top of page

Patient Data Processing Policy

Last Updated: 04 AUGUST 2026

1.    Introduction

Crestcare is committed to protecting your privacy and Processing your Personal Information responsibly, securely and in accordance with the Protection of Personal Information Act 4 of 2013 ("POPIA"), applicable healthcare legislation and other applicable laws.


This patient data processing policy ("Policy") explains how Crestcare collects, uses, stores, shares and otherwise Processes the Personal Information submitted through the Crestcare Patient Pre-Admission Platform ("Platform") as part of your pre-admission to a Crestcare hospital. It applies whether you submit information for yourself or on behalf of another person whom you are authorised to represent.


The Platform is designed to facilitate the pre-admission process by enabling patients, parents, legal guardians and authorised representatives to submit the information reasonably required to prepare for a patient's admission to a Crestcare hospital.
The Personal Information submitted through the Platform is collected and Processed for the purposes described in this Policy, including facilitating and administering your pre-admission and admission, preparing for and providing healthcare services, and complying with applicable legal, regulatory and professional obligations. Depending on the information you submit, this may include the Processing of Special Personal Information, including Health Information, in accordance with POPIA, applicable healthcare legislation and other applicable laws.


In this Policy, references to:

  • "Crestcare", "we", "us" and "our" means Crestcare Healthcare Group (Pty) Ltd, Crestcare (Pty) Ltd and the following hospitals: 

    • Crestcare Zoutpansberg Private Hospital; 

    • Crestcare St Mary’s Private Hospital;

    • Crestcare Malmesbury Private Hospital; and

    • any other hospital owned, operated and/or managed by Crestcare Healthcare Group (Pty) Ltd and/or Crestcare (Pty) Ltd from time to time.     

                       

  • “Crestcare Entity” means the specific Crestcare company or hospital responsible for collecting and Processing the Personal Information you submit through the Platform for the purposes of facilitating and administering your pre-admission and preparing for your admission to a Crestcare hospital.

2. Scope

This Policy explains how Crestcare collects and Processes Personal Information through the Platform.

​

This Policy applies to the Processing of Personal Information relating to, among others:

​

  • patients seeking admission to a Crestcare hospital;

  • parents, guardians or authorised representatives who submit information on behalf of a patient;

  • children or other dependants whose Personal Information is provided as part of the admission process;

  • emergency contacts, next of kin and other individuals whose Personal Information is provided in connection with a patient's admission or treatment; and

  • referring healthcare practitioners, where applicable.

 

This Policy applies only to the Personal Information submitted through the Platform as part of the pre-admission process. It does not apply to the collection or Processing of Personal Information by the relevant Crestcare Entity outside the Platform or after your admission to a Crestcare hospital, which will be governed by the relevant Crestcare Entity's applicable privacy documentation and legal obligations.

3. Definitions

Unless the context indicates otherwise:

​

3.1.  "Health Information" means information relating to a person's physical or mental health, medical history, diagnosis, treatment, disabilities, medication, allergies, laboratory results, or any other information concerning that person's health status;

​

3.2.  "Personal Information" has the meaning assigned to it in POPIA;

​

3.3.  "Processing" has the meaning assigned to it in POPIA and includes any operation or activity concerning Personal Information, whether or not by automatic means, including its collection, receipt, recording, organisation, collation, storage, updating, modification, retrieval, alteration, consultation, use, dissemination by means of transmission, distribution or making available in any other form, merging, linking, restriction, degradation, erasure or destruction. The terms "Process", "Processes" and "Processed" shall bear corresponding meanings; and

​

3.4.  "Special Personal Information" has the meaning assigned to it in POPIA and includes, amongst other things, information relating to a person's health or biometric information.

4. How We Collect Your Information

In connection with your use of the Platform, Crestcare generally collects the Personal Information covered by this Policy directly from you whenever you:

​

  • complete a pre-admission form through the Platform; and/or

  • otherwise provide information through the Platform in connection with your pre-admission.

 

Where required to verify or supplement the information submitted through the Platform, or to facilitate your admission and the provision of healthcare services, Crestcare may also obtain Personal Information from:

​

  • your treating healthcare practitioner;

  • your referring practitioner;

  • your medical scheme or other healthcare funder;

  • your parent or legal guardian;

  • your authorised representative;

  • another healthcare provider involved in your admission or treatment; and/or

  • other lawful sources, including publicly available records, where permitted by applicable law.

