Holistic Health by Dr. Stoni is a private medical practice led by Dr. Stoni Lawrence. The practice is the responsible party for the personal information processed through this platform.

Privacy queries: holistichealthbydrstoni@gmail.com

• Identifying and contact information: name, date of birth, sex, phone number, email address, emergency contact details.
• Administrative information: medical aid scheme and membership number, appointment and booking details, enquiries and messages you send us.
• Health information: your pre-assessment answers, symptoms, medical and family history, medication, supplements and allergies, measurements and vital signs, lifestyle and wellbeing information, antenatal and reproductive health information, investigation and laboratory results, and the clinical records created by your doctor.
• Technical information: secure authentication data and access logs needed to keep your record safe.

Health information is special personal information under the Protection of Personal Information Act (POPIA). It is treated with a higher level of care and is only processed where the law permits — principally for the provision of medical care by a health professional bound by professional confidentiality, and with your consent.

• To assess, diagnose, treat and follow up your health concerns.
• To prepare for and conduct your consultations, including antenatal care.
• To create and maintain your longitudinal clinical record over time.
• To create dietary, fitness and other care plans you have asked for.
• To manage bookings, communication, billing and medical aid administration.
• To meet legal, professional and record-keeping obligations (HPCSA, POPIA, National Health Act).

We do not sell your information, and we do not use it for advertising or automated decision-making about your care.

• Dr. Stoni Lawrence, as your treating doctor.
• Authorised practice personnel acting under the doctor's instruction, only to the extent required for administration, and bound by confidentiality.
• Laboratories, radiology providers or other healthcare providers where a referral or investigation is required for your care.
• Our secure hosting and database providers, who process data on our instruction and may not use it for their own purposes.
• Your medical aid, only where you ask us to submit a claim on your behalf.
• Anyone else you specifically authorise, or where the law requires disclosure.

• Your record is accessible only from your own authenticated account.
• Database-level access rules prevent one patient from seeing another patient's information under any circumstances.
• Clinician access requires two-factor authentication in addition to a password.
• Access to clinical records — reading as well as changing — is logged in an audit trail attributable to the individual account.
• Information is encrypted in transit and at rest by our hosting provider.
• Private clinical notes written by your doctor are kept separate from information released to you, and are not visible in your portal.

No system can be guaranteed absolutely secure, but we take reasonable technical and organisational measures appropriate to the sensitivity of health information.

Health records must be retained for the periods required by law and by professional guidance. As a general rule:

• Adult clinical records: retained for at least 6 years from the last consultation.
• Records of a minor: retained until the patient's 21st birthday, and for the applicable period thereafter.
• Records relating to pregnancy and antenatal care: retained in line with the applicable obstetric record-keeping requirements.
• Enquiries, bookings and non-clinical administrative data: retained only for as long as needed for the purpose collected.

Clinical records are never deleted automatically. Where the retention period has lapsed and no legal obligation requires further retention, records may be deleted or de-identified by the doctor as a deliberate, audited action.

Subject to POPIA and to the practice's legal record-keeping duties, you may: ask what information we hold about you; request access to your record; ask us to correct information that is inaccurate or incomplete; object to certain processing; withdraw consent for processing that is not legally required; and request deletion of information we are not obliged to retain.

You may also lodge a complaint with the Information Regulator (South Africa). Giving consent on this platform does not remove or limit any right you have under POPIA or any other law.

To exercise a right, email holistichealthbydrstoni@gmail.com. You can also submit a deletion request from your patient portal; the doctor reviews every request and will tell you which information must legally be retained.

Before you submit health information through the pre-assessment, you are asked to confirm that you have read and understood this notice and that you consent to the collection and processing of your personal and health information for the purposes described. We record the date and time of that consent and the version of this notice you accepted.

You may withdraw consent at any time by contacting the practice. Withdrawal does not affect processing that already took place, and does not permit us to delete records we are legally required to retain.

Automated prompts in this platform are clinical review flags that help your doctor prioritise what to discuss with you. They are not a diagnosis, not a test result, and not a substitute for a consultation. Only Dr. Stoni makes clinical decisions about your care.