Martina Johannes Physiotherapist, trading as Move With Martina (referred to in this document as “the Practice”, “we”, “us”, or “our”), is deeply committed to protecting your privacy and ensuring that your personal and medical information is collected, processed, and stored with the highest level of care. We operate a clinical physical therapy practice and a movement studio located at 202 Wanda Road, Murrayfield, Pretoria. Because we handle highly sensitive health information alongside standard business data, we hold ourselves to rigorous ethical and legal standards regarding data protection.
This Privacy Policy explains exactly how we obtain, use, share, and protect your personal data when you visit our website, book a consultation, participate in our Myofascial Activated Posture (MAP) movement classes, or communicate with us in any way. By interacting with the Practice, you agree to the practices detailed in this document. It is your responsibility to read this policy carefully to understand how your data will be treated.
Our data processing activities are strictly governed by the laws of the Republic of South Africa. We adhere entirely to the following primary pieces of legislation and regulatory guidelines:
The Protection of Personal Information Act No. 4 of 2013 (POPIA): This is the primary data protection law in South Africa, which regulates how personal information may be processed and outlines the strict conditions for lawful processing.
The National Health Act No. 61 of 2003: This act sets out the rules regarding the confidentiality of health records and the specific timelines required for the retention of medical files.
The Electronic Communications and Transactions Act No. 25 of 2002 (ECTA): This act governs electronic communications, online transactions, and consumer rights online.
The Promotion of Access to Information Act No. 2 of 2000 (PAIA): This act grants individuals the right to access records held by public and private bodies.
Health Professions Council of South Africa (HPCSA) Ethical Guidelines: As a registered physiotherapy practice, we are bound by the HPCSA’s strict rules regarding patient confidentiality, informed consent, and the ethical handling of medical records.
To ensure clarity throughout this Privacy Policy, the following terms are defined in accordance with POPIA:
“Personal Information” means information relating to an identifiable, living, natural person, and where it is applicable, an identifiable, existing juristic person. This includes, but is not limited to, names, contact details, identification numbers, and location data.
“Special Personal Information” is a highly protected sub-category of personal information under POPIA. It includes details concerning a person’s religious beliefs, race, ethnic origin, trade union membership, political persuasion, health, sex life, or biometric information. In our context, this primarily refers to your medical history and clinical records.
“Data Subject” refers to the person to whom the personal information relates. In the context of this policy, you—whether as a patient, a class participant, or a website visitor—are the data subject.
“Processing” means any operation or activity, whether or not by automatic means, concerning personal information. This includes the collection, receipt, recording, organisation, collation, storage, updating, modification, retrieval, alteration, consultation, or use of the data.
“Information Officer” refers to the person responsible for ensuring that the Practice complies with the conditions for the lawful processing of personal information.
To provide effective clinical care and safely guide your movement classes, we must collect and maintain a detailed record of your information. We limit our collection to the exact data required to fulfil our professional duties. The categories of information we collect include:
First name, maiden name, last name, and title.
South African Identity Document (ID) number or passport number.
Date of birth, age, and gender.
Physical residential address and postal address.
Email address and telephone numbers (cellular and landline).
Emergency contact details (name, relationship, and phone number).
Detailed medical history, including past surgeries, chronic conditions, and previous injuries.
Current symptoms, pain levels, and physical limitations.
Reports from other medical professionals, including orthopaedic surgeons, occupational therapists, and general practitioners.
Diagnostic imaging results, such as MRI scans, X-rays, or ultrasound reports.
Clinical notes recorded by the physiotherapist during consultations, detailing physical assessments, trigger point locations, fascial tension areas, and treatment plans.
Progress tracking and specific adaptations required for MAP movement classes.
Bank account details for processing refunds if necessary.
Medical aid scheme name, membership number, and dependent code.
Main member details if the patient is registered as a dependent.
Payment card details (processed securely via our designated merchant services; we do not store full credit card numbers on our local systems).
Invoicing records and payment history.
Internet Protocol (IP) address used to connect your device to the internet.
Browser type and version, time zone setting, browser plug-in types, and operating system.
Information about your visit to our website, including the pages viewed, page response times, and length of visits to certain pages.
