Patient Information, Consent and Data Protection Waiver

Advanced Global Medical Solutions (Pty) Ltd (“AGMS”) is the registered company that owns and operates the medical clinic. Clinical and consulting services are rendered through Doctor24 (Inc. Practice), the HPCSA-registered practice operating within AGMS, staffed by practitioners registered with the Health Professions Council of South Africa. References below to “the Practice”, “we”, “us” and “our” mean AGMS and/or Doctor24, as the context requires, and this notice governs the processing of your personal information by both.

This notice must be read and accepted before your patient information form can be submitted.

1. Who we are and what this document is

1.1 AGMS (Pty) Ltd is the registered corporate entity that owns, operates and administers the medical service — including this booking platform, billing, and the systems used to collect and store your information. Doctor24 is the HPCSA-registered inc. practice under which all medical consultations, diagnoses, treatment and clinical/consulting services are actually provided, by practitioners registered with the HPCSA.

1.2 AGMS and Doctor24 are joint “responsible parties” (under the Protection of Personal Information Act 4 of 2013, “POPIA”) and, where applicable to you, joint “data controllers” (under the EU/UK General Data Protection Regulation, “GDPR”) in respect of the personal information you submit through this form: AGMS as the entity that operates the intake, billing and administrative systems, and Doctor24 as the HPCSA-registered practice that holds and is clinically and ethically accountable for your health and treatment records.

1.3 By ticking “I agree” / submitting this form, you (the patient, or the parent/legal guardian completing this form on behalf of a minor or a person without legal capacity) confirm that you have read, understood, and consent to this notice in full.

1.4 If you do not agree to this notice, we may be unable to accept your booking or provide clinical services, save where processing is otherwise required by law or necessary to protect your vital interests in an emergency.

2. What personal information we collect

Depending on the service requested, we may collect:

3. Special (health) information and disclosure to third parties

3.1 Your health information is processed only by, or under the supervision of, Doctor24’s HPCSA-registered practitioners and supporting clinical staff, who are bound by professional confidentiality obligations (including the HPCSA ethical rules and, where applicable, common-law and contractual confidentiality duties). AGMS administrative staff may access limited non-clinical information (e.g. contact and billing details) strictly for booking, billing and operational purposes, on a need-to-know basis, under confidentiality obligations to AGMS.

3.2 Doctor24 and/or AGMS (as relevant to the type of information) may disclose limited personal or health information to:

3.3 We do not disclose your information to unrelated third parties for their own marketing purposes.

4. Cross-border transfers of information

4.1 Some of the systems we use to store or process data (including cloud-based clinical, communication and administrative platforms) may transfer or store data outside South Africa.

4.2 Where we transfer personal information outside South Africa, we do so in accordance with POPIA section 72 — i.e. only where the recipient is subject to a law, binding agreement, or binding corporate rules that provide an adequate level of protection substantially similar to POPIA, or where you have consented to the transfer.

4.3 For patients located in, or nationals of, the European Economic Area or United Kingdom, any transfer of your data to South Africa or onward to a third country will rely on appropriate safeguards recognised under GDPR (such as Standard Contractual Clauses) or your explicit consent, where an adequacy decision does not apply.

5. How we communicate with you

5.1 We may contact you by phone, SMS, email, and messaging platforms such as WhatsApp, Telegram or Signal (or successor platforms) for professional purposes, including appointment coordination, clinical updates, results, prescriptions, invoices and practice-related communication.

5.2 You acknowledge and accept that these channels, other than our internal clinical records system, are not guaranteed to be fully secure or end-to-end encrypted, and that there is an inherent risk of interception or unauthorised access outside our control when using these channels. You may request an alternative, more secure communication method at any time.

5.3 You may withdraw consent to a specific communication channel at any time by notifying us; this will not affect the lawfulness of communications sent before withdrawal, and may limit our ability to reach you for time-sensitive clinical matters.

6. Retention of information

Doctor24, as the HPCSA-registered practice, retains clinical and health records for as long as necessary for the purposes set out above, and in any event for the minimum periods required by HPCSA guidance on medical record retention (currently a minimum of 6 years from the last entry, or until a minor patient turns 21, whichever is longer). AGMS retains administrative, billing and financial records for the periods required by tax and financial record-keeping laws. Either entity may retain information for a longer period where required for a specific legal claim or regulatory investigation.

7. Security safeguards

7.1 We process your personal information strictly in accordance with the requirements of POPIA, including the information security requirements set out in sections 19 to 22, and, where applicable, Article 32 of the GDPR.

7.2 We maintain appropriate technical and organisational measures to protect personal information against loss, unauthorised access, interference, or disclosure.

7.3 We will notify you and, where legally required, the Information Regulator (and any applicable EU/UK supervisory authority) without undue delay if we become aware of a security compromise affecting your personal information that presents a real risk of harm to you, and we will comply with any lawful instruction issued by you, the Information Regulator, or another competent authority in relation to such a compromise.

8. Your rights

Subject to the requirements and exceptions set out in POPIA and (where applicable to you) the GDPR, you have the right to:

To exercise any of these rights, contact the Information Officer for AGMS and Doctor24 at [insert Information Officer name/registration number and contact email].

9. Limitation of liability and indemnity

9.1 We will handle your personal information with the care required by law. However, no system of communication or data transmission (including phone, SMS, email or messaging platforms referred to in clause 5) is completely secure, and to the fullest extent permitted by law, neither AGMS (Pty) Ltd nor Doctor24 will be held liable for any unauthorised interception, access to, or disclosure of information transmitted via these channels, except where such loss arises from our own gross negligence or wilful misconduct, which liability cannot lawfully be excluded.

9.2 Where you (or a third party acting on your behalf) provide us with personal information relating to another person (for example, next-of-kin or dependant details), you warrant that you are authorised to disclose that information to us and you indemnify and hold AGMS harmless against any claim, fine, penalty, damage, or legal cost arising from any breach of POPIA or GDPR caused by your unauthorised disclosure of that third party’s information to us. This indemnity does not extend to, and does not limit our own direct statutory obligations as responsible party/controller for information you have properly provided about yourself.