Privacy Notice

This notice explains what information Move Physio & Pilates Kimberley collects about you, why we need it, who we share it with, and the choices you have. We have written it in plain language on purpose — if anything here is unclear, please ask us.

Who is responsible for your information

Move Physio & Pilates Kimberley is the responsible party for your personal information under the Protection of Personal Information Act, 2013 (POPIA).

• Practice: Move Physio & Pilates Kimberley
• Information Officer: Anna de Beer
• Address: 8 At v Niekerk Street, Kimberley, Northern Cape, 8301
• Email: movepilatessa@gmail.com
• Phone: 079 150 7603
• Practice number: 0810452 · HPCSA: PT0113522

What we collect

We only collect what we actually need to treat you safely and run the practice.

Your details

• Name and title, and your identity number and date of birth
• Contact details — cellphone, work number, email and home address
• Your occupation, and the name and number of an emergency contact

Your health information

Because we are a physiotherapy and pilates practice, some of what we hold is health information. POPIA calls this special personal information and gives it extra protection. This can include:

• Problem areas, injuries and pain history
• Treatment you are receiving and medication you are taking
• Whether you are pregnant, and any related notes
• Clinical assessments, evaluation reports and progress notes
• Your exercise goals and previous pilates experience

We collect this so that your physiotherapy treatment and your pilates exercises can be adapted safely to your body. Working without it would put you at risk of injury.

Records of what you agreed to

When you sign a consent form or membership agreement on our website, we keep an unchangeable record of it: your signature (drawn or typed), the exact wording you agreed to, the date and time, and the internet (IP) address it was signed from. This protects both of us by proving what was agreed and when.

Practice and website information

• Invoices, payments and account history
• Messages you send us through the website or WhatsApp button
• A review, only if you choose to submit one — and it is only published after Anna approves it
• Basic security records, including a short-lived note of your IP address used to stop automated abuse of our forms. These are deleted within a day.

Why we are allowed to hold health information

POPIA generally prohibits processing health information. It specifically permits it for healthcare practitioners where the information is needed for proper treatment and care. That is the basis we rely on, and everyone at the practice is bound by professional confidentiality. Your other details are processed so that we can provide the service you have asked for and meet our legal and professional obligations.

Who else can see it

We never sell your information, and we do not share it for marketing. We use a small number of trusted service providers to run the practice, and they may only process your information on our instructions:

• Supabase — the secure database and file storage behind our website and admin system
• Cloudflare — hosts and protects the website
• Resend — delivers our emails, such as invoices and confirmations
• Google Maps — provides the map showing where the studio is
• JLR Dev — our website and systems developer, who maintains the software

We may also share information where the law requires it, or with your medical aid or another healthcare provider where you have asked us to.

Where your information is stored

We want to be straightforward about this: our database and stored files are hosted in a data centre in Sweden, in the European Union, and our website is delivered through a global network of servers. Our email provider processes messages outside South Africa as well.

This means your information is transferred outside South Africa. POPIA permits this where the receiving country has laws that protect personal information to a comparable standard. The European Union's data protection law (the GDPR) is one of the strictest in the world, and our providers are contractually required to protect your information and to process it only on our instructions.

How long we keep it

Health records must be kept for a minimum period set by the Health Professions Council of South Africa, and we keep yours for at least that long. Financial records such as invoices are kept for the period required by tax law. Anything we no longer need, and are not required to keep, is deleted. Website security records are deleted within a day.

How we protect it

• Your information is held in an access-controlled database — it is never publicly readable
• The website is encrypted (HTTPS) end to end
• Only Anna and authorised staff have logins, each with their own password
• Our forms are protected against automated abuse and bulk data harvesting
• Our website deliberately does not display your stored details back to anyone who simply enters a phone number

Your rights

Your information belongs to you. You may:

• Ask what we hold about you, and get a copy
• Correct anything that is wrong or out of date — you can do this yourself at any time using the "Update my details" link Anna sends you
• Ask us to delete information we no longer have a legal or professional reason to keep
• Object to us using your information in a particular way
• Withdraw consent you previously gave, where our use was based on that consent
• Complain to us, or to the Information Regulator

To exercise any of these, contact Anna on movepilatessa@gmail.com or 079 150 7603. We will respond as quickly as we can. There is no charge to ask what we hold, though a small fee may apply for extra copies.

Complaining to the Information Regulator

If you are not satisfied with how we have handled your information, you can complain directly to the Information Regulator of South Africa using their POPIA Form 5 or their eServices portal:

• Address: Woodmead North Office Park, 54 Maxwell Drive, Woodmead, Johannesburg, 2191
• Phone: 010 023 5200 · Toll-free 0800 017 160
• General enquiries: enquiries@inforegulator.org.za
• POPIA complaints: POPIAComplaints@inforegulator.org.za
• Website: inforegulator.org.za

Cookies and similar technology

Our website does not use advertising or tracking cookies. It stores a small amount of data in your browser so the site works properly and can load quickly when you return. If you sign in to the admin area, a secure session cookie keeps you signed in. The embedded Google map may set its own cookies — that is Google's, and their privacy policy applies to it.

Children

Where we treat anyone under 18, we collect and process their information only with the consent of a parent or guardian, who may exercise all of the rights above on the child's behalf.

Changes to this notice

If we change how we handle your information, we will update this page and change the date at the top. Where a change is significant, we will tell you directly.