Version 2.0 · 1 October 2026
This notice explains how the practice collects, uses, shares and protects personal information,
and what rights you have. It is given in accordance with section 18 of the Protection of Personal
Information Act 4 of 2013 (POPIA).
It is in three parts. Part A applies to anyone visiting the website or making an enquiry. Part B
applies to patients, and covers health information. Part C applies to both.
Who is responsible for your information
-
Responsible party: The Psychology Collective (by Teneal Burger Psychology), 3 Breda Street,
Gardens, Cape Town, 8001 -
Information Officer: Teneal Burger, contactable through the Contact page of this website
-
Information Regulator (South Africa): complaints.IR@inforegulator.org.za · inforegulator.org.za ·
010 023 5200
Part A Website visitors and enquiries
A1 What we collect
-
Information you give us through the booking or contact form: your name, email address, telephone
number, and what you tell us about why you are making contact. -
Technical information collected automatically: IP address, device and browser type, pages visited,
and the date, time and duration of your visit.
We ask you not to include clinical detail or sensitive personal information in a website form or in email.
Neither channel is secure, and we do not need that information before your first appointment.
A2 Why we collect it, and on what basis
We use enquiry information to respond to you, to arrange an appointment and to keep a record of the
arrangement. Section 11(1) of POPIA permits this because it is necessary to conclude or perform a
contract with you and because you have provided the information for that purpose. We use technical
information to keep the site secure and working, and to understand in aggregate how it is used.
A3 Cookies and analytics
A3.1 The website is built on the Wix platform. It uses cookies that are strictly necessary for the site to
function and to keep it secure, and — subject to your choice — cookies for analytics and
functionality.
A3.2 Non-essential cookies are set only where you have accepted them through the cookie banner. You
can change your choice at any time through the banner or your browser settings. Refusing non-
essential cookies does not prevent you using the site.
A3.3 We do not use cookies to build advertising profiles, and we do not permit third parties to use cookies
on this site for their own advertising purposes.
A4 Who we share it with
Enquiry information is shared only with service providers that process it on our written instruction and
under a confidentiality obligation — currently Wix, as website and forms provider, Google as email and
calendar provider. These are operators under POPIA. They may not use your information for their own
purposes.
We do not sell your information. We do not share it with business partners, affiliates or advertisers, and
there is no facility on the site through which other users can see it.
A5 Information sent outside South Africa
Some of our service providers store information on servers outside South Africa. Section 72 of POPIA
permits this where the recipient is subject to a law or binding agreement providing protection substantially
similar to POPIA. We rely on the contractual data protection terms in our agreement with each provider
and adequacy of the receiving jurisdiction.
A6 How long we keep it
Enquiry information that does not lead to an appointment is deleted after 12 months. Where an
appointment follows, the information becomes part of your clinical record and Part B applies. Technical
and analytics information is retained for 14 months in aggregated form.
A7 Marketing
We do not send unsolicited electronic marketing. Where we send you information about the practice, it is
because you have specifically asked to receive it, and every message includes a way to stop. This
reflects section 69 of POPIA and the HPCSA’s rules restricting the advertising and canvassing of
professional services.
A8 Children
Under POPIA a child is a person under 18. We do not knowingly collect a child’s personal information
through this website. Enquiries about a child should be made by a parent or guardian. Where a child is
treated by the practice, consent is dealt with under the Children’s Act 38 of 2005 and is addressed in the
separate child and adolescent consent documents.
Part B Patients
B1 What we hold
-
Identifying and contact information: name, identity number, date of birth, address, telephone
number, email address, medical scheme details, and an emergency contact. -
Clinical information: presenting difficulties, relevant history, session notes, assessment results,
treatment plans, and correspondence with other treating professionals. -
Financial information: invoices, receipts and payment records.
B2 Health information is specially protected
Information about your physical or mental health is “special personal information” under section 26 of
POPIA, and its processing is prohibited unless an exception applies. Section 32(1)(a) permits processing
by a health practitioner where this is necessary for the proper treatment and care of the patient. That is
the basis on which we hold your clinical record. Section 14 of the National Health Act 61 of 2003 and the
HPCSA’s Ethical Rules impose a parallel duty of confidentiality.
B3 What we use it for
To assess and treat you; to keep the clinical records a health practitioner is required to keep; to
communicate with you about appointments; to bill you and recover fees; to obtain clinical supervision and
consultation; and to comply with legal obligations. We do not use it for any other purpose without your
consent.
