How does Catford Dental handle your personal information?

What about Cathy, the assistant on this site?

Cathy answers questions about the practice using the text published on this website. It cannot search anywhere else, and it will not guess: if it cannot find something, it gives you the practice’s number instead.

What you type is sent to Anthropic, the company whose language service phrases Cathy’s replies. Anthropic is based in the United States, so this is a transfer of information outside South Africa. We use their API on terms under which your message is not retained after the reply is produced and is not used to train their models. We do not keep a transcript of your conversation — no record of who you are or what you asked is kept by the practice or on this website.

There is one small, deliberate exception. When Cathy cannot answer something, it may keep a short, anonymisednote of the topic — with any contact details removed, and never a question phrased as a personal or health matter — only so we can see what information is missing and add it to this site. It is a list of gaps to fill, not a record of people or of what any individual asked.

Two things are worth knowing because they are unusual, and both work in your favour. Cathy checks your message for signs of a dental emergency on your own phone, before anything is sent— so if you describe swelling, difficulty swallowing, an injury or severe pain, you are told to phone us immediately and the message goes no further. And if the service is unavailable, Cathy answers from this website alone, with nothing transmitted at all.

Please do not type identifying details, medical aid numbers, or a full account of your symptoms into Cathy. It is there to answer questions about the practice, not to take a history — and health information is special personal information under POPIA. Anything clinical belongs in a phone call or an appointment, where it can be recorded properly and answered by a person.

What happens if I request an appointment through Cathy?

Cathy can take an appointment request. It is not a booking: nothing is reserved in the diary, and a member of the practice phones you to confirm a time that is actually available.

To do that it asks for your name and surname, a contact number, an email address, the date and times you would prefer, whether you will be using medical aid or paying privately, and briefly what the visit is for. That last field is the only one that may contain health information, which is why the form asks you to keep it to a sentence and to leave out your ID number, medical aid number and symptom history.

What we do with it.The request is turned into two emails — one to the practice you chose, one to you as a copy — and then discarded. It is not written to a database, a log file, or any record on this website. The emails are sent through Resend, a delivery service that transmits them and does not use their contents for anything else. Once your appointment is confirmed, the details you gave are recorded in the practice management system in the ordinary way, and the rest of this policy applies to them from that point.

You can use the practice’s online booking, phone, WhatsApp or email instead at any time — all of them are offered alongside the form, and none of them require you to use Cathy.

Who is responsible for your information?

Catford Dental is the responsible party for the purposes of the Protection of Personal Information Act 4 of 2013 (POPIA). The practice operates from two locations:

• 167 Stonebridge Drive, Stonebridge, Phoenix, KwaZulu-Natal, 4068
• 4 Palm Boulevard, Umhlanga Ridge (Royal Palm Hotel), Durban, KwaZulu-Natal, 4319

This policy covers information collected in the practice, over the phone or WhatsApp, and through this website.

What information do we collect?

Two broad categories.

Personal information — your name, identity or passport number, date of birth, contact details, postal and residential address, medical aid scheme and membership details, and account and payment records. Where you are booking on behalf of a child or dependant, this includes their details and your relationship to them.

Health information — your medical and dental history, current medication and allergies, clinical findings, X-rays, photographs, scans, treatment plans, clinical notes, laboratory prescriptions, and correspondence with other healthcare providers about your care. POPIA treats health information as special personal information, which carries stricter conditions than ordinary personal information.

Website information — this site has no forms and stores nothing you type. The company that hosts it keeps standard server request logs, which record the page requested, the browser type, an approximate location derived from the network address, and the date and time. We do not use those logs to identify you.

Booking and payment happen on systems the practice does not host. The booking links go to our practice management provider, and credit applications go to MediWallet. Once you follow one of those links you are on their system, under their privacy terms.

Why do we collect it, and on what lawful basis?

We process your information in order to:

• assess, diagnose and treat you safely, and to maintain your clinical record;
• contact you about appointments, recalls, results and follow-up care;
• submit claims to your medical aid scheme, issue accounts and recover unpaid fees;
• instruct dental laboratories and refer you to other healthcare providers where your treatment requires it;
• meet legal, regulatory and professional record-keeping obligations; and
• run and improve the practice, including this website.

The lawful bases we rely on under POPIA are: performance of our agreement with you as a patient; compliance with legal obligations that apply to a healthcare practice; the legitimate interests of the practice and of you as a patient; and, where none of those apply, your consent. Health information is processed under the specific authorisation POPIA gives to healthcare providers to process such information for the purposes of proper treatment and care.