We gather your personal and health information through several direct and indirect methods:
Direct Interactions: The vast majority of the data we hold is provided directly by you. This occurs when you fill out a patient intake form at our Murrayfield studio, sign an indemnity form before a MAP class, book an appointment over the phone or via email, or communicate with us via WhatsApp regarding your symptoms or class schedules.
Third-Party Sources: With your explicit verbal or written permission, we may receive medical information from your referring doctor, surgeon, or other allied healthcare professionals. We also interact with your medical aid scheme to confirm available funds and submit claims on your behalf.
Automated Technologies: When you browse our website, we automatically collect technical data regarding your browsing actions and patterns using cookies and server logs.
We will only use your personal information when the law allows us to. Under POPIA, we must have a lawful basis to process your data. We rely on the following justifications: processing is necessary to conclude or perform a contract with you; processing complies with an obligation imposed on us by law; processing protects your legitimate interests; or processing is necessary for pursuing our legitimate interests.
Specifically, we use your information for the following exact purposes:
To Register You as a New Patient: We must verify your identity, set up your medical file, and capture your medical aid details.
To Provide Clinical Treatment: Your medical history and physical assessments are used to diagnose your condition, plan safe fascial release strategies, and execute effective physiotherapy treatments.
To Ensure Safety in Classes: Instructors need to know about your injuries or physical restrictions (such as a recent discectomy or pregnancy) to provide safe, individualised modifications during MAP movement classes.
To Manage Payments and Claims: We use your financial and medical aid data to generate accurate invoices, submit claims directly to your medical scheme, and follow up on outstanding accounts.
To Communicate With You: We will use your contact details to send appointment reminders, notify you of changes to the class schedule, respond to your post-class queries regarding muscle soreness, and provide home-exercise instructions.
To Comply With Legal Obligations: We are required by the HPCSA and the National Health Act to maintain accurate, up-to-date patient files and clinical notes.
The medical data we collect constitutes Special Personal Information under POPIA. The processing of this highly sensitive data is subject to strict conditions. We are authorised to process your health information because it is necessary for your proper treatment and care. Furthermore, as registered healthcare practitioners, we are bound by common law and statutory duties of confidentiality. Your medical files are treated with the utmost secrecy and respect. No clinical details are ever discussed outside the confines of the treatment room or shared with unauthorised individuals.
We do not sell, rent, or trade your personal information to any third parties. We will only share your data with specific external parties under strictly controlled circumstances:
Medical Schemes: We share necessary diagnostic codes (ICD-10 codes) and treatment codes with your medical aid provider to process financial claims on your behalf.
Other Healthcare Professionals: If your condition requires referral to a specialist, or if we are working in tandem with your doctor, we will share relevant clinical notes with them, provided we have received your clear consent to do so.
Service Providers: We may employ trusted third-party companies to perform specific business functions. This includes practice management software providers, cloud hosting services, accounting firms, and debt collection agencies. These third parties are bound by strict confidentiality agreements and POPIA-compliant data processing contracts. They are only permitted to process your data for the specified purpose and in accordance with our direct instructions.
Legal and Regulatory Authorities: We may disclose your information if required to do so by a court order, a subpoena, or a lawful request from a government authority or the HPCSA.
We have put in place highly secure technical and organisational measures to prevent your personal information from being accidentally lost, used, or accessed in an unauthorised way, altered, or disclosed.
Physical Security: All hardcopy patient files, intake forms, and clinical notes are stored in locked filing cabinets within our secure studio at Wanda Road. Access to the office is strictly controlled.
Digital Security: All electronic devices used by the Practice are protected by strong passwords, biometric access controls, and up-to-date antivirus software. Our practice management systems are encrypted, and access is restricted solely to authorised personnel who require the data to perform their job functions.
Staff Training: Any support staff, interns, or visiting professionals operating within the Practice are fully trained on patient confidentiality protocols and are bound by non-disclosure agreements.
We will only retain your personal information for as long as necessary to fulfil the exact purposes for which we collected it, including for the purposes of satisfying any medical, legal, accounting, or reporting requirements.
Statutory Minimums: In accordance with the guidelines set by the HPCSA and the National Health Act, we are legally required to keep patient records for a minimum of six years from the date they became dormant.
Records of Minors: For patients who are under the age of 18, medical records must be kept until the minor reaches the age of 21, plus an additional period as dictated by standard medical regulations.
