This notice explains what personal information Paediatric Chiropractic Africa collects, why we collect it, who we share it with, and what you can ask us to do about it.
We are the responsible party for the information described here, as that term is used in the Protection of Personal Information Act 4 of 2013 (POPIA).
Who this applies to
This notice covers three groups of people, and what we hold differs for each:
- Members — chiropractors who belong to the association.
- Visitors — anyone using the website, including parents searching the practitioner directory.
- Event attendees — anyone who registers for a seminar, symposium or course, whether or not they are a member.
What we collect, and why
Everyone who contacts us
When you use a contact form or send an enquiry to a practice through our directory, we collect your name, email address, telephone number if you give one, and your message. Where the enquiry form asks, we also collect the age of the child you are enquiring about and your preferred appointment time. We collect this so that we, or the practice you contacted, can reply to you. We keep a record of the enquiry so that we can answer a query about it later.
We do not need your child's name and do not ask for it. Please do not include a child's full name or any clinical detail in an enquiry form — send that to the practice directly once they have replied.
Members
To administer your membership we hold your name, email address, mobile and alternative telephone numbers, practice or company name, job title, and your professional registration numbers (HPCSA and AHPCSA). We hold your membership type, its start and expiry dates, your membership number, and the record of what you have paid.
If you publish a directory listing, we also hold what you choose to put in it: your professional profile, qualifications, the year you began practising, your photograph, and the details of each practice you work from — including its address, coordinates, opening hours, contact details and photographs.
Event attendees
When you register for an event we hold your name and contact details, which ticket you bought and what you paid, your answers to any questions the event asks, and your attendance — the time you were checked in at the door, and out again. Where an event is catered we ask about dietary requirements. If you tell us about an allergy or a requirement arising from a health condition or a religious observance, that is special personal information, and we use it only to brief the caterer.
Attendance is what CPD certificates are issued from, so we keep the record of it for as long as you might need to prove your CPD.
Exhibitors at our events
If you allow an exhibitor to scan your badge at an event, that exhibitor receives your name, practice, email address and mobile number, and they may record a note or a voice memo about your conversation. The exhibitor is a separate responsible party for what they then do with it. If you would rather not share your details with a stand, do not let them scan your badge.
Everyone who visits the website
Our servers record the IP address of requests, which we use to limit abuse of our forms and to investigate problems. We record how many times a directory listing was viewed, as a daily total rather than a log of individual visits. If you allow your browser to share your location so that we can show you the nearest practitioners, that location is used for the search and is not stored.
Email we send you
When we send you a newsletter or an announcement, we record whether it was opened and which links were clicked. We do this to understand which messages are useful. Every such message carries an unsubscribe link, and unsubscribing stops all marketing email immediately. Messages about your own account — a payment receipt, a renewal notice, an event ticket, a certificate — are not marketing and continue regardless, because you need them.
What we do not collect
- We never see your card details. Payments are taken by PayFast on their own pages; we receive only a confirmation that a payment succeeded, its amount and its reference.
- We do not collect clinical or patient records. Whatever passes between you and your chiropractor stays with them.
- We do not buy personal information from anyone, and we do not sell yours.
Why we are allowed to hold it
We rely on different grounds for different information. Most of what we hold about members is necessary to perform the membership agreement between us. Some of it we hold to comply with obligations — records of payments, and of CPD attendance. Directory listings and marketing email rest on your consent, which you can withdraw. Where we rely on our legitimate interests, such as keeping the site secure and preventing abuse of our forms, we have weighed that against your rights.
Who we share it with
We use a small number of service providers, each of which processes information on our behalf:
- PayFast — takes payments. They receive your name, email address and the amount.
- Our email provider — delivers our email. Our mail is sent through the mail servers of the company that hosts this website.
- Meta Platforms — delivers WhatsApp messages, where you have given us a mobile number and we message you that way.
- SMSPortal — delivers SMS messages, used when WhatsApp is unavailable.
- Google — converts a practice address into map coordinates, and displays maps on listing pages.
- YouTube and Vimeo — host the videos in our member library. Watching one means your browser contacts them.
- Our hosting provider — stores this website and its database.
Some of these are outside South Africa, which means your information may be processed in another country. We use established providers who are contractually bound to protect it.
A directory listing is public. Anything you publish in it — including your practice address, telephone number and photographs — is visible to anyone and may be indexed by search engines. That is the purpose of the directory, but it is worth being deliberate about what you put there.
We will disclose information where the law requires it, or where it is necessary to establish or defend a legal claim.
How long we keep it
- Membership and payment records — for as long as you are a member, and afterwards for the period our record-keeping obligations require.
- Attendance and CPD records — kept indefinitely, because they are the evidence behind a certificate you may be asked to produce years later.
- Enquiries — kept while we deal with them and for a reasonable period afterwards in case of a follow-up query.
- Email open and click records — kept while the campaign's performance is still of interest.
- Website and payment logs — pruned automatically; security logs are kept for 30 days.
If you ask us to delete your information, we will do so except where we are required to keep it.
Your rights
Under POPIA you may:
- ask what personal information we hold about you, and get a copy;
- ask us to correct anything that is wrong or incomplete;
- ask us to delete information we no longer have a reason to keep;
- object to us using your information for direct marketing — you can also simply use the unsubscribe link in any message;
- withdraw a consent you have given, without affecting what we did before you withdrew it;
- complain to the Information Regulator.
Members can see and correct most of what we hold directly in the member portal. For anything else, write to us using the details below.
Security
Passwords are stored hashed and cannot be read by us or recovered — if you forget yours, we reset it rather than tell you what it was. The site is served over an encrypted connection. Certificates, uploaded documents and voice recordings are stored outside the public web root and are served only to the person entitled to them, after we check. Access to the administration area is limited to the people who need it, and significant actions are logged.
No system is perfectly secure. If a breach occurs that creates a real risk to you, we will notify you and the Information Regulator as POPIA requires.
Cookies
We use a single cookie to keep you signed in and to protect forms against cross-site request forgery. It is necessary for the site to work and is not used for advertising or for tracking you across other websites. We do not use advertising or analytics cookies. Videos embedded from YouTube and Vimeo are loaded in their privacy-preserving modes, but playing one may still set cookies belonging to those services.
Children
This website is intended for adults. We do not knowingly collect information directly from children. Where a parent or guardian tells us the age of a child in an enquiry, we use it only to pass the enquiry on.
Contacting us
For any question about this notice, or to exercise any of the rights above, contact us using the details on our contact page. We will respond as soon as we reasonably can.
You may also complain directly to the Information Regulator of South Africa.