Privacy Policy & POPIA Notice

1. Introduction

1.1 Balance Point Wellness Centre respects your privacy. This policy explains what personal information we collect about you, why we collect it, what we do with it, who we share it with, how long we keep it, how we protect it, and what rights you have.

1.2 This policy is our notification to you in terms of section 18 of the Protection of Personal Information Act 4 of 2013 (“POPIA”). It also serves as our privacy statement for the purposes of section 43(1) of the Electronic Communications and Transactions Act 25 of 2002.

1.3 This policy applies to:

1.3.1 your use of https://balancepointwellness.co.za;

1.3.2 enquiries, contact forms, course enquiries and corporate wellness enquiries you send us;

1.3.3 administrative and reception interactions with the Centre; and

1.3.4 our corporate wellness and Employee Wellness Programme services, to the extent set out in clause 12.

1.4 This policy does not cover the clinical records that an independent Practitioner creates about you. Each independent Practitioner is a separate responsible party under POPIA and has their own privacy policy. Clause 11 explains this.

1.5 We may update this policy. The current version is always the one published on this website. Material changes will be notified by a new version number and effective date, and, where the change is significant, by a notice on the website or by email.

2. Who is responsible for your personal information

We are the responsible party as defined in POPIA.

Item	Detail
Responsible party	Benjamin Shefer trading as Balance Point Wellness Centre
Registration number	2026/280968/07
Physical address	77 11th Street, Parkmore, Sandton, Gauteng, 2196
Telephone	068 636 9440
General email	info@balancepointwellness.co.za
Information Officer	Benjamin Shefer, Director & CEO
Information Officer email	ben@balancepointwellness.co.za
Information Officer telephone	+27 82 677 8757
Deputy Information Officer	Not appointed
Registration with the Information Regulator	In Progress

Our Information Officer will be registered with the Information Regulator. In terms of section 55(2) of POPIA, an Information Officer may only take up the duties of that office once registered with the Regulator.

3. Definitions

“Data subject” means the person to whom personal information relates, which in most cases means you.

“Operator” means a person who processes personal information for us under a written contract, without coming under our direct authority.

“Personal information” means information relating to an identifiable living natural person, and where applicable an identifiable existing juristic person. It includes your name, contact details, identity number, biometric information, health information, correspondence you send us, and opinions about you.

“Processing” means anything done with personal information, including collecting, receiving, recording, storing, updating, using, sharing, erasing or destroying it.

“Responsible party” means the person who determines the purpose of and means for processing personal information.

“Special personal information” means the categories listed in section 26 of POPIA, which include information about a person’s health, sex life, religious or philosophical beliefs, race or ethnic origin, trade union membership, political persuasion, biometric information, and criminal behaviour.

4. The principles we apply

We process personal information in accordance with the eight conditions for lawful processing in Chapter 3 of POPIA:

Condition	What it means for you
1. Accountability	We take responsibility for meeting POPIA in everything we do with your information.
2. Processing limitation	We collect only what we need, lawfully, and in a way that does not unreasonably intrude on your privacy. We collect it from you directly unless an exception applies.
3. Purpose specification	We collect for a specific, explicitly defined and lawful purpose, which we tell you about, and we do not keep records longer than we need to.
4. Further processing limitation	We only use your information for a new purpose if that purpose is compatible with the original one, or you consent, or the law allows it.
5. Information quality	We take reasonable steps to keep your information complete, accurate, current and not misleading.
6. Openness	We tell you what we do with your information, which is the purpose of this policy, and we maintain a PAIA manual.
7. Security safeguards	We secure the integrity and confidentiality of your information with appropriate technical and organisational measures, and we notify you and the Regulator if there is a security compromise.
8. Data subject participation	You may ask what we hold, ask for a correction, ask for deletion, and object to processing.

