Patient and caregiver notes.

Draft for review by the Information Officer. Last updated October 2026.

1. Scope

This review covers personal information recorded after a patient is admitted: patient records (name, centre, room, daily routine), scheduled therapy sessions, treatment notes written by staff, caregiver daily notes, and the caregiver contact details used for portal access. Admission enquiries and assistance applications are covered by the main privacy notice.

2. Responsible party and Information Officer

StrokeRehabCo (Pty) Ltd is the responsible party for all patient and caregiver notes. Sukuma Uhambe NPC does not have access to these notes. The Information Officer can be reached at info@strokeretherapycompany.com.

3. Information processed

• Patient record: full name, centre, room and daily routine.
• Sessions: date, time, length, type of therapy and the staff member responsible.
• Treatment notes: clinical observations, progress and therapy given, with date and author.
• Caregiver daily notes: observations for each part of the routine (for example morning or evening), with date and author.
• Caregiver details: email address and optional name.

Treatment and caregiver notes are health information, which is special personal information under section 26 of POPIA.

4. Purpose and lawful basis

• Purpose: to plan, deliver and coordinate rehabilitation and daily care, keep the care team and family informed, and meet healthcare record-keeping duties.
• Lawful basis: the patient's (or legal representative's) explicit consent (section 27(1)(a)), and processing by a healthcare provider for proper treatment and care (section 32(1)(b)), subject to confidentiality duties.
• Notes are never used for marketing, sold, or used for any purpose not listed here.

5. Consent

Before any notes are recorded, the patient or their legal representative signs a consent form at admission. A copy is kept in the patient's file. The form must include the following:

Each invited caregiver also agrees, when first signing in, to keep the notes confidential and to use them only to support the patient's care.

6. How caregivers join the portal

1. The patient or legal representative names the caregiver on the consent form.
2. A staff member adds the caregiver's email address to the patient record in the Admissions Portal.
3. The caregiver creates their own account with that same email address and confirms it from their inbox.
4. Once signed in, the caregiver sees only the patient(s) they were invited for, and can read and add daily notes. They cannot see treatment notes, other patients, enquiries or room bookings.
5. Access ends when staff remove the caregiver's email from the patient record, or when consent is withdrawn.

7. Who can access the notes

• Staff granted the staff role by an administrator: all patient records, sessions and notes.
• Caregivers: only the daily notes for their linked patient.
• The public: no access. Signed-out visitors, and signed-in users without staff access or a caregiver link, see nothing.

These limits are enforced by the database itself, not only by hiding parts of the page.

8. Security safeguards

• All data travels over an encrypted connection and is stored in a private, access-controlled database.
• Each person signs in with their own account. Shared accounts and shared passwords should not be used, and staff should use strong, unique passwords.
• Notes cannot be edited or deleted once saved. Corrections are added as a new note, keeping a complete record of who wrote what and when.
• Staff access is granted and removed by an administrator, and should be removed promptly when a staff member leaves.

9. Retention and deletion

We retain treatment notes, session records and caregiver notes as part of the patient health record, following the Health Professions Council of South Africa’s Guidelines on the Keeping of Patient Health Records (Booklet 9, revised September 2022). The guidelines recommend indefinite electronic retention where practical. If that is not practical, the minimum periods are:

• Adults: at least six years from when the record becomes dormant, meaning the date the patient was last treated by a healthcare practitioner.
• Patients treated while under 18: at least until their 21st birthday, or the six-year minimum after last treatment if later.
• Patients with mental incapacity: for the patient's lifetime.

Where the Occupational Health and Safety Act applies, records must be kept for 20 years after treatment. Records relating to conditions with a long latency may need to be kept for at least 25 years. Any longer statutory period, ongoing care need, legal claim or other applicable obligation takes precedence. Once the applicable retention period has ended and no other lawful reason to keep the record remains, it is securely disposed of in accordance with the organisation’s records policy.

10. Rights of patients and caregivers

Patients (or their legal representatives) and caregivers may ask to see their information, ask for corrections, object to processing, withdraw consent or complain. Requests go to info@strokeretherapycompany.com and will be answered within 30 days. Complaints may also be lodged with the Information Regulator (inforeg.org.za).

11. Security incidents

If notes are accessed without authorisation, StrokeRehabCo will contain the incident, notify the Information Regulator and affected people as soon as reasonably possible (section 22), and record the steps taken.

12. Open review points

• Confirm the named Information Officer and register them with the Information Regulator.
• Have your clinical lead confirm the retention periods in section 9.
• Adopt the consent form above, on paper or electronically, before recording notes for real patients.
• The room helper on centre pages sends what families type to an AI service to suggest rooms. Decide whether to mention this in the main privacy notice.