Neo-Psych
Psychology at Work
Back to site
How Neo-Psych Services collects, uses, stores, and protects your personal information — and what rights you have over your data.
Applicable law: This policy is governed by the Protection of Personal Information Act, 2013 (POPIA, Act No. 4 of 2013) of South Africa, and is further aligned with the General Data Protection Regulation (GDPR, EU 2016/679) for users based in the European Economic Area (EEA). Where both frameworks apply, the stricter standard is observed.
Neo-Psych Services is a registered psychological practice based in South Africa, providing individual therapy, couples and family therapy, psychoeducational assessments, screenings, and clinical supervision. Our registered psychologist holds HPCSA Registration No. PS 0150754 and is governed by the Health Professions Act (Act No. 56 of 1974).
For the purposes of POPIA, Neo-Psych Services is the Responsible Party (equivalent to "Data Controller" under GDPR). We determine the purpose and means of processing your personal information.
We collect personal information only where it is necessary to deliver our services, comply with our legal and professional obligations, or communicate with you. The categories of information we may collect include:
| Category | Examples | Source |
|---|---|---|
| Identity data | Full name, date of birth, South African ID number or passport number | Provided by you via the intake form or direct communication |
| Contact data | Email address, cell/telephone number, physical address, WhatsApp number | Provided by you |
| Health & clinical data | Presenting concern, therapy history, medical conditions, medications, risk assessments, session notes, assessment reports | Provided by you; generated during sessions |
| Financial data | Payment method preference, medical aid scheme name and membership number, benefit plan type | Provided by you |
| Emergency contact data | Name, relationship, and contact number of your nominated emergency contact | Provided by you |
| Communication data | Content of emails, WhatsApp messages, and other correspondence with our practice | Generated through your communication with us |
| Technical / usage data | IP address, browser type, pages visited, session duration (via Google Analytics) | Automatically collected via our website |
| Marketing data | Name and email address if you subscribe to our newsletter | Provided by you |
Special categories of data: Health and clinical information constitutes special category / sensitive personal information under both POPIA and GDPR. We process this information only with your explicit informed consent and as required to deliver psychological services and comply with our professional obligations.
We use your personal information for the following purposes:
We will not use your personal information for any purpose incompatible with the purposes listed above, or for unsolicited marketing without your explicit consent.
Under POPIA and GDPR, we must have a lawful basis for processing your personal information. We rely on the following grounds:
Special category data (health information) is processed exclusively on the basis of your explicit consent (POPIA s. 26; GDPR Art. 9(2)(a)) and where necessary for preventive or occupational medicine and the provision of healthcare (GDPR Art. 9(2)(h); POPIA s. 27).
We do not sell, rent, or trade your personal information to third parties. We may share your information only in the following circumstances:
In all cases, we share the minimum necessary information and take all reasonable steps to ensure it is protected.
Our website uses cookies and similar tracking technologies to improve your experience and to understand how the site is used.
| Cookie Type | Purpose | Retention |
|---|---|---|
| Essential | Required for the website to function correctly. Cannot be disabled. | Session / as required |
| Analytics (Google Analytics) | Collects anonymised data about page visits, traffic sources, and user behaviour to help us improve our site. IP addresses are anonymised. | Up to 26 months |
| Preference | Remembers your settings and choices on our site. | Up to 12 months |
We do not use cookies for advertising or to track you across third-party websites. You can manage your cookie preferences through your browser settings. Disabling analytics cookies will not affect your ability to use any part of our site.
For users in the EEA, we rely on your consent as the lawful basis for analytics cookies (GDPR Art. 6(1)(a); ePrivacy Directive). You may withdraw consent at any time by adjusting your browser settings or clearing cookies.
We retain your personal information only for as long as necessary to fulfil the purposes for which it was collected, comply with legal obligations, and resolve any disputes.
| Data Type | Retention Period | Basis |
|---|---|---|
| Clinical records (adults) | Minimum 6 years after the last service date | National Health Act; HPCSA guidelines |
| Clinical records (minors) | Until the client turns 21, or 6 years after last service — whichever is later | National Health Act; Children's Act |
| Financial records | 5 years | South African tax law (SARS requirements) |
| Intake forms & consent | Duration of the professional relationship + 6 years | Legal and professional obligation |
| Newsletter subscriber data | Until you unsubscribe or withdraw consent | Consent-based |
| Website analytics data | Up to 26 months (anonymised) | Legitimate interest |
After the applicable retention period, data is securely deleted or anonymised.