5. What personal information we collect

Where it comes from	What we collect	Whether it is voluntary or mandatory
Website contact form	First name, last name, email address, telephone number, the enquiry category you select, the free-text message you write, and your consent to be contacted	Voluntary. If you do not provide your name and at least one contact detail we cannot respond to you.
Course and programme enquiries	Name, contact details, and any information you volunteer about your background, experience or reason for enrolling	Voluntary
Corporate wellness enquiries	Your name, job title, employer, work email and telephone number, and the nature of the enquiry	Voluntary
Reception, telephone and email	Name, contact details, appointment details, the practitioner you wish to see, and any information you choose to give us	Voluntary
Billing and administration where we invoice you directly	Name, billing address, identity number where required by law, medical scheme name and membership number, and payment reference	Mandatory for us to invoice or claim on your behalf
Automatically from your device	IP address, approximate location derived from IP address, browser type and version, device type, operating system, referring page, pages viewed, time on page, and cookie identifiers	Collected automatically. See clause 9.
Google reCAPTCHA on our forms	Technical and behavioural signals collected by Google to distinguish humans from automated software	Necessary to submit the form
Job applications, if you apply to us	CV, qualifications, registration numbers, references and employment history	Voluntary but necessary to consider your application

We do not knowingly collect more than we need, and we do not sell your personal information to anyone.

6. Special personal information and health information

6.1 We ask you not to send detailed health information through the website contact form or by ordinary email. The form is intended for enquiries only. Email and web forms are not encrypted end to end and are not a secure channel for clinical information.

6.2 We nevertheless recognise that people sometimes describe a symptom or a condition when they explain why they are getting in touch. Where that happens, that information is special personal information as defined in section 26 of POPIA and we treat it accordingly:

6.2.1 we process it only to route your enquiry to the right Practitioner and to respond to you;

6.2.2 access is restricted to the reception and administrative staff who need it for that purpose, each of whom is bound by a written confidentiality undertaking;

6.2.3 we do not use it for marketing;

6.2.4 we delete it from our enquiry records once the enquiry is closed and the retention period in clause 14 has expired.

6.3 The prohibition on processing special personal information in section 26 does not apply where one of the authorisations in sections 27 to 33 applies. We rely on:

6.3.1 section 27(1)(a), your consent, which you give when you tick the consent box on our form and choose to describe your health concern to us; and

6.3.2 section 32(1)(a), which authorises the processing of health information by medical professionals, healthcare institutions and facilities where that processing is necessary for the proper treatment and care of the data subject, or for the administration of the institution or the professional practice concerned.

6.4 Everyone who processes health information for us is subject to an obligation of confidentiality by virtue of office, employment, profession or legal provision, or by written agreement, as required by sections 32(2) and 32(3) of POPIA. Where any person is not already under such an obligation, they are required to treat the information as confidential. We apply the same standard set out in the Regulations relating to the Processing of Data Subjects’ Health Information by Certain Responsible Parties, 2026, published on 6 March 2026 in Government Gazette No. 54268.

6.5 Clinical records. Where you are treated by a Practitioner, that Practitioner creates and holds the clinical record. Those records are governed by:

6.5.1 sections 14 to 17 of the National Health Act 61 of 2003, which impose confidentiality on all information about a user of health services and require the person in charge of a health establishment to set up control measures to prevent unauthorised access;

6.5.2 the ethical rules and record-keeping guidelines of the relevant professional council; and

6.5.3 that Practitioner’s own privacy policy.

6.6 We do not have routine access to another Practitioner’s clinical records about you, and we do not require them to give us access.

6.7 Multidisciplinary care. Where you are treated by more than one Practitioner at the Centre and coordinated care is clinically appropriate, those Practitioners may share relevant clinical information with each other. This will only happen with your informed consent, which will be obtained by the Practitioner in writing at intake, and you may withdraw it at any time by telling the Practitioner.

7. Children’s personal information

7.1 A child, for POPIA purposes, is a person under the age of 18 who is not legally competent to act without the assistance of a competent person.

7.2 We do not knowingly collect the personal information of a child through this website. If you are under 18, please ask your parent or guardian to make the enquiry for you.

7.3 Where a child is treated at the Centre, the Practitioner obtains the consent of the parent, guardian or other competent person, subject to the child’s own rights under the Children’s Act 38 of 2005 and section 129 of that Act, and subject to the National Health Act, under which a person aged 12 or older may consent to their own medical treatment in certain circumstances.