 

You are responsible for ensuring that the information you submit through the Platform is complete, accurate and kept up to date.

Where you provide Personal Information relating to another individual (including your spouse, dependant, emergency contact or next of kin), you confirm that you are authorised to provide that information and, where required by applicable law, have obtained any necessary consent or permission for Crestcare to collect and Process that Personal Information for the purposes described in this Policy.

5. Information We Collect

The categories of Personal Information collected through the Platform will depend on the nature of your proposed admission and the information reasonably required to facilitate and prepare for your admission to a Crestcare hospital. Depending on the circumstances, the Personal Information you submit through the Platform may include the following:

​

5.1 Personal Information

 

Crestcare may collect Personal Information including:

​

  • your full name and surname;

  • identity number or passport number;

  • date of birth;

  • age;

  • gender;

  • nationality;

  • ethnicity (Department of Health Reporting Requirement);

  • marital status, where relevant;

  • physical and postal address;

  • email address;

  • telephone numbers;

  • emergency contact details;

  • next of kin information;

  • preferred language;

  • billing information;

  • payment details required for your admission;

  • medical scheme details, including:​

    • membership number;

    • dependant code; and

    • principal member information

  • medical scheme name;

  • admission details, including:

    • the Crestcare hospital to which you are being admitted;

    • your treating or admitting healthcare practitioner;

    • your proposed admission date; and

    • details of the planned procedure or treatment, where applicable;

  • correspondence and communications relating to your pre-admission; and

  • any other Personal Information reasonably required to facilitate your pre-admission and prepare for your admission to a Crestcare hospital.

 

5.2. Special Personal Information (Health Information)

​

To facilitate your pre-admission and admission, and to prepare for and provide healthcare services to you, Crestcare may collect and Process the Health Information you provide through the Platform, including:

​

  • your medical history and current state of health;

  • current or previous medical conditions, illnesses and diagnoses relevant to your admission;

  • previous hospital admissions, surgical procedures or treatment history relevant to your proposed admission;

  • allergies, sensitivities and current medication;

  • pregnancy status, disability or mobility requirements, where relevant to your admission;

  • infectious disease status, where clinically relevant;

  • dietary requirements associated with your health or medical condition; and

  • any other Health Information you provide that is relevant to your proposed admission or the provision of healthcare services.

 

5.3. Information Relating to Minor Patients and Dependants

 

Where the patient is a child, or information relating to a minor dependant is required as part of the pre-admission process, Crestcare may collect:

​

  • the minor's identifying information;

  • date of birth;

  • medical scheme details;

  • Health Information relevant to the proposed admission;

  • parent or legal guardian details;

  • emergency contact information; and

  • information relating to parental responsibility or legal guardianship, where required.

 

Such information will generally be collected from a parent, legal guardian or another person legally authorised to act on behalf of the minor.

 

5.4. Technical Information

​

When you access or use the Platform, Crestcare may automatically collect limited technical information necessary to operate, secure and maintain the Platform, including:

​

  • device information;

  • browser type;

  • IP address;

  • date and time of access;

  • system logs; and

  • audit records relating to changes made to your information.

 

This information is collected primarily to maintain the security, integrity and functionality of the Platform and to detect, investigate and respond to unauthorised access, misuse or security incidents.

6. Why We Process Your Information

Crestcare Processes the Personal Information you submit through the Platform only for lawful purposes and in accordance with POPIA, applicable healthcare legislation and other applicable laws.

​

The Personal Information submitted through the Platform is Processed primarily to facilitate and administer your pre-admission, prepare for your admission to a Crestcare hospital and enable the provision of healthcare services to you. Depending on the information you provide and the nature of your proposed admission and healthcare services, your Personal Information may also be Processed for one or more of the following purposes:

​

6.1   Managing your pre-admission

​

To facilitate, coordinate and administer your pre-admission, we may Process your Personal Information to:

​

  • verify your identity;

  • register you as a patient within Crestcare's systems;

  • create or update your patient record;

  • process and administer your pre-admission;

  • confirm your admission details and communicate with you regarding your admission;

  • verify your funding or payment arrangements, where applicable;

  • prepare for your admission and the healthcare services you are expected to receive; and

  • facilitate the efficient administration and management of your admission.