We take the security of your personal information seriously. We implement appropriate technical and organisational measures to protect your information against accidental loss, unauthorised access, disclosure, alteration, or destruction. These measures include:
Despite these measures, no internet transmission or electronic storage method is 100% secure. In the event of a data breach that poses a risk to your rights and freedoms, we will notify you and the Information Regulator (South Africa) as required by POPIA, or the relevant supervisory authority as required by GDPR, within the applicable timeframes.
WhatsApp communication: While we use WhatsApp for appointment-related communication, please be aware that WhatsApp is a third-party platform and its security is subject to Meta's policies. We do not transmit sensitive clinical information via WhatsApp without your explicit request and acknowledgement of the associated risks.
You have significant rights over your personal information. Depending on your location and applicable law, these include:
| Right | Description | POPIA | GDPR |
|---|---|---|---|
| Right of access | Request a copy of the personal information we hold about you. | ✓ s.23 | ✓ Art.15 |
| Right to correction | Request correction of inaccurate or incomplete information. | ✓ s.24 | ✓ Art.16 |
| Right to deletion / erasure | Request deletion of your data (subject to legal retention obligations). | ✓ s.24 | ✓ Art.17 |
| Right to object | Object to processing of your data for certain purposes (e.g., direct marketing). | ✓ s.11 | ✓ Art.21 |
| Right to withdraw consent | Withdraw consent at any time without penalty (does not affect prior processing). | ✓ s.11 | ✓ Art.7(3) |
| Right to restrict processing | Request that we limit how we use your data in certain circumstances. | Partial | ✓ Art.18 |
| Right to data portability | Receive your data in a structured, machine-readable format (GDPR users). | – | ✓ Art.20 |
| Right not to be subject to automated decisions | We do not make automated decisions with significant effects — this right applies in principle. | ✓ | ✓ Art.22 |
To exercise any of these rights, please contact us at info@neo-psych.co.za. We will respond within 30 days (as required by both POPIA and GDPR). In complex cases we may extend this by a further 60 days, with written notice.
Please note: Some rights may be limited where processing is required by law or for the purposes of healthcare delivery. For example, we may not be able to delete clinical records during their mandatory retention period.
We take the privacy of minor clients very seriously. In accordance with the Children's Act, 2005 (Act No. 38 of 2005):
We will not knowingly collect personal information directly from children under 12 without verified parental or guardian consent. If you believe we have inadvertently collected such information, please contact us immediately at info@neo-psych.co.za.
For child clients, our website (including the intake form) may be completed by the parent or guardian on the child's behalf. The parent/guardian holds the account holder role and assumes responsibility for all billing and correspondence.
Neo-Psych Services is based in South Africa. Your personal information is primarily processed and stored within South Africa. However, some of our third-party service providers (such as Google Analytics) may process data in countries outside South Africa or the EEA.
Where personal data is transferred internationally, we ensure that:
You may request details about the specific safeguards in place for international transfers by contacting us at info@neo-psych.co.za.
Our website may contain links to third-party websites — including social media platforms (Instagram, TikTok, YouTube, LinkedIn, Facebook), WhatsApp, and Google Maps. Clicking these links will take you to an external website governed by that party's own privacy policy.
We are not responsible for the privacy practices or content of any third-party sites. We encourage you to review the privacy policies of any third-party services you use.
Specifically, please note:
We may update this Privacy Policy from time to time to reflect changes in our practices, legal requirements, or for other operational reasons. The "Last updated" date at the top of this page will always reflect the most recent version.
For significant changes affecting how we process your data, we will notify you by email (where we hold your address) or by a prominent notice on our website prior to the changes taking effect. Continued use of our services after the effective date of the updated policy constitutes acceptance of the changes.
Previous versions of this policy are available on request by contacting us at info@neo-psych.co.za.
If you have any questions, concerns, or requests regarding this Privacy Policy or how we handle your personal information, please contact us:
If you are not satisfied with our response, you have the right to lodge a complaint with the relevant supervisory authority:
EEA-based users may lodge a complaint with the data protection authority in their EU member state. A directory of EU supervisory authorities is available at edpb.europa.eu.