7.4 If you believe we hold information about a child without proper consent, contact our Information Officer and we will delete it.

8. Why we process your information, and on what legal basis

Purpose	Legal basis under section 11 of POPIA
Responding to your enquiry and routing it to the right Practitioner	Consent, section 11(1)(a), and steps at your request preceding a contract, section 11(1)(b)
Making, confirming, rescheduling and reminding you about appointments	Performance of a contract, section 11(1)(b)
Providing and administering wellness services and coordinating care	Performance of a contract, section 11(1)(b), and section 32(1)(a) for health information
Invoicing, payment, and medical scheme claims	Performance of a contract, section 11(1)(b), and legal obligation, section 11(1)(c)
Keeping accounting and tax records	Legal obligation, section 11(1)(c), under the Tax Administration Act 28 of 2011 and the Companies Act 71 of 2008
Course enrolment, administration and certification	Performance of a contract, section 11(1)(b)
Corporate wellness services	Performance of a contract with the employer, section 11(1)(b), and legitimate interests, section 11(1)(f)
Website security, fraud prevention and abuse prevention	Legitimate interests, section 11(1)(f)
Website analytics and improving the site	Consent for non-essential cookies, section 11(1)(a)
Newsletters and marketing communications	Consent, section 11(1)(a), read with section 69
Publishing a testimonial you have given us	Consent, section 11(1)(a)
Defending or bringing a legal claim, and complying with a lawful request	Establishment, exercise or defence of a right in law, section 11(1)(d), and legal obligation, section 11(1)(c)
Recruitment	Steps preceding a contract, section 11(1)(b), and consent, section 11(1)(a)

9. Cookies, analytics and tracking

9.1 A cookie is a small text file placed on your device. We use the following categories:

Category	Purpose	Basis
Strictly necessary	Keep the site working, remember your cookie choice, protect forms against automated abuse through Google reCAPTCHA	Legitimate interests. These cannot be switched off.
Performance and analytics	Google Analytics 4 tells us which pages are read, for how long, and where visitors come from, in aggregate	Consent
Functional	Remember preferences such as language or a closed banner	Consent
Marketing and retargeting	Meta Pixel, Google Ads and CRM systems to measure campaigns and show relevant advertising	Consent. Currently in use

9.2 We ask for your consent to non-essential cookies through a cookie banner before those cookies are set. You may accept all, reject all, or choose categories, and you may change your choice at any time through the cookie settings link in the website footer.

9.3 You can also block or delete cookies in your browser settings. If you block strictly necessary cookies, parts of the website may not work.

9.4 We do not respond to “Do Not Track” browser signals, because there is no agreed standard for them.

9.5 Google reCAPTCHA is used on our forms. Your use of it is subject to the Google Privacy Policy and Terms of Service.

10. Who we share your information with

10.1 We share personal information only where it is necessary, and only with the following categories of recipient:

Recipient	What they receive	Why
The Practitioner you have asked to see	Your name, contact details and the substance of your enquiry	So that they can contact you and arrange care
Website host and technical maintenance provider	Anything stored on the website, including form submissions	Hosting, backups and support
Email and productivity provider, for example Microsoft 365	Correspondence and contact details	Business email
Booking, practice management or CRM software	Appointment and contact data	Scheduling and reminders
Email marketing platformm	Name and email address, if you have subscribed	Sending the newsletter you asked for
Google, for reCAPTCHA and, if enabled, Analytics	Technical and behavioural signals, IP address	Spam protection and aggregate analytics
Accountants, auditors, bankers and attorneys	Only what is necessary for the mandate	Professional services and legal compliance
Debt collection agency	Name, contact details and account balance	Recovery of an overdue account, only after notice to you
Medical schemes and administrators, where you ask us to claim	Name, membership number, service codes and dates	To submit a claim on your behalf
Law enforcement, a regulator, or a court	Only what is lawfully required	Compliance with a subpoena, court order or statutory obligation
A purchaser of the business	Records necessary for the transaction, under confidentiality	Business transfer, subject to your rights under POPIA

10.2 Every service provider that processes personal information for us is an operator under POPIA. We are required by sections 20 and 21 to conclude a written contract with each of them obliging them to establish and maintain the security measures required by section 19, to process only on our instructions, and to notify us immediately where there are reasonable grounds to believe personal information has been accessed or acquired by an unauthorised person.

