PAIA Manual

The Promotion of Access to Information Act 2 of 2000 (PAIA) gives effect to the constitutional right of access to information held by another person where that information is required for the exercise or protection of any right. Section 51 requires every private body to compile and make available a manual describing the records it holds and how they may be requested.

This manual is that manual. It concerns records held by MemberSavi / Dinnative Technologies (Pty) Ltd as a private body. It does not cover records held by a practice that uses CareSavi: a practice is a separate private body with its own PAIA manual, and a request about a patient record should go to that practice.

Where we hold patient information, we hold it as an operator on a practice's instruction. See §1 of the Privacy Notice for what that means and who to approach.

The head of a private body is its Information Officer for PAIA purposes and its responsible party's Information Officer for POPIA purposes. Requests under this manual go to the Information Officer.

No Deputy Information Officer has been designated (POPIA s56 requires deputies only where they are necessary), so the Information Officer handles all requests under this manual.

Section 10 of PAIA requires the Information Regulator to compile a guide, in each official language, on how to use the Act. The guide explains how to lodge a request, the fees payable, the available remedies and the contact details of every public and private body's Information Officer.

The guide is available from the Information Regulator at inforegulator.org.za, or on request from enquiries@inforegulator.org.za · 010 023 5200 (toll-free 0800 017 160).

The following are published or provided on request without a formal PAIA request, and no request fee applies:

• this manual;
• the Privacy Notice, including the sub-processor register;
• the Terms of Service and published pricing;
• product and security documentation we choose to publish on caresavi.com;
• information a company is required to make public under the Companies Act 71 of 2008.

We have not published a notice under section 52(2) of PAIA listing further categories of records automatically available on payment of a prescribed fee.

The subject categories below describe the records we hold and the kinds of records in each. Listing a category here is not an undertaking that a particular record will be released. Access is decided against the grounds in §10.

Records may be held electronically, on paper, or both. Records containing personal information are held in the Republic of South Africa as described in §6 of the Privacy Notice.

Records are also kept in terms of, among others: the Companies Act 71 of 2008; the Income Tax Act 58 of 1962; the Value-Added Tax Act 89 of 1991; the Tax Administration Act 28 of 2011; the Basic Conditions of Employment Act 75 of 1997; the Labour Relations Act 66 of 1995; the Employment Equity Act 55 of 1998; the Unemployment Insurance Act 63 of 2001; the Compensation for Occupational Injuries and Diseases Act 130 of 1993; the Occupational Health and Safety Act 85 of 1993; the Electronic Communications and Transactions Act 25 of 2002; the Consumer Protection Act 68 of 2008; and the Protection of Personal Information Act 4 of 2013 together with the Regulations relating to the Processing of Data Subjects' Health Information, 2026.

Section 51 of PAIA, as amended by POPIA, requires this manual to describe the personal information we process, the purposes, the categories of data subjects and recipients, any transfer outside South Africa, and a general description of our security measures. All of that is set out in full in the Privacy Notice, which forms part of this manual. In summary:

A data subject exercising a POPIA right (access, correction, objection, deletion) should use the routes in Privacy Notice §11 rather than a PAIA request. They are different mechanisms with different timelines and fees.

1. Use the prescribed form. Complete the form prescribed for a request for access to a record of a private body under the PAIA Regulations. The current form is available from the Information Regulator's website and, on request, from our Information Officer.
2. Give enough detail. Provide sufficient particulars to identify the record and the Information Officer handling it, your identity, and the postal address, email address or other contact where the reply must go.
3. State the right you are exercising or protecting, and explain why the record is required for that right. Section 50 of PAIA makes this a condition of access to a record of a private body.
4. Say what form of access you want (a copy, an inspection, a transcription) and whether you need it in a particular language or format, including any assistance you need because of a disability.
5. Send it to the Information Officer at the address in §3, together with proof of the request fee where one is payable.

Where a request affects a third party's information, we must notify that third party and give them an opportunity to make representations before we decide, as PAIA requires.

We will decide the request and notify you of the outcome within 30 days of receiving it. That period may be extended by a further period, of not more than 30 days, in the circumstances PAIA allows, for example where the request covers a large number of records or requires a search of records held elsewhere. We will tell you if it is extended, and why.

Access may be refused, in whole or in part, on the grounds PAIA sets out for private bodies, including:

• Privacy of a third party: unreasonable disclosure of personal information about a natural person (s63). Patient records held on a practice's behalf will ordinarily fall here.
• Commercial information of a third party: trade secrets, confidential financial or commercial information (s64).
• Confidential information whose disclosure would breach a duty of confidence owed to a third party (s65).
• Safety of individuals and protection of property (s66).
• Legally privileged records (s67).
• Our own commercial information: trade secrets, information that would harm our commercial or financial interests, or information supplied in confidence in a contractual negotiation (s68).
• Research information of a third party or of the body (s69).

Access must nevertheless be given where the public-interest override in section 70 applies. Our notice will give reasons for any refusal and explain the remedies in §12.

Two kinds of fee may apply, both at the rates prescribed by the PAIA Regulations rather than set by us:

• A request fee, payable before a request is processed. A personal requester (someone requesting a record about themselves) pays no request fee (PAIA s54(1)).
• An access fee, payable before a record is released, covering reproduction, search and preparation time, and postage or delivery where applicable. Where search and preparation will take more than the prescribed number of hours, a deposit may be required.

The schedule in force is Annexure B to the Regulations Relating to the Promotion of Access to Information, 2021 (Government Gazette 45057, 27 August 2021), as published by the Information Regulator at inforegulator.org.za. For a private body:

We will give you a written fee estimate before incurring any cost, and you may withdraw the request rather than pay it. A decision on a fee, a deposit or an extension may be taken on the remedies in §12.

There is no internal appeal against a decision of a private body under PAIA. If we refuse a request, or you are unhappy with a decision about a fee, a deposit, an extension or the form of access, you may:

1. Lodge a complaint with the Information Regulator under section 77A of PAIA, on the prescribed form, ordinarily within 180 days of the decision; or
2. Apply to a court with jurisdiction under section 78 of PAIA for appropriate relief.

Information Regulator (South Africa): inforegulator.org.za.

This manual is available free of charge on this website, and on request from the Information Officer in the format and language a requester reasonably needs. A copy is lodged with the Information Regulator as required.

We review this manual at least annually and whenever the records we hold, our processing, or our contact details change. The version and effective date are at the top of this page.