WellNest Privacy Policy

Version 2.0 | Last updated: 8 October 2026

1. Who we are and how to contact us

Well Nest Multidiscipline Practice (Pty) Ltd, registration number 2025/508895/07, trading as WellNest and WellNest Gold (“WellNest”, “we”, “us”), is responsible for the personal information it controls.

Address: 183 Bree Street, Cape Town City Centre, Cape Town, 8001, South Africa.

Information Officer: Steve (Stephen) Uria.
Email: hello@wellnest.gold — please use the subject “Privacy”.
Telephone: +27 66 538 4856.

This policy covers our website, enquiries, bookings, payments and patient services, including consultations, telehealth, callouts, diagnostics, treatments and recovery services. It explains how we handle information under South Africa’s Protection of Personal Information Act, 2013 (“POPIA”) and applicable healthcare confidentiality and record-keeping requirements.

This policy explains our practices; reading it, browsing our website or accepting a booking does not by itself give consent to optional marketing, advertising tracking, research or every overseas transfer. Treatment and service-specific consent forms continue to apply.

2. Information we collect

Depending on your interaction with us, we collect:

• Identity and contact information: your name, date of birth, identification details where needed, address, email address, telephone number and relevant guardian or emergency-contact details.
• Booking and account information: the service requested, appointment details, forms, consent records, communications and your preferences.
• Health information: symptoms, medical history, allergies, medicines, clinical assessments, consultation notes, test results, treatment plans, prescriptions, referrals and progress information needed for your care.
• Payment and administration information: charges, invoices, payment status, transaction references and medical-aid details where relevant. Payment providers process the payment credentials you enter into their services.
• Website information: IP address, browser and device details, pages visited, referring pages, security logs and, where permitted and with any required consent, cookies and advertising click references.
• CCTV images where surveillance operates at the premises. Notices identify monitored areas; the relevant premises operator may be responsible for its own cameras.

An enquiry may contain health information if you choose to include it. Please do not send detailed medical records, identity documents or payment-card details through a general website form or ordinary email. Contact us for a suitable method.

When you submit an intake or booking form, we may receive and store it even if you do not complete payment or confirm an appointment. We use submitted information to handle your request and apply the retention principles below. Starting an enquiry or booking does not automatically subscribe you to marketing.

3. Where information comes from

We obtain information from you and, where lawful, from your authorised representative or guardian, treating professionals, laboratories, diagnostic providers, pharmacies, medical aids, booking and payment providers, and the devices or systems used to interact with us. We obtain or share information through these sources only where necessary for the relevant purpose and legally permitted.

If you provide another person’s details, such as an emergency contact, please make them aware of this policy and provide only what is needed.

4. Why we use information and our lawful grounds

We use information to:

• Respond to enquiries, arrange appointments, administer accounts and deliver services you request. Depending on the activity, this is necessary to take steps at your request, perform our agreement with you or pursue a legitimate operational interest that does not override your rights.
• Assess, provide and coordinate healthcare, including referrals, diagnostics and prescriptions. We process health information only under an applicable POPIA permission for special personal information, including necessary healthcare by professionals or institutions subject to confidentiality, or your consent where required.
• Keep clinical, consent, financial and administrative records, meet professional and legal obligations, and manage complaints or legal claims.
• Protect people, accounts and systems; prevent fraud; investigate security incidents; and maintain service quality, using information proportionate to these purposes.
• Send appointment reminders, receipts, care instructions and other service communications.
• Send optional marketing or use optional website measurement only under the applicable legal conditions and any required consent.

Applicable obligations include POPIA, the National Health Act, relevant health-profession rules, and financial and tax record requirements. We do not treat consent as the only lawful ground for necessary healthcare or legally required records.

5. Required information and optional choices

We identify required fields and explain why information is needed. Accurate identity, contact, clinical and payment information may be necessary to arrange a service, assess whether it is safe, provide care or meet legal obligations. If essential information is withheld, we may be unable to complete the booking or provide the relevant service safely.