10.3 We do not sell, rent or trade your personal information.

11. Independent Practitioners are separate responsible parties

11.1 Several of the Practitioners who consult at or through the Centre are independent practices. Where you book with them, whether through a link on our website or directly, they collect and hold your information as their own responsible party.

11.2 This means:

11.2.1 their privacy policy, not this one, governs the information they collect from you;

11.2.2 they are responsible for their own POPIA compliance, their own Information Officer, their own security and their own retention;

11.2.3 a data subject request about your clinical record must be made to them, not to us, although we will help you direct it correctly; and

11.2.4 when you click a booking link on our website and are taken to their site or to a third-party booking platform, you leave our website and their terms apply.

11.3 We require every independent Practitioner operating at the Centre to have a written agreement with us that includes confidentiality and data protection obligations.

12. Corporate wellness and employee information

12.1 Where an employer appoints us to provide an Employee Wellness Programme, we may process the personal information of that employer’s employees.

12.2 In that arrangement:

12.2.1 we process the administrative and enrolment information on the employer’s behalf and under a written services agreement containing the operator provisions required by sections 20 and 21 of POPIA;

12.2.2 the clinical and counselling records of an employee are created and held by the treating Practitioner as a separate responsible party, and are confidential to that employee;

12.2.3 an employer never receives an individual employee’s clinical information, counselling notes, diagnosis or attendance detail without that employee’s specific written consent. Reporting to the employer is limited to aggregated, de-identified utilisation and outcome statistics of a size that cannot identify any individual; and

12.2.4 where an employee is referred for occupational health or fitness-for-work assessment, the scope of what is reported to the employer is agreed in advance and disclosed to the employee before the assessment.

13. Sending information outside South Africa

13.1 Some of our service providers store or process information on servers outside South Africa, principally in the European Union and the United States. This includes our email provider and Google reCAPTCHA and Analytics.

13.2 Section 72 of POPIA permits a transfer outside South Africa only where one of the following applies. We rely on the ones marked:

13.2.1 the recipient is subject to a law, binding corporate rules or a binding agreement that provides an adequate level of protection substantially similar to POPIA and that includes similar onward-transfer restrictions. This is our primary basis. We contract with our providers on their data processing addenda, which include the European Commission standard contractual clauses.

13.2.2 you have consented to the transfer;

13.2.3 the transfer is necessary for the performance of a contract between you and us, or for the implementation of pre-contractual measures taken in response to your request;

13.2.4 the transfer is necessary for the conclusion or performance of a contract concluded in your interest between us and a third party; or

13.2.5 the transfer is for your benefit and it is not reasonably practicable to obtain your consent, and if it were, you would be likely to give it.

13.3 Health information. In line with the Regulations relating to the Processing of Data Subjects’ Health Information by Certain Responsible Parties, 2026, we do not transfer identifiable health information outside South Africa unless one of the section 72 conditions is met and the transfer is necessary. Clinical records held by Practitioners at the Centre are stored in a secured cloud.

14. How long we keep your information

14.1 We keep personal information only for as long as we need it for the purpose we collected it, or for as long as the law requires.

Record	Retention period	Reason
Website enquiry that does not become a booking	12 months from the last contact	To follow up and to defend a complaint
Enquiry that becomes a client relationship	For the duration of the relationship and then as set out below	Continuity of care
Clinical and health records	Held by the treating Practitioner. Professional guidance requires a minimum of six years from the date the record became dormant. For a minor, until the person turns 21. For a person who is mentally not competent, for the lifetime of the person. Occupational health records are kept for 20 years after treatment under the Occupational Health and Safety Act 85 of 1993.	National Health Act 61 of 2003 and the record-keeping guidelines of the Health Professions Council of South Africa
Invoices, receipts and accounting records	Five years from the end of the tax year to which they relate	Tax Administration Act 28 of 2011, Companies Act 71 of 2008
Employment and recruitment records for unsuccessful applicants	12 months, unless you ask us to keep them longer	Employment Equity Act 55 of 1998 and to answer any challenge
Marketing consent and opt-out records	For as long as we conduct marketing, and for three years after	To prove consent and to honour objections under section 69
Cookie consent records	12 months	To prove consent
CCTV footage at the premises, if any	30 days	Security

