Privacy notice

How we handle your information

---

We look after health information about people at their most vulnerable. This page explains in plain English what we collect, why, who sees it, and what you can ask us to do about it.

Last updated: 25 August 2026  ·  This notice is issued under the Protection of Personal Information Act 4 of 2013 (POPIA).

1. Who we are

The Care Co (Pty) Ltd, trading as The Care Co @ Home, is a home care provider based in Gqeberha (Port Elizabeth), Eastern Cape. Under POPIA we are the "responsible party" for the personal information described below.

Company

The Care Co (Pty) Ltd

Registration number

2026/410791/07

Information Officer

Sinta Schroeder, Director and Registered Nurse (SANC 14777502)

Email

sinta@thecareco.co.za

Telephone

+27 69 711 3278

Area

Gqeberha, Eastern Cape, South Africa

2. Who this notice is for

Two different groups of people, with very different amounts of information involved:

• Visitors to this website. We collect almost nothing about you. Section 3 covers it.
• Patients, their families and their representatives. Once we're arranging or providing care, we hold detailed information including health information. Sections 4 to 10 cover that.

Our carers and job applicants are covered by a separate employment privacy notice, available from Sinta on request.

3. If you're visiting this website

This site is deliberately simple. There is no enquiry form, no account to create, and nothing to sign up for.

• No cookies. We don't set cookies of our own, and we don't use tracking or advertising cookies.
• No analytics. We don't run Google Analytics or any similar visitor-tracking script.
• No social media pixels. Nothing on this site reports your visit back to Facebook, Instagram or anyone else.
• Server logs. Our hosting provider, Cloudflare, keeps standard technical logs (including IP addresses and the time of a request) to keep the site running and to protect it from attack. We don't use those logs to identify or profile visitors.

If you contact us by WhatsApp, telephone or email, we keep that message or a note of the call so we can respond and, if care follows, so there is a record of how the enquiry began. WhatsApp is operated by Meta and your use of it is also subject to Meta's own terms and privacy notice.

The site loads its fonts from Google Fonts, which means Google's servers receive the IP address making the request. No cookie is set by this.

4. If we're providing care

To assess someone, write a care plan, and deliver care safely, we need to collect and keep:

• Names, contact details and physical address of the patient and the family member or representative arranging care
• Date of birth and South African ID number, where needed for records, invoicing or a medical aid claim
• Next of kin and emergency contact details
• Medical aid scheme, plan and membership number, where applicable
• Details of the patient's doctors and other healthcare professionals involved
• Health information, as set out in section 5
• Practical information about the home relevant to care, such as access, stairs or falls risks
• Notes made during care, handovers between carers, and records of reviews and visits

Most of this comes from you. Some may come from a hospital, GP, specialist, social worker or care facility referring the patient to us, with the patient's or representative's knowledge.

5. Health information

POPIA treats information about a person's health as "special personal information" and prohibits processing it unless a specific exception applies (sections 26 and 32).

The health information we hold can include diagnoses and medical history, current medication, vital signs and other monitoring records, wound care and dressing records, catheter care records, mobility and falls risk, nutrition and swallowing needs, continence needs, and mental health or cognitive screening including for children.

We rely on two grounds for processing it:

• Provision of care. POPIA permits a care provider to process health information where it is necessary for the proper treatment and care of the person, subject to a duty of confidentiality.
• Agreement to care. Care is only ever arranged with the agreement of the patient, or of a person legally entitled to act on their behalf.

We collect what is needed to deliver care safely, and nothing beyond that. If we ask for something and you can't see why, ask us. If we can't explain the reason, we shouldn't be holding it.

6. Children's information

We provide home-based care for children living with disability, so we process information about children.

POPIA requires the consent of a competent person, normally a parent or legal guardian, before a child's personal information may be processed. Care for a child is arranged with that parent or guardian, and their agreement is taken before any assessment. We keep the same information for a child that we would for an adult, no more.

Where a child is old enough to understand and take part in decisions about their care, we involve them, whatever the legal position on consent.