Where we rely on your consent — for example to send marketing messages or to use clinical photographs for teaching or promotion — you may withdraw it at any time, and withdrawing it will not affect your treatment.

How is your information stored and secured?

Clinical records are held in the practice management system and, where paper records exist, in the practice itself. Access is restricted to the dental professionals and administrative staff who need it to do their work, and all staff are bound by confidentiality obligations that survive the end of their employment.

We apply reasonable technical and organisational safeguards — access controls, authentication, backups and encrypted transmission where available — appropriate to the sensitivity of health information. No system is absolutely secure, and no transmission over the internet can be guaranteed, so we cannot promise absolute security. If a security compromise affects your personal information, we will notify you and the Information Regulator as POPIA requires.

Please do not send clinical details, identity numbers or medical aid numbers by email or WhatsApp unless you are willing to accept the risk that those channels are not encrypted end to end for our purposes.

Who do we share your information with?

We do not sell your information, and we do not share it beyond what your care or our legal obligations require. Recipients may include:

• Your medical aid scheme or its administrator, where you ask us to claim on your behalf. Schemes require diagnostic and procedure codes, and sometimes supporting clinical information, before they will pay a claim.
• Dental laboratories, which receive the prescription, impressions or scans needed to make your restoration.
• Other healthcare providers — specialists, your medical practitioner, radiology providers — where you are referred or where your care requires it.
• Service providers acting as operators on our behalf, such as the practice management system, backup and hosting providers, and the appointment or communication tools we use. They may process your information only on our instruction.
• Debt recovery agents, auditors and legal advisors, where an account is unpaid or where we need professional advice.
• Regulators, courts and other authorities, where we are legally compelled to disclose.

Some service providers store information outside South Africa. Where that happens, POPIA requires that the receiving jurisdiction or the contract with the provider offers protection comparable to POPIA, and we contract on that basis.

How long do we keep your records?

Health records are not kept at our discretion. South African law and professional rules impose minimum retention periods for patient records — longer for the records of children and for certain categories of care — and we retain clinical records for at least the applicable statutory minimum, and longer where there is a legal reason to do so.

Financial and account records are kept for the periods required by tax and company legislation. Information we no longer have a lawful reason to hold is destroyed or de-identified.

The exact retention periods and the disposal method must be confirmed at legal review and stated here explicitly. They are deliberately not given as figures in this draft.

Cookies and this website

This website sets no cookies. It runs no analytics, no advertising pixels and no third-party tracking scripts, so there is nothing to consent to and no preference to set. If that changes, this section will be updated before the change goes live.

The site may link to external sites we do not operate, including map, booking and social platforms. Their privacy practices are their own, and we have no control over them.

What are your rights under POPIA?

As a data subject you have the right to:

• be told what personal information we hold about you and who has had access to it;
• access that information, subject to the procedures and fees the Act allows;
• ask us to correct or delete information that is inaccurate, irrelevant, excessive, out of date, incomplete, misleading or obtained unlawfully;
• object to processing on reasonable grounds, and to object at any time to direct marketing;
• withdraw consent where processing is based on consent; and
• complain to the Information Regulator, or to a court, if you believe your information has been handled unlawfully.

One limit is worth stating plainly: a clinical record is a contemporaneous account of what was found and done. You may have factual errors corrected and may add your own statement to the record, but a clinical entry cannot simply be deleted while the statutory retention period runs.

To exercise any of these rights, contact the Information Officer below. We may need to verify your identity before acting on a request.

How do I contact the Information Officer?

The practice’s Information Officer is Nozipho Nuxmalo, Practice Manager.

Requests, questions and complaints about this policy or about how your information has been handled can be sent to the Information Officer at info@catforddental.co.za, or by post or in person at either practice. Contact details for both are on the contact page.

You do not have to come to us first, and you do not have to accept our answer. If you are not satisfied — or would simply rather not raise it with the practice — you may complain directly to the Information Regulator of South Africa:

• inforegulator.org.za
• Complaints: POPIAComplaints@inforegulator.org.za
• General enquiries: enquiries@inforegulator.org.za
• JD House, 27 Stiemens Street, Braamfontein, Johannesburg, 2001

Before launch: confirm the Information Officer’s registration with the Information Regulator has been lodged. Note also that POPIA defines the Information Officer of a private body via the PAIA definition of “head” — a practice manager is more usually designated a Deputy Information Officer, with the head of the practice as Information Officer. Confirmed as intended by the practice in a legal capacity; the registration itself is the outstanding step.

Changes to this policy

We may update this policy as the practice, the law or our systems change. The current version is always the one published on this page, and material changes will be signposted here.