14.2 When a retention period expires, we delete the record or de-identify it so that it can no longer be linked to you. Paper records are shredded. Electronic records are deleted from live systems and from backups on the ordinary backup rotation.

14.3 We may keep a record longer where it is the subject of a live complaint, investigation, claim or legal proceeding, until that matter is finally resolved.

15. How we protect your information

15.1 Section 19 of POPIA requires us to secure the integrity and confidentiality of personal information by taking appropriate, reasonable technical and organisational measures. The measures we take include:

15.1.1 access control, so that staff only see what their role requires;

15.1.2 individual user accounts, strong password requirements and multi-factor authentication on email and administrative systems;

15.1.3 encryption of data in transit using TLS on the website, and encryption at rest on our devices and cloud storage;

15.1.4 written confidentiality undertakings for every employee, contractor and Practitioner with access to personal information;

15.1.5 locked physical storage for any paper records, in a controlled-access area of the premises;

15.1.6 regular software updates, malware protection and backups;

15.1.7 written operator agreements with our service providers, as required by sections 20 and 21;

15.1.8 periodic review of our risks and safeguards, and of any accepted information security practices applicable to the healthcare sector; and

15.1.9 staff awareness training on privacy and confidentiality.

15.2 No system is perfectly secure. We cannot guarantee absolute security, and information sent to us over an unsecured channel such as ordinary email travels at your own risk while in transit.

15.3 Security compromise. If there are reasonable grounds to believe that your personal information has been accessed or acquired by an unauthorised person, section 22 of POPIA requires us to notify the Information Regulator and to notify you as soon as reasonably possible after discovering it and after determining the scope of the compromise. Our notification to you will describe the possible consequences, the measures we intend to take or have taken, what you can do to reduce the harm, and, if we know it, the identity of the unauthorised person. We will notify you in writing by email, by post, or by a prominent notice on this website, as the circumstances require.

16. Marketing communications

16.1 We will only send you electronic marketing, including email, SMS, WhatsApp or push notifications, if:

16.1.1 you have given us your consent to do so; or

16.1.2 you are an existing client, we obtained your contact details in the context of providing a service to you, we are marketing our own similar services, and you were given a reasonable opportunity to object both when we collected the details and in every message since.

16.2 This reflects section 69 of POPIA as interpreted in the Information Regulator’s Guidance Note on Direct Marketing. Silence is not consent. Where we approach a person who is not an existing client, we must first obtain consent using Form 4 prescribed under the POPIA Regulations.

16.3 Every marketing message we send will identify us, will give a valid address to which you can send an objection, and will include a one-click unsubscribe.

16.4 You may object to direct marketing at any time, at no cost, by clicking unsubscribe, by emailing info@balancepointwellness.co.za. We will action it immediately and record your objection on a suppression list so that you are not contacted again.

16.5 An objection to marketing does not affect the appointment reminders, account statements, clinical follow-ups and service notices we need to send you, which are not direct marketing.

17. Your rights

You have the following rights. We will not charge you for exercising them, except that a reasonable prescribed fee may be payable for a copy of a record under PAIA.