Optional marketing, photographs or testimonials for publicity, and non-essential advertising or analytics choices are separate from treatment consent. Refusing or withdrawing an optional choice does not affect your access to care.

Where we rely on consent, you may withdraw it through the relevant settings or by contacting us. Withdrawal applies going forward and does not undo lawful processing already carried out or require us to remove records we must retain.

6. Who receives information

We share only information reasonably needed for the purpose, with appropriate confidentiality and safeguards. Recipients may include:

• Authorised WellNest staff and healthcare professionals involved in your care.
• Laboratories, diagnostic providers, pharmacies and referral practitioners where needed and legally permitted for your care.
• Medical aids or insurers when you request a claim or authorise relevant disclosure, or another legal ground permits it.
• Providers supporting clinical records, bookings, payments, hosting, email, messaging, customer administration and IT security. These include Practice Better for clinical administration and records, Bookem for relevant bookings, and Yoco for relevant payments.
• Professional advisers, regulators, courts, law-enforcement bodies or other recipients where disclosure is legally required or otherwise lawfully justified.

Providers acting as our operators must process information on authorised instructions and meet contractual confidentiality and security obligations. Some healthcare, laboratory and payment providers independently determine how they handle information for their own legal and professional duties; their privacy notices also apply.

We do not sell personal information. We do not disclose patient lists or health information to advertisers for audience targeting.

7. Storage and processing outside South Africa

Some providers process information outside South Africa. Our clinical system, Practice Better, uses infrastructure in the United States. Website, booking, communications and supporting technology services may use infrastructure in South Africa, the European Union, including Ireland, and the United States. If a service involves an additional overseas processing location, we explain the relevant destination and safeguards before the transfer.

Different countries have different privacy laws. Before an overseas transfer, we establish an applicable POPIA section 72 ground, such as adequate protection through law or a binding agreement, or specific informed consent where that is the appropriate ground. Health information and children’s information require additional protection; where POPIA requires prior authorisation from the Information Regulator, that requirement must also be satisfied.

For Practice Better’s US processing, we have a written data-processing agreement requiring instructed processing, confidentiality, restricted personnel access and appropriate security measures. Where specific consent is the applicable transfer ground, we request it separately before the transfer. We assess whether these safeguards and the applicable transfer ground satisfy POPIA; a foreign provider's privacy standards do not automatically establish compliance.

We explain service-specific overseas processing and obtain separate consent where required. Accepting this policy is not blanket consent to send your information anywhere. Ask our Information Officer for the providers, processing locations and safeguards relevant to your service, or to discuss concerns before submitting health information. If you decline a consent needed for a particular transfer, we will explain any available options and whether this prevents us from providing the affected service through that system.

8. Cookies, advertising and measurement

We use essential technologies to operate the website, maintain security and remember necessary choices. Non-essential analytics and advertising technologies are enabled only after the applicable consent choice. You can decline them and still use our services, and change or withdraw your choice through the website’s cookie settings.

Where you agree to permitted measurement, information may include cookie or device identifiers, an advertising click reference, and limited event details. Even without your name, these details can be personal information. We assess what may be collected or shared in a healthcare context and do not treat hashing or removal of a name as making information anonymous.

We do not upload patient email addresses or telephone numbers, including hashed versions, to Google for advertising, audience matching or conversion measurement. We do not send clinical form contents, medical records, diagnoses, symptoms, prescriptions or treatment details to advertising platforms. We do not create advertising audiences from patient lists, health information or visits that reveal a health condition.

Google measurement, where used, involves Google entities and infrastructure including the United States. Only measurement permitted by applicable law and Google’s rules may operate, with any required consent. Consent does not authorise data sharing that an advertising platform prohibits.

9. Marketing, images and testimonials

We keep service communications separate from promotional messages. We send electronic direct marketing only with your consent or where POPIA’s limited existing-customer conditions are met. Every promotional message provides a way to stop future marketing, and you can also contact hello@wellnest.gold.

We obtain separate permission before using an identifiable patient’s photograph, video, testimonial or story for publicity. An agreement to receive care is not permission to publish your identity or treatment experience.