 

6.2   Preparing for your admission and healthcare services

​

To prepare for your admission and enable the relevant Crestcare Entity and your treating healthcare practitioners to make the necessary arrangements for your admission and the provision of healthcare services, we may Process your Personal Information and Health Information to:

​

  • assess the information you provide before your admission;

  • identify allergies, medical conditions, medication requirements and other clinical considerations relevant to your admission;

  • assist healthcare practitioners in preparing for your admission and treatment;

  • coordinate your admission with your treating healthcare practitioners and other healthcare providers, where appropriate; and

  • ensure that the information required to facilitate your admission is available to authorised healthcare personnel.

 

6.3   Verifying funding

​

To facilitate your admission and the provision of healthcare services to you, we may Process your Personal Information to:

​

  • verify your medical scheme membership and healthcare funding details;

  • obtain any pre-authorisations required for your admission or healthcare services;

  • confirm your available healthcare benefits, funding arrangements or level of cover; and

  • liaise with your medical scheme, medical scheme administrator, healthcare funder or any other person or entity responsible for authorising or funding your admission or healthcare services.

 

6.4   Operating the Platform

​

To operate, maintain and improve the Platform, we may Process your Personal Information to:

​

  • administer, operate and maintain the Platform;

  • maintain the security, integrity and availability of the Platform and associated systems;

  • detect, investigate and resolve technical issues and security incidents;

  • maintain appropriate records relating to your use of the Platform; and

  • improve the functionality, security and user experience of the Platform.

 

6.5   Legal and regulatory purposes

​

We may Process your Personal Information to:

​

  • comply with POPIA, applicable healthcare legislation and other applicable laws;

  • respond to lawful requests from regulators, courts or competent authorities;

  • establish, exercise or defend legal rights;

  • investigate suspected fraud, unlawful conduct or security incidents; and

  • comply with applicable record-keeping and governance requirements.

 

6.6.   Statistical and Service Improvement Purposes

​

Where you choose to provide optional information through the Platform, including optional marketing-related information, the relevant Crestcare Entity may Process such information for statistical, reporting, analytical and service improvement purposes.

​

6.7.  Other lawful purposes

​

We may also Process your Personal Information for any other lawful purpose that is necessary for or incidental to facilitating your pre-admission and admission, providing healthcare services to you, operating the Platform, or complying with our legal, regulatory and professional obligations.

7. Processing of Special Personal Information

Some of the Personal Information submitted through the Platform constitutes Special Personal Information under POPIA, including Health Information relating to your physical or mental health, medical history, medical conditions, medication and other information relevant to your proposed admission.

​

Crestcare will Process your Special Personal Information only for the purposes described in this Policy, including facilitating your pre-admission and admission, providing healthcare services to you, and complying with POPIA and other applicable laws.

​

Access to your Special Personal Information is restricted to authorised personnel, healthcare practitioners and other persons who require access to that information to facilitate your pre-admission or admission, operate or support the Platform, comply with applicable legal obligations, or otherwise Process the information for the purposes described in this Policy. Such persons are subject to appropriate confidentiality obligations.

​

Crestcare will Process your Special Personal Information only where such Processing is authorised or required under POPIA or any other applicable law, and only for the purposes described in this Policy, including facilitating your pre-admission and admission and the provision of healthcare services to you.

8. Sharing Your Personal Information

Crestcare treats the Personal Information you submit through the Platform as confidential and will disclose it only to facilitate and administer your pre-admission and admission, the provision of healthcare services, the operation of the Platform, compliance with applicable law, or for the other purposes described in this Policy.

​

Depending on the nature of your proposed admission, the Personal Information you submit through the Platform may be shared with one or more of the following categories of recipients:

​

8.1. Healthcare Practitioners and Healthcare Providers

​

To facilitate your pre-admission, admission and the provision of healthcare services to you, Crestcare may share your Personal Information with healthcare practitioners and other healthcare providers involved in your proposed admission or healthcare services, including:

​

  • your admitting or treating healthcare practitioner;

  • specialists, surgeons or anaesthetists involved in your planned procedure;

  • pathology laboratories or radiology practices, where relevant to your proposed admission;

  • nursing or admissions personnel responsible for preparing for your admission; and

  • other healthcare practitioners or healthcare providers involved in facilitating your admission.

 

8.2. Hospital and Patient Management Systems

​

In connection with your pre-admission, admission and the provision of healthcare services, Crestcare may disclose and make your Personal Information available to patient administration, healthcare management, patient engagement and other operational systems used by or on behalf of Crestcare. Such systems may be operated, hosted or supported by third-party technology service providers engaged by Crestcare.