Right	What it means	POPIA section
To be notified	To be told that we are collecting your information, and to be told if it has been accessed by an unauthorised person	18, 22
Access	To ask us to confirm, free of charge, whether we hold information about you, and to be given a description of it and of who has had access to it. A copy of the record is requested under PAIA and a prescribed fee may apply	23, read with PAIA
Correction	To ask us to correct or update information that is inaccurate, irrelevant, excessive, out of date, incomplete, misleading or unlawfully obtained	24
Deletion	To ask us to delete or destroy a record we are no longer authorised to retain	24
Objection	To object, on reasonable grounds, to processing based on legitimate interests or public interest	11(3)
Withdraw consent	To withdraw consent at any time, without affecting the lawfulness of what we did before you withdrew it	11(2)
Direct marketing	To stop direct marketing at any time	69
Automated decisions	Not to be subject to a decision with legal or substantially similar consequences based solely on automated processing	71
Complain	To lodge a complaint with the Information Regulator, and to institute civil proceedings for damages	74, 99

17.2 How to exercise a right. Send a written request to our Information Officer at info@balancepointwellness.co.za. Where a form is prescribed, please use it:

17.2.1 Form 1 under the POPIA Regulations, to object to the processing of your personal information in terms of section 11(3)(a);

17.2.2 Form 2 under the POPIA Regulations, to request the correction or deletion of your personal information, or the destruction or deletion of a record of personal information, in terms of section 24(1);

17.2.3 Form 4 under the POPIA Regulations, to give or withdraw consent to direct marketing in terms of section 69(2);

17.2.4 for a request to access the personal information we hold about you, the request is made under the Promotion of Access to Information Act using the prescribed PAIA request form for a private body. There is no POPIA Regulations form for an access request. The form and the procedure are set out in our PAIA manual, and we will send you the form on request.

All POPIA forms are available on the Information Regulator’s website at https://inforegulator.org.za and on request from us.

17.3 We will acknowledge your request within 5 business days and respond within 30 days, as required by PAIA, unless the period is lawfully extended, in which case we will tell you why.

17.4 We may need to verify your identity before acting on a request, so as to protect you against someone else obtaining your information.

17.5 We may refuse a request only on a ground permitted by PAIA or POPIA, and if we do we will give you written reasons and tell you how to challenge the refusal.

18. Complaints to the Information Regulator

18.1 We would prefer to resolve your concern directly. Please contact our Information Officer first.

18.2 If you are not satisfied, you may lodge a complaint with the Information Regulator, using Form 5 under the POPIA Regulations.

Information Regulator of South Africa
Physical address	Woodmead North Office Park, 54 Maxwell Drive, Woodmead, Johannesburg, 2191
Telephone	010 023 5200
Toll free	0800 017 160
POPIA complaints	POPIAComplaints@inforegulator.org.za
PAIA complaints	PAIAComplaints@inforegulator.org.za
General enquiries	enquiries@inforegulator.org.za
Website	https://inforegulator.org.za

18.3 Where your concern relates to the conduct of a registered health professional, you may also complain to the Health Professions Council of South Africa or, for a registered wellness counsellor, to the Association for Supportive Counsellors and Holistic Practitioners.

19. Access to information under PAIA

19.1 We have compiled a manual in terms of section 51 of the Promotion of Access to Information Act 2 of 2000. Every private body in South Africa must have one. The exemption that previously applied to smaller private bodies lapsed on 31 December 2021.

19.2 Our manual sets out the records we hold, how to request access, the fees payable, the grounds on which access may be refused, and our Information Officer’s contact details. It is available at Contact, for inspection at our premises during business hours, and on request.

19.3 We submit the annual PAIA report to the Information Regulator for the period 1 April to 31 March, in the reporting window that closes on 30 June each year.

20. Automated decision-making and profiling

20.1 We do not make any decision about you that has legal consequences, or that affects you to a substantial degree, based solely on automated processing.

20.2 We use aggregate website analytics to understand how the site is used. This does not produce a decision about you as an individual.

20.3 Google reCAPTCHA makes an automated assessment of whether a form submission is human. If it wrongly blocks you, you can reach us by telephone on 068 636 9440 or by emailing info@balancepointwellness.co.za, so no decision about you rests solely on that automated check.

21. Contact us

If you have a question about this policy, want to exercise a right, or want to report a concern:

Information Officer: Benjamin Shefer

Email: ben@balancepointwellness.co.za

Telephone: 068 636 9440

Post: 77 11th Street, Parkmore, Sandton, Gauteng,2196

22. Version control

Version	Effective date	Summary of change	Approved by
1.0	31/08/2026	First publication	Benjamin Shefer