10. Research, AI and BioBank development

We do not use identifiable patient information for general-purpose AI model training, independent research or BioBank product development. Those secondary uses are planned or involve information that has been properly de-identified.

Proper de-identification must prevent identification by reasonably foreseeable means; replacing names with codes or hashing contact details is not enough by itself.

Before introducing an identifiable use for a new purpose, we will explain it, establish the required legal basis and safeguards, obtain specific consent where required, and secure applicable research or regulatory approvals. Any clinical recording, transcription or AI-assisted feature must be covered by an appropriate patient notice and any required separate consent. This policy does not authorise those activities merely because they may be planned.

11. Children and representatives

We handle children’s information and information supplied through a representative with additional care. We verify the relevant authority and obtain consent from a competent person where required by POPIA, or rely on another applicable legal permission.

Children may have their own rights to consent to particular health services and to confidentiality under South African law. We respect those rights and do not assume that a parent or guardian is automatically entitled to every clinical record.

12. How long we keep information

We keep information only for a lawful purpose and the period required or justified by that purpose:

• Clinical records are generally retained for at least six years after the last treatment. Longer periods apply where required by law, professional guidance or the circumstances, including records of minors, mental incapacity, continuing care and actual or reasonably anticipated claims. Records of minors are retained at least until age 21, or longer where another applicable retention requirement demands it.
• Financial and transaction records are retained for the applicable accounting and tax periods.
• Enquiries, submitted but incomplete bookings, administrative records, consent records and correspondence are retained for as long as reasonably needed to handle the matter, document our actions and meet applicable obligations.
• Website logs, analytics and advertising references are retained only for their defined security or measurement purposes and the relevant retention period.
• We may keep a limited suppression record to honour a request not to receive marketing.

We restrict information kept solely for a retention obligation. When retention is no longer justified, we securely delete, destroy or properly de-identify it, subject to managed backup cycles and any lawful preservation requirement. Correcting a clinical record may require an additional entry so its clinical history and audit trail remain intact.

13. Security and security incidents

We use reasonable technical and organisational measures appropriate to the information, including access restrictions, confidentiality obligations, secure transmission and safeguards for systems and service providers. No system is completely risk-free.

If there are reasonable grounds to believe personal information has been accessed or acquired by an unauthorised person, we assess and contain the incident and notify the Information Regulator and affected people as soon as reasonably possible, as POPIA requires, subject to its permitted exceptions or delays. POPIA does not impose a general 72-hour notification deadline.

14. Your privacy rights

Subject to lawful limits, you may ask us to:

• Confirm whether we hold your personal information and request access.
• Correct inaccurate information or request deletion or destruction of information we are no longer entitled to keep.
• Object to processing where POPIA provides that right.
• Withdraw consent for processing that depends on your consent.
• Stop direct marketing.
• Explain relevant sharing, overseas processing or retention practices.

Contact our Information Officer at hello@wellnest.gold with the subject “Privacy”. We may reasonably verify your identity or authority before disclosing or changing information. Please request a secure method before sending identity documents or health records. Confirmation of whether we hold your personal information is free. A prescribed fee may apply to copies or other access where the law permits. We will explain the applicable process and any reason we cannot fully meet a request. Some access requests may follow the procedure under the Promotion of Access to Information Act.

You may complain directly to South Africa’s Information Regulator; you do not have to complain to us first:

Website and complaints: https://inforegulator.org.za/complaints/
Email: POPIAComplaints@inforegulator.org.za
Telephone: 010 023 5200 or 0800 017 160.

15. Changes to this policy

We publish the current version and update date on this page. Where a material change affects how we use your information, we provide an appropriate further notice and obtain fresh consent where required. Continuing to use the website does not by itself provide consent for a new purpose that requires your permission.

16. Contact

• Well Nest Multidiscipline Practice (Pty) Ltd
• Email: hello@wellnest.gold
• Website: www.wellnest.gold
• Phone: +27 66 538 4856

For privacy queries or to exercise your POPIA rights: hello@wellnest.gold.