PAIA MANUAL

Prepared in terms of section 51 of the Promotion of Access to Information Act 2 of 2000 (as amended)

MEDICARE HOSPITAL EQUIPMENT (PTY) LTD

Original compilation: 17 June 2025
Revised draft effective: 01 October 2026

1. Definitions and purpose

“PAIA” means the Promotion of Access to Information Act 2 of 2000;
“POPIA” means the Protection of Personal Information Act 4 of 2013;
“Regulator” means the Information Regulator (South Africa);
“IO” means Information Officer;
“DIO” means Deputy Information Officer;
“Company” means Medicare Hospital Equipment (Pty) Ltd.

This manual informs the public about the Company’s records, the process for requesting access, the prescribed PAIA Guide, contact details, processing of personal information and the availability of this manual. Access is subject to PAIA requirements and lawful grounds of refusal; listing a record does not automatically make it available to a requester.

2. Details of the private body and responsible officers

Requests and enquiries under PAIA may be delivered to the address or email above and marked for the attention of the Information Officer. Any change of designation or address will require an update to this manual.

3. Guide to exercising rights under PAIA

The Information Regulator publishes an official Guide describing the purpose of PAIA and POPIA, request procedures, applicable forms, fees and remedies. It is available from https://inforegulator.org.za/paia/ and on request from the Company’s Information Officer. The Company must make the Guide available for public inspection during ordinary business hours in at least two official languages at its principal office. Copies in the languages actually held must be confirmed before publishing this manual.

4. Records generally available without a formal PAIA request

These examples describe ordinary public information; they do not of themselves constitute a formal voluntary disclosure notice under section 52 of PAIA. Any separately adopted section 52 notice will be dealt with in accordance with the applicable publication and notification requirements.

5. Records available or maintained under other legislation

Depending on the Company’s activities and the relevant statutory disclosure conditions, records are maintained under legislation including: Companies Act 71 of 2008 (company and statutory records); Income Tax Act 58 of 1962 and Value-Added Tax Act 89 of 1991 (tax and accounting records); Basic Conditions of Employment Act 75 of 1997 and Labour Relations Act 66 of 1995 (employment records); Occupational Health and Safety Act 85 of 1993 (workplace safety records); POPIA (personal information); and PAIA (this manual and access requests). This list is descriptive, not a claim that all records are available without restriction.

6. Subjects and categories of records held

The actual existence, retention and disclosure status of each record depends on the Company’s activities and applicable law. Confidential, commercially sensitive and third-party personal information remains subject to statutory safeguards, and will not be disclosed without specific permission.

7. How to request access to a record

7.1. Submit a completed prescribed Form 2 (Request for Access to Record), identifying the requester, the record sought, preferred form of access, contact details and the right sought to be exercised or protected. Forms are available at https://inforegulator.org.za/paia/. Submit to paia@medicare.co.za or the principal office.

7.2. A requester seeking a private-body record must establish that access is required for the exercise or protection of a right, comply with prescribed procedure and not fall within a lawful ground of refusal. Access to the requester’s own personal information may also be exercised in accordance with POPIA.

7.3. The Company will issue notices of applicable request and access fees in the prescribed form, subject to statutory exemptions, and assess requests within PAIA’s applicable periods (ordinarily 30 days, subject to a permitted extension). The current prescribed fee schedule, rather than any superseded amount, applies.

7.4. The Company will communicate a decision and, where appropriate, reasons and the available remedies using the prescribed outcome notice (Form 3). A dissatisfied requester may complain to the Information Regulator or approach a competent court, as provided by law; the ordinary public-body internal appeal procedure does not apply to a private body.

8. Processing of personal information under POPIA

8.1. Purposes of processing

The Company processes personal information as reasonably necessary for legitimate business and statutory purposes, which may include handling sales and enquiries, customer service, procurement, delivery and support, recruitment, administration of employment and payroll, contractual management, credit/payment administration, fraud prevention, legal compliance and responding to PAIA or POPIA requests. Processing is subject to an applicable lawful basis and purpose limitation.

8.2. Categories of data subjects and information

8.3. Recipients or categories of recipients

Depending on the transaction and lawful basis, information may be provided to banks/payment providers, auditors and professional advisers, payroll or IT service providers, couriers and service partners, regulators and statutory bodies (including SARS), credit bureaus or verification service providers where authorised, and law-enforcement authorities where legally required. Disclosure is limited to legitimate purposes and applicable safeguards.

8.4. Transborder flows

The Company will assess whether its service providers, email/cloud systems or international business arrangements involve transfers of personal information outside South Africa. Any such transfers must satisfy section 72 of POPIA. The specific countries and recipients, if any, require confirmation before final approval; the 2025 manual’s unconditional “N/A” has not been retained.

8.5. General security safeguards

The Company applies appropriate reasonable technical and organisational measures proportionate to risk, including encryption and anti-malware measures as recorded in the earlier manual. Other measures, such as access restriction, authentication, backups, staff confidentiality procedures, incident management and processor contracts, must be described as implemented only after internal verification. Security measures are reviewed in accordance with POPIA section 19.

9. Availability of this manual

Once approved, a current copy of this manual will be made available without charge for inspection during normal business hours at the principal office and electronically via www.medicare.co.za. Requests for an electronic copy may be sent to paia@medicare.co.za. The Information Regulator may be provided with a copy as required. Reasonable reproduction charges, if any, are subject to the applicable prescribed rules.

10. Updating and approval

The Information Officer will review this manual following material changes in the Company’s operations, processing practices, responsible officers or governing law, and periodically as necessary. The revision date of this document is 1 October 2026; it supersedes the version dated 17 June 2025 only upon formal approval and publication.