​

Crestcare will take reasonable steps to ensure that any third-party provider of such systems Processes your Personal Information only on Crestcare's documented instructions and in accordance with POPIA, other applicable laws and appropriate confidentiality and security obligations.

 

8.3. Medical Schemes, Healthcare Funders and Administrators

​

To verify funding and facilitate your admission and the provision of healthcare services, Crestcare may disclose your Personal Information to:

  • medical schemes;

  • medical scheme administrators;

  • managed healthcare organisations;

  • healthcare funders;

  • benefit administrators; and

  • any other person or entity responsible for authorising or funding your proposed admission.

 

These disclosures may be made for purposes such as obtaining pre-authorisation, confirming healthcare benefits or funding arrangements, and facilitating your admission.

​

8.4  Service Providers

​

Crestcare may disclose Personal Information to third-party service providers that assist in operating, maintaining, supporting and securing the Platform and other systems used in connection with your pre-admission and admission. These service providers may include providers of:

​

  • information technology services;

  • cloud hosting and data storage services;

  • cybersecurity services;

  • software maintenance and technical support;

  • secure document management services; and

  • communications services.

 

Where a service provider Processes Personal Information on behalf of Crestcare, the relevant Crestcare Entity will take reasonable steps to require that the service provider Processes such Personal Information only on its documented instructions and in accordance with POPIA, other applicable laws and appropriate contractual obligations.

 

8.5. Regulators and Government Authorities

​

Crestcare may disclose your Personal Information to regulators, government departments, law enforcement agencies, courts or other competent authorities where required or authorised by applicable law, including to comply with legal or regulatory obligations, respond to lawful requests, or establish, exercise or defend legal rights.

​

8.6. Professional Advisers

​

Crestcare may disclose Personal Information to its legal advisers, auditors, insurers or other professional advisers in order to obtain professional advice, comply with legal or regulatory obligations, or establish, exercise or defend legal rights. Appropriate confidentiality obligations will apply to such recipients.

​

8.7. Parents, Guardians and Authorised Representatives

​

Where appropriate, Crestcare may disclose relevant Personal Information to your parent, legal guardian or authorised representative in connection with your pre-admission, admission or the provision of healthcare services, or where otherwise authorised or required by applicable law.

9. Personal Information of Minors

Where a patient is under the age of 18 (eighteen) years, Personal Information will generally be collected from, or provided by, the patient's parent, legal guardian or another person who is legally authorised to act on the patient's behalf. Crestcare may, however, collect Personal Information directly from a minor where this is permitted by applicable law.

​

Crestcare may Process the Personal Information of minors for the purposes described in this Policy and any other lawful purpose connected with the provision, administration or management of healthcare services. Where required by applicable law, Crestcare will obtain the consent of a competent person before Processing a minor's Personal Information. In all other circumstances, Crestcare will Process such information only where authorised or required under POPIA or any other applicable law. Crestcare recognises that the Personal Information of minors is afforded additional protection under POPIA and will Process such information accordingly.

10. Where Your Information Is Hosted

Personal Information submitted through the Platform is hosted and stored on systems and infrastructure located in the Republic of South Africa. The Crestcare may use third-party technology and service providers to support the operation of the Platform and the provision of healthcare services. If Crestcare transfers, or permits access to, Personal Information from a jurisdiction outside South Africa as part of its operations or for another lawful purpose, any such cross-border transfer or access will be undertaken in accordance with POPIA and other applicable laws.

11. How We Protect Your Information

Crestcare takes appropriate, reasonable technical and organisational measures to protect Personal Information against loss, misuse, unauthorised access, disclosure, alteration or destruction in accordance with POPIA and other applicable laws.

​

Access to Personal Information is limited to authorised personnel, healthcare practitioners, service providers and other third parties who have a legitimate need to access such information for the purposes described in this Privacy Policy and who are subject to appropriate confidentiality obligations.

12. Retention of Personal Information

Crestcare will retain the Personal Information submitted through the Platform only for as long as is required to fulfil the purposes described in this Policy, or for any longer period where retention is authorised, required or permitted under POPIA or any other applicable law.

​

If you commence, but do not complete, the pre-admission process, the information you have submitted through the Platform will be securely stored in an encrypted format for a maximum period of 10 (ten) calendar days. If your pre-admission form is not completed and submitted within that period, the incomplete information will be automatically deleted as a security measure and you will be required to restart the pre-admission process.

