Privacy Policy

1. Introduction

Dr. Werner Gilfillan ("we", "us", "our") is committed to protecting your privacy and handling your personal information responsibly. This policy explains what information we collect, why we collect it, how we use and protect it, and your rights under the Protection of Personal Information Act 4 of 2013 (POPIA).

By using our website or engaging with our practice, you acknowledge that you have read and understood this Privacy Policy.

2. Who We Are

Responsible Party (Data Controller):
Dr. Werner Gilfillan
3 Grey St, Worcester Central, Worcester, 6850
Telephone: 023 347 2069
Email: admin@gilfil.co.za

3. Information We Collect

We may collect and process the following categories of personal information:

• Contact details: name, telephone number, email address, postal address.
• Demographic information: date of birth, gender, identity number.
• Medical and health information: medical history, diagnoses, prescriptions, test results, treatment records, and consultation notes.
• Medical aid / insurance details: scheme name, membership number, and dependant codes.
• Financial information: billing and payment records.
• Occupational information: employer details where relevant to WCA / IOD claims.
• Website usage data: anonymised analytics data (page visits, browser type) collected only with your consent via cookies.

4. How We Collect Information

• Directly from you when you register as a patient, make a booking, or contact the practice.
• From referring healthcare professionals or hospitals involved in your care.
• From your medical aid scheme or insurer where applicable.
• Automatically via our website analytics (only after you have given cookie consent).

5. Why We Process Your Information

We process your personal information for the following purposes:

• Provision of healthcare: to diagnose, treat and manage your health, and to maintain accurate clinical records.
• Appointments and bookings: to schedule, confirm and manage consultations.
• Billing and administration: to process payments and submit medical aid claims.
• Referrals: to refer you to specialists or allied health professionals when clinically necessary.
• Legal and regulatory compliance: to comply with the Health Professions Act, POPIA, and other applicable legislation.
• Communication: to send appointment reminders or important practice updates.
• Website improvement: to understand how our website is used (analytics cookies, with your consent only).

6. Legal Basis for Processing

We rely on the following grounds permitted under POPIA:

• Consent — where you have given explicit consent (e.g., for analytics cookies).
• Contract performance — to provide the medical services you have requested.
• Legal obligation — where processing is required by law (e.g., mandatory reporting obligations).
• Vital interests — to protect your life or health in an emergency.
• Legitimate interests — for practice administration and service improvement, where these do not override your rights.

Health data is special personal information under POPIA. We process it solely to provide you with medical care or as required by law.

7. Sharing Your Information

We do not sell your personal information. We may share information only where necessary:

• Healthcare professionals: specialists, hospitals, or allied health providers involved in your care.
• Medical aid schemes: to process authorisations and claims on your behalf.
• Practice management software: our booking and billing system (MyGC / GoodX) processes data on our behalf under confidentiality obligations.
• Legal or regulatory authorities: where required by law, court order, or to protect public health.
• Third-party analytics: anonymised website usage data may be shared with Google Analytics (only with your cookie consent).

Any third party that processes data on our behalf is required to handle it securely and only for the specified purpose.

8. How We Protect Your Information

• Patient records are stored in a secure, password-protected practice management system.
• Physical records are kept in locked storage accessible only to authorised staff.
• All staff are bound by professional confidentiality obligations.
• Our website uses HTTPS encryption for all data in transit.
• Access to patient information is restricted on a need-to-know basis.

9. Retention of Records

We retain patient health records for a minimum of five years from the date of last entry, or longer where required by applicable law or professional guidelines (e.g., records for minor patients are retained until the patient turns 21, or five years from last entry, whichever is later). When records are no longer required, they are destroyed securely.

Website analytics data is retained in accordance with Google Analytics' standard retention settings (26 months by default).

10. Cookies

Our website uses cookies only with your consent. When you first visit the site, a consent banner gives you the option to accept or reject analytics cookies. You may change your preference at any time using the "Manage cookie preferences" button in the page footer.

We use Google Analytics (with IP anonymisation enabled) to understand aggregated website traffic. No personally identifiable information is sent to Google Analytics.

11. Your Rights Under POPIA

You have the right to:

• Access the personal information we hold about you.
• Correct inaccurate or incomplete information.
• Object to the processing of your personal information in certain circumstances.
• Request deletion of your information where there is no lawful reason to retain it (subject to our legal and professional record-keeping obligations).
• Withdraw consent where processing is based on consent (e.g., analytics cookies), without affecting the lawfulness of prior processing.
• Lodge a complaint with the Information Regulator of South Africa.

To exercise any of these rights, please contact us using the details in Section 2.

12. Information Regulator

If you believe we have not handled your personal information in accordance with POPIA, you have the right to lodge a complaint with the Information Regulator:

Information Regulator (South Africa)
JD House, 27 Stiemens Street, Braamfontein, Johannesburg, 2001
Email: inforeg@justice.gov.za
Website: www.justice.gov.za/inforeg

13. Changes to This Policy

We may update this Privacy Policy from time to time to reflect changes in legislation or practice. The "Last updated" date at the top of this page will be revised accordingly. We encourage you to review this page periodically.

14. Contact Us

For any privacy-related questions, requests, or concerns, please contact us:

Dr. Werner Gilfillan
3 Grey St, Worcester Central, Worcester, 6850
Telephone: 023 347 2069
Email: admin@gilfil.co.za

← Back to home