Your information and POPIA

The Skin Crowd (Pty) Ltd, trading as The Skin Crowd. Physical address: 44 Will Scarlet Road, Robindale, Randburg, Gauteng, 2194. Email: hello@theskincrowd.co.za. Telephone: 065 738 1307. WhatsApp: +27657381307. Hours: Mon–Fri, 08:00–18:00 SAST.

Wessel Davel, privacy@theskincrowd.co.za. Registration of the Information Officer with the Information Regulator (South Africa): in progress.

We collect account and contact details, medical questionnaire answers, skin photos, consultation and clinical records, payment status, delivery details and messages needed to provide care.

We use this information to assess treatment suitability, conduct consultations, design personalised programmes, monitor progress, arrange payment and delivery, keep clinical records and meet legal duties.

Health information is special personal information under section 26 of POPIA. We process it under the section 32 authorisation, which permits processing by medical professionals where it is necessary for proper treatment and care.

Providing your medical history, current medication, allergies and photographs is mandatory for us to treat you safely. If you do not provide it, we cannot prescribe for you.

Access is limited to authorised clinical and operational staff. Only information needed for a specific task is shared with these categories of recipient: the prescribing practitioner, the compounding pharmacy, our payment provider, the courier, and our hosting and communications providers. We do not sell medical information.

Personal information is stored on infrastructure operated by Supabase and its cloud provider, which may involve processing outside South Africa. In terms of sections 18(1)(g) and 72 of POPIA, that transfer is made under a written agreement requiring an adequate level of protection with principles substantially similar to POPIA, and equivalent restrictions on onward transfer.

Skin photos are stored privately and are available only to authorised clinical staff. You may submit photos without identifying facial features. We protect records with access controls, role-based access, encryption in transit, private storage buckets for photographs and prescriptions, signed time-limited URLs for any access to those files, and written confidentiality undertakings from everyone with access.

Clinical records are kept for at least 6 years from the date the record becomes dormant. Records of patients who were minors are kept until their 21st birthday. Financial records are kept for 5 years as required by the Tax Administration Act. Telehealth communications and photographs are retained as part of the clinical record.

You may request access to your information, ask us to correct it, ask for deletion where the law allows, object to processing, and object to direct marketing at any time. You may also lodge a complaint with the Information Regulator: complaints.IR@inforegulator.org.za, JD House, 27 Stiemens Street, Braamfontein, Johannesburg.

Our PAIA manual is available on request from privacy@theskincrowd.co.za.

Email hello@theskincrowd.co.za or privacy@theskincrowd.co.za for privacy requests, or WhatsApp +27657381307 (Mon–Fri, 08:00–18:00 SAST). We may need to verify your identity before releasing or changing health information.