​

If you complete and submit your pre-admission information and are admitted to a Crestcare hospital, that information may be incorporated into your patient record and retained in accordance with Crestcare's legal, regulatory and operational record-keeping obligations applicable to patient records.

If you are not admitted to a Crestcare hospital, or the information does not form part of your patient record, Crestcare will retain your Personal Information only for as long as required to facilitate your proposed admission, fulfil its legal, regulatory or operational obligations, establish, exercise or defend legal rights, or for any other lawful purpose.

​

Once Personal Information is no longer required to be retained, Crestcare will securely delete, destroy, anonymise, de-identify or otherwise dispose of it in accordance with POPIA, other applicable laws and its records management practices.

13. Your Privacy Rights

Under POPIA and other applicable laws, you may have certain rights in relation to the Personal Information that the relevant Crestcare Entity Processes about you. Where you wish to exercise any of these rights, you should direct your request to the relevant Crestcare Entity in accordance with section 15 below.

​

Depending on the circumstances, your rights may include the right to:

​

  • access your Personal Information;

  • request that inaccurate, incomplete or outdated Personal Information be corrected or updated;

  • object, in certain circumstances, to the Processing of your Personal Information;

  • withdraw your consent where Processing is based on your consent, provided that such withdrawal will not affect the lawfulness of any Processing undertaken before your consent was withdrawn;

  • request the deletion, destruction or restriction of the Processing of your Personal Information, where permitted by law; and

  • lodge a complaint regarding the Processing of your Personal Information.

 

These rights are not absolute and may be limited in accordance with POPIA and other applicable laws. The relevant Crestcare Entity may decline or limit your request where it is entitled or required to do so, including where it is required to retain or continue Processing your Personal Information, where complying with your request would adversely affect the rights or legitimate interests of another person, or where another lawful ground applies.

14. Your Responsbilities

To assist Crestcare and the Crestcare Entity(ies) in providing safe, effective and efficient healthcare services, you are responsible for:

​

  • ensuring that the Personal Information you provide is accurate, complete and, where applicable, kept up to date;

  • notifying the relevant Crestcare Entity promptly of any changes to your Personal Information that may affect your admission, treatment or patient account;

  • ensuring that you are authorised to provide any Personal Information relating to another individual, including where you submit information on behalf of a minor or another patient;

  • notifying the relevant Crestcare Entity promptly if you become aware of, or reasonably suspect, any unauthorised access to or compromise of your account.

15 Contracting Crestcare And Complaints

If you have any questions about this Policy or the Processing of your Personal Information, wish to exercise any of your rights under POPIA, or would like to raise a concern or complaint regarding the Processing of your Personal Information, you may contact the Crestcare Entity that Processes your Personal Information through Crestcare's Information Officer using the details below:

​

 

That Crestcare Entity will endeavour to investigate and, where appropriate, resolve any concerns or complaints as promptly as reasonably practicable.

If you believe that the Crestcare Entity has Processed your Personal Information in contravention of POPIA, or you are dissatisfied with its response to your complaint, you may lodge a complaint with the Information Regulator using the following details:

​

16. Changes To This Patient Data Processing Policy

Crestcare may amend this Policy from time to time to reflect changes in applicable laws, healthcare practices, technology, our Processing activities or the operation of the Platform.

​

The most recent version of this Policy will always be made available through the Platform and will indicate the date on which it was last updated.

17. Acceptance of This Data Processing Policy

By accessing or using the Platform and submitting Personal Information through it, you acknowledge that this Policy has been made available to you and that you have read and understand how Crestcare and/or the relevant Crestcare Entity will collect, use, disclose, store and otherwise Process the Personal Information you submit through the Platform in accordance with POPIA, other applicable laws and this Policy.

​

Where you submit Personal Information on behalf of another individual, including a minor or a person for whom you are legally authorised to act, you confirm that you are authorised to provide that Personal Information to Crestcare and, where required by applicable law, have obtained any necessary consent or permission for Crestcare and/or the relevant Crestcare Entity to Process that Personal Information for the purposes described in this Policy.

​

Nothing in this Policy limits or affects the right of Crestcare and/or the relevant Crestcare Entity to Process Personal Information where such Processing is authorised or required under POPIA or any other applicable law.

© 2026 Crestcare | All Rights Reserved

bottom of page