Privacy Policy
Effective date: 7 November 2026
Introduction
Sandton Sport & Family Chiropractic ("we", "us" or "our") is the shared practice of Dr Matthew Proctor and Dr Kirsty Anley, chiropractors located at 3rd Floor, North Block, MediMix at 200 Rivonia, Morningside, Sandton. We are committed to protecting the privacy and personal information of our patients and website visitors.
Dr Proctor and Dr Anley each practise as a separate sole proprietor from the same premises. Each is the responsible party, as defined in POPIA, for the records of their own patients. Our website, online booking system (Cliniko) and other shared practice systems are operated jointly by both chiropractors, and this policy applies to both.
This privacy policy explains how we collect, use, store and share your personal information in accordance with the Protection of Personal Information Act, 2013 (POPIA). It applies to information collected through our practice, our website at sandtonchiropractor.co.za and any related communications.
What personal information we collect
Depending on how you interact with us, we may collect the following types of personal information:
- Contact and booking details: your name, date of birth, phone number, email address, physical address, emergency contact and anything you add in the booking notes
- Health and medical history: information about your current complaints, past medical history, medications, lifestyle factors and related health information
- Treatment records: clinical notes, examination findings, diagnoses, treatment plans and progress notes
- Billing information: medical aid details, account information and payment records
- Messages: what you send us through the contact form, by email or on WhatsApp
- Website usage data: anonymous page views and booking-step events, and the technical browser signals our security check uses to tell people from bots (see "Website analytics and security" below)
Why we collect your information
We collect and use your personal information for the following purposes:
- Providing chiropractic care, including assessment, diagnosis and treatment
- Managing appointments and communicating with you about your care
- Billing, invoicing and processing medical aid claims
- Communicating important practice information (such as appointment reminders)
- Improving our website and the services we offer
- Complying with our legal and professional obligations
Lawful basis for processing under POPIA
We process your personal information on one or more of the following lawful grounds as set out in sections 6 to 11 of POPIA:
- Consent: you have given us your consent to process your personal information for a specific purpose
- Contractual necessity: processing is necessary to carry out the agreement between you and our practice (for example, providing treatment you have requested)
- Legal obligation: processing is necessary to comply with a legal duty (for example, keeping patient records as required by the National Health Act, 2003 and the rules of the Allied Health Professions Council of South Africa)
- Legitimate interest: processing is necessary for our legitimate interests, provided your rights are not overridden (for example, improving our services)
Special personal information: health data
Health information is classified as "special personal information" under section 26 of POPIA and receives additional protection. We process your health information with your explicit consent and because it is necessary for the provision of healthcare services. This includes clinical assessments, diagnoses, treatment records and any related health data required to provide you with appropriate chiropractic care.
How we protect your information
We take reasonable steps to protect your personal information from unauthorised access, loss, misuse or alteration. Our security measures include:
- Physical security: patient files and records are stored securely within our practice with restricted access
- Electronic security: digital records are protected by password controls, encryption where appropriate and secure backup systems
- Staff awareness: our team is made aware of their obligations regarding the handling of personal information
Who we share your information with
We do not sell or trade your personal information. We may share your information with the following parties where necessary:
- Medical aid schemes: only if you ask us to, for example a detailed invoice or claim information
- Other healthcare practitioners: where you have been referred to or from another practitioner, with your consent
- Service providers (operators) who process information on our behalf:
- Cliniko (Red Guava Pty Ltd, Australia): our practice management system. It stores your patient file, clinical notes, appointments and invoices, receives your online booking and sends appointment confirmations and reminders by email and SMS.
- Vercel (Vercel Inc., USA): hosts this website and its booking system, and provides our anonymous website analytics.
- Cloudflare Turnstile (Cloudflare Inc., USA): checks that booking and contact form submissions come from a person, not a bot.
- Web3Forms: delivers messages sent through our contact form to our practice email.
- WhatsApp (WhatsApp LLC / Meta Platforms): carries messages when you contact us on WhatsApp, under WhatsApp's own privacy policy.
- Google: provides the map on our contact page and our practice email.
- Legal requirements: where we are required to disclose information by law, regulation or court order
Information sent outside South Africa
Some of our service providers store or process information outside South Africa. Cliniko stores patient records in Australia, and Vercel, Cloudflare, WhatsApp and Google process data in the United States and other countries. We only use providers that are bound by data protection laws or written agreements giving protection substantially similar to POPIA, as section 72 of POPIA requires. These transfers are also necessary to provide the booking, records and communication services you ask us for.
Website analytics and security
Our website uses Vercel Web Analytics to count page views and to see where people get stuck in online booking. Alongside page views, the booking system records anonymous events such as which booking step was reached, whether a booking succeeded and the type of error if it failed. These events never include your name, contact details, appointment details or health information. Vercel Web Analytics does not use cookies or track you across other websites. Visitors are counted using a short-lived identifier derived from the request, which is discarded within 24 hours.
Our booking and contact forms use Cloudflare Turnstile to block spam and automated abuse. Turnstile runs a background check that uses your IP address and technical information about your browser and device. It does not use advertising cookies and the information is used only for security.
We do not use Google Analytics, advertising cookies or tracking pixels.
Our contact page includes an embedded Google Map to help you find our practice. This embed is provided by Google and may set its own cookies on your device. These cookies are managed by Google, not by us. You can review Google's privacy policy at policies.google.com/privacy.
Your rights under POPIA
You have the following rights in relation to your personal information:
- Right to access: you may request confirmation of whether we hold personal information about you and request access to that information
- Right to correction: you may request that we correct or update inaccurate or incomplete personal information
- Right to deletion: you may request the deletion of your personal information, subject to legal retention requirements
- Right to object: you may object to the processing of your personal information in certain circumstances
- Right to withdraw consent: where processing is based on your consent, you may withdraw that consent at any time
- Right to opt out of marketing: if you agreed to receive practice news by email, SMS or WhatsApp, you can opt out at any time by replying STOP, using the unsubscribe link or contacting us. Appointment confirmations and reminders are not marketing and are sent as part of your care.
- Right to lodge a complaint: you may lodge a complaint with the Information Regulator if you believe your personal information has been mishandled
To exercise any of these rights, please contact us using the details below.
Data retention
We keep patient records for the minimum periods required by law and by the Allied Health Professions Council of South Africa, which for children extends at least until they turn 21. Other personal information is retained only for as long as necessary to fulfil the purposes for which it was collected or as required by law.
When personal information is no longer needed, we will securely delete or destroy it.
Information Regulator
If you are not satisfied with how we handle your personal information, you have the right to lodge a complaint with the Information Regulator (South Africa):
- Email: POPIAComplaints@inforegulator.org.za
- Telephone: 010 023 5200 or 0800 017 160 (toll free)
- Address: Woodmead North Office Park, 54 Maxwell Drive, Woodmead, Johannesburg, 2191
Contact us
If you have any questions about this privacy policy or wish to exercise your rights, please contact us. Each chiropractor is the Information Officer for their own practice and their own patients' records. Address your request to the chiropractor who treats you, or to either of them for questions about the website or booking system.
- Information Officers: Dr Matthew Proctor (for his patients) and Dr Kirsty Anley (for her patients)
- Email: admin@sandtonchiropractor.co.za
- Telephone: 011 656 1444
- Address: 3rd Floor, North Block, MediMix at 200 Rivonia, Morningside, Sandton
Changes to this policy
We may update this privacy policy from time to time to reflect changes in our practices or legal requirements. The updated version will be published on our website with a revised effective date. We encourage you to review this page periodically.