B4 Who has access
B4.1 Your clinical record is accessed by your treating psychologist. Our appointed administrative or billing
personnel has access to your contact and account information but not to clinical notes, and is
bound by a written confidentiality undertaking.
B4.2 Where your psychologist consults a supervisor or peer about the clinical work — which registered
practitioners are expected to do — identifying detail is minimised, and the person consulted is
themselves bound by confidentiality.
B4.3 Our operators process information on our written instruction only: Wix, Google, Apple (iCloud),
Zoom, HealthBridge, and Yoco. Some store information outside South Africa — see A5.
B5 When we disclose information
The circumstances in which your information may be disclosed — including the mandatory reporting
duties under the Children’s Act, the Criminal Law (Sexual Offences and Related Matters) Amendment
Act, the Older Persons Act and the Prevention and Combating of Trafficking in Persons Act, and
disclosure where there is a real and imminent risk to your life or to another identifiable person — are set
out in full in clause 10 of the Service Agreement and Informed Consent. Please read that clause; it is the
substance of what confidentiality does and does not cover.
All other disclosure occurs only with your specific written consent, which you may withdraw at any time.
B6 How we keep it safe
We take the measures section 19 of POPIA requires, which currently include: encryption of electronic
records at rest and in transit; individual access credentials and multi-factor authentication; encrypted,
separately held backups; screen locking; and a written confidentiality undertaking from anyone with access.
No system is wholly secure, and we do not claim otherwise — but where a compromise affecting your
personal information occurs, we will notify the Information Regulator and you, as section 22 requires,
and will tell you what has happened and what you can do about it.
B7 How long we keep it
B7.1 In line with the HPCSA’s Guidelines on the Keeping of Patient Records (Booklet 9), clinical records
are retained for at least six years from the date the record becomes dormant, that is, from your
last consultation.
B7.2 Records of patients who were under 18 at the time of treatment are retained at least until their 21st
birthday, because a minor has three years after turning 18 in which to bring a claim. Records of
patients who were mentally incapacitated are retained for the duration of their lifetime.
B7.3 Financial records are retained for five years under the Tax Administration Act 28 of 2011.
B7.4 At the end of the retention period records are securely destroyed — paper by shredding, electronic
records by secure deletion.
B8 Your rights, and their limits
Under POPIA and the Promotion of Access to Information Act 2 of 2000 you may ask what we hold about
you and request access to it; request correction or deletion of information that is inaccurate, irrelevant,
excessive, out of date, incomplete, misleading or unlawfully obtained; object to processing on reasonable
grounds; withdraw a consent you have given, where processing rests on consent; and complain to the
Information Regulator.
Two limits are worth stating plainly:
-
We generally cannot delete a clinical record on request. The retention periods in B7 are
professional and legal obligations, and they override a deletion request. We can correct inaccurate
information, and we can add your own statement to the record where we disagree about a correction. -
Access to a clinical record can be limited in the narrow circumstances contemplated by section
14 of the National Health Act and section 63 of PAIA — principally where disclosure would cause
serious harm to your health. Where we limit access we will tell you why, and will normally offer a
summary or a supported disclosure through another practitioner instead.
To exercise a right, write to the Information Officer. We respond within 30 days. Where a request falls
under PAIA, the prescribed form and fee apply.
Part C General
C1 Links. This site links to other websites we do not control. We are not responsible for their privacy
practices.
C2 Legal compulsion. We may disclose personal information where the law requires it, or in response to
a valid court order or subpoena. Where possible we will tell you, and we will disclose the
minimum required.
C3 Changes. We may update this notice. Material changes will be posted here with a new effective date
before they take effect, and existing patients will be told directly.
C4 Questions and complaints. Write to the Information Officer through the Contact page of this website.
If we cannot resolve the matter, you may complain to the Information Regulator using the contact
details at the top of this notice.
In a crisis
If you need help now, contact SADAG on 0800 567 567, or your nearest emergency room.
The Psychology Collective is the trading name of Teneal Burger Psychology, a private clinical psychology practice registered with the Health Professions Council of South Africa and the Board of Healthcare Funders.
Practice no. PR 119 480 1
Teneal Burger — Clinical Psychologist — HPCSA PS 0 156 833
Khanyisile Thusi — Clinical Psychologist — HPCSA PS 0 162 361