Destruction of Data: Once the statutory retention period has expired and the records are no longer required, we employ secure methods to destroy the data. Hardcopy files are shredded by a certified document destruction service, and digital files are permanently erased from our servers and backup systems.
In some instances, the third-party service providers we use to support our business (such as cloud storage providers or email hosting platforms) may be located outside of the Republic of South Africa. If we transfer your personal information across borders, we ensure a similar degree of protection is afforded to it. We will only transfer your data to countries that have data protection laws that are substantially similar to POPIA, or we will implement binding corporate rules or standard data protection clauses to guarantee the safety of your information in the foreign jurisdiction.
Under the Protection of Personal Information Act, you are granted specific and powerful rights regarding your personal data. You have the right to:
Request Access: You may request a copy of the personal information we hold about you. We will provide this information within a reasonable timeframe, subject to verification of your identity. We may charge a legally allowable administrative fee for processing large requests.
Request Correction: If you believe that the information we hold about you is inaccurate, incomplete, or out of date, you have the right to request that we correct or update the data.
Request Deletion: You may ask us to delete or remove your personal information where there is no good reason for us continuing to process it. Please note that we may not always be able to comply with your request of erasure for specific legal reasons, such as our statutory obligation to retain medical records under the National Health Act.
Object to Processing: You have the right to object to the processing of your personal information where we are relying on a legitimate interest and you feel it impacts your fundamental rights and freedoms.
Withdraw Consent: Where we are relying on your consent to process your data, you have the right to withdraw that consent at any time. However, this will not affect the lawfulness of any processing carried out before you withdrew your consent. If you withdraw your consent for medical processing, we may not be able to continue providing you with clinical care.
Lodge a Complaint: You have the absolute right to lodge a complaint with the Information Regulator of South Africa if you believe your data protection rights have been violated.
Our website uses cookies to distinguish you from other users, to provide a better browsing experience, and to gather statistics on how the site is used. A cookie is a small file of letters and numbers that we store on your browser or the hard drive of your computer.
Strictly Necessary Cookies: These are required for the operation of our website, such as cookies that enable you to log into secure areas or use a shopping cart for booking classes.
Analytical Cookies: These allow us to recognise and count the number of visitors and see how visitors move around our website. This helps us improve the way the website works.
Managing Cookies: You can set your browser to refuse all or some browser cookies, or to alert you when websites set or access cookies. If you disable or refuse cookies, please note that some parts of this website may become inaccessible or not function properly.
We may use your identity and contact data to send you communications regarding our studio, such as changes to the MAP class schedule, new class times, holiday closure dates, or relevant educational content about physical mobility and fascial health.
Consent and Opt-Out: You will only receive marketing communications if you have specifically requested information from us, or if you are an active client and have not opted out of receiving such messages. You can ask us to stop sending you marketing messages at any time by following the opt-out links on any communication sent to you, or by contacting us directly.
Transactional Messages: Please note that opting out of marketing communications does not apply to transactional or clinical messages, such as appointment confirmations, invoices, or direct follow-ups regarding your medical treatment.
In the unlikely event of a data breach where we have reasonable grounds to believe that your personal information has been accessed or acquired by any unauthorised person, we have a strict incident response plan in place. We are legally obligated to notify the Information Regulator and you (the affected data subject) as soon as reasonably possible after discovering the breach. We will provide you with details of the breach, the possible consequences, and the measures we are taking to address the situation and mitigate any risks to your privacy.
We keep our Privacy Policy under regular review and may update it from time to time to reflect changes in our business operations or legal requirements. Any updates will be published directly on this website page. The revised policy will apply to the use of our website and our services from the date of publication. We encourage you to review this policy periodically to stay informed about how we are protecting your personal data.
If you have any questions regarding this Privacy Policy, wish to exercise any of your legal rights, or want to discuss how your medical information is handled, please contact our designated Information Officer:
Martina Johannes Physiotherapist Physical Address: 202 Wanda Road, Murrayfield, Pretoria, 0081 Telephone: 065 389 4835
If you are unsatisfied with how we handle your personal information, you have the right to contact the Information Regulator of South Africa: The Information Regulator (South Africa) JD House, 27 Stiemens Street, Braamfontein, Johannesburg, 2001 P.O Box 31533, Braamfontein, Johannesburg, 2017 Complaints email: complaints.IR@justice.gov.za General enquiries: inforeg@justice.gov.za