7. Why we use it

• To carry out a clinical assessment and write an individual care plan
• To match a suitable carer and brief them on what the person needs
• To deliver care safely, and to hand over properly between carers and shifts
• To review the care as the person's needs change
• To invoice, and to prepare invoices and motivation letters for a medical aid where you ask us to
• To keep the clinical and business records that professional and legal obligations require
• To respond if there's a complaint, an incident or a claim

We don't use anyone's information for marketing, and we don't build profiles or make automated decisions about people.

8. Who we share it with

Only the people who need it to look after the person properly:

• The assigned carer, who receives what they need to deliver that person's care, not the whole file
• The rehabilitation doctor who supports our clinical oversight, where a medical review is needed
• The patient's own doctors, so that care at home lines up with their treatment
• Other healthcare professionals such as physiotherapists, occupational therapists, speech therapists, dieticians and wound care specialists, where the patient or representative has agreed
• A referring hospital, care facility or social worker, as part of a formal handover
• A medical aid scheme, where you ask us to invoice them or write a motivation
• Our service providers, such as accounting and IT support, under agreements requiring them to protect the information and use it only for what we've asked them to do
• A court, regulator or professional body, where the law requires it

We do not sell personal information. We do not share it for advertising. We do not give it to anyone else without a lawful reason.

9. How long we keep it

Health records have to be kept for a set minimum period, because a person may need their history years later and because claims can be brought long after care has ended.

• Adults: at least six years from the last entry in the record.
• Children: until the child's 21st birthday, because a person has three years after turning 18 to bring a claim.
• Financial and tax records: as long as tax and company law requires, normally five years.

These periods follow section 13 of the National Health Act and the record-keeping guidance applied in South African healthcare.

When a retention period ends, records are destroyed securely. Paper records are shredded and electronic records are deleted.

10. How we protect it

We're a small organisation, so here is honestly what that looks like in practice:

• Devices holding client information are password protected and encrypted
• Only Sinta has access to complete client files
• Carers see the care plan and the information relevant to their patient, not other people's records
• Paper records are kept locked away and are not left in vehicles or homes
• Carers sign confidentiality obligations as part of their contract, and those continue after they leave
• We avoid sending health information over WhatsApp, and we ask families not to either
• Records are backed up so that information isn't lost

If something goes wrong and personal information is lost or accessed by someone who shouldn't have it, POPIA requires us to notify the Information Regulator and, in most cases, the people affected. We will do that.

11. Your rights

Under POPIA you can ask us to:

• Tell you what we hold about you, and give you a copy
• Correct or complete anything that's wrong or out of date
• Delete or destroy information we no longer have a lawful reason to keep
• Object to how we're using it, in the circumstances POPIA allows
• Withdraw consent you previously gave, though this may mean we can no longer provide care safely, and it doesn't affect records we're legally required to keep

To exercise any of these, email sinta@thecareco.co.za or call +27 69 711 3278. We may need to confirm your identity, and where you're asking on someone else's behalf we'll need to establish that you're entitled to. There is no charge for a correction. A formal request for access to records may carry a prescribed fee.

You also have rights under the Promotion of Access to Information Act (PAIA). Our PAIA manual sets out what records we hold, how to make a request, what it costs and how long it takes.

12. Making a complaint

Speak to Sinta first. Most concerns are a misunderstanding and are quicker to fix directly.

If you're not satisfied, you can complain to the Information Regulator of South Africa, which oversees POPIA and PAIA. Complaints must be made in writing, in the prescribed manner, through the Regulator's eServices portal.

Information Regulator

inforegulator.org.za

POPIA complaints

POPIAComplaints@inforegulator.org.za

eServices portal

eservices.inforegulator.org.za

13. Information held outside South Africa

This website is served by Cloudflare, a global network, so a request for a page may be handled by a server outside South Africa. The website itself holds no client information, so this affects technical logs only.

Where we use an email or file storage service that stores data outside the country, POPIA requires that the information receives a comparable level of protection to South African law. We take that into account when choosing a provider.

14. Changes to this notice

If how we handle information changes, we'll update this page and change the date at the top. Where a change materially affects people currently receiving care, we'll tell them directly rather than rely on them checking the website.