ULWAZI HEALTH HUB (PTY) LTD

Ulwazi Health Hub (Pty) Ltd is a private company registered in the Republic. It owns and operates MyMenopauseSA, a consumer-facing information and membership platform providing evidence-based information on perimenopause and menopause for South African women. This single manual applies to the Company and to all of its activities, including the MyMenopauseSA Website, brand and services.

This PAIA Manual is useful for the public to:

2.1 check the categories of records held by the Company which are available without a person having to submit a formal PAIA request;

2.2 have a sufficient understanding of how to make a request for access to a record of the Company, by providing a description of the subjects on which the Company holds records and the categories of records held on each subject;

2.3 know the description of the records of the Company which are available in accordance with any other legislation;

2.4 access all the relevant contact details of the Information Officer and Deputy Information Officer who will assist the public with the records they intend to access;

2.5 know the description of the Guide on how to use PAIA, as updated by the Regulator, and how to obtain access to it;

2.6 know if the Company will process personal information, the purpose of processing of personal information and the description of the categories of data subjects and of the information or categories of information relating thereto;

2.7 know the description of the categories of data subjects and of the information or categories of information relating thereto;

2.8 know the recipients or categories of recipients to whom the personal information may be supplied;

2.9 know if the Company has planned to transfer or process personal information outside the Republic and the recipients or categories of recipients to whom the personal information may be supplied; and

2.10 know whether the Company has appropriate security measures to ensure the confidentiality, integrity and availability of the personal information which is to be processed.

3.1 Information Officer

In terms of PAIA, the head of a private body is its Information Officer. For the Company, this is its Director.

3.2 Access to information general contacts

3.3 National or head office

4.1 The Regulator has, in terms of section 10(1) of PAIA, as amended, updated and made available the revised Guide on how to use PAIA (“Guide”), in an easily comprehensible form and manner, as may reasonably be required by a person who wishes to exercise any right contemplated in PAIA and POPIA.

4.2 The Guide is available in each of the official languages and in braille.

4.3 The aforesaid Guide contains the description of:

4.3.1 the objects of PAIA and POPIA;

4.3.2 the postal and street address, phone and fax number and, if available, electronic mail address of:

4.3.2.1 the Information Officer of every public body; and

4.3.2.2 every Deputy Information Officer of every public and private body designated in terms of section 17(1) of PAIA and section 56 of POPIA;

4.3.3 the manner and form of a request for:

4.3.3.1 access to a record of a public body contemplated in section 11; and

4.3.3.2 access to a record of a private body contemplated in section 50;

4.3.4 the assistance available from the IO of a public body in terms of PAIA and POPIA;

4.3.5 the assistance available from the Regulator in terms of PAIA and POPIA;

4.3.6 all remedies in law available regarding an act or failure to act in respect of a right or duty conferred or imposed by PAIA and POPIA, including the manner of lodging:

4.3.6.1 an internal appeal;

4.3.6.2 a complaint to the Regulator; and

4.3.6.3 an application with a court against a decision by the information officer of a public body, a decision on internal appeal or a decision by the Regulator or a decision of the head of a private body;

4.3.7 the provisions of sections 14 and 51 requiring a public body and private body, respectively, to compile a manual, and how to obtain access to a manual;

4.3.8 the provisions of sections 15 and 52 providing for the voluntary disclosure of categories of records by a public body and private body, respectively;

4.3.9 the notices issued in terms of sections 22 and 54 regarding fees to be paid in relation to requests for access; and

4.3.10 the regulations made in terms of section 92.

4.4 Members of the public can inspect or make copies of the Guide from the offices of the public and private bodies, including the office of the Regulator, during normal working hours.

4.5 The Guide can also be obtained:

4.5.1 upon request to the Information Officer; and

4.5.2 from the website of the Regulator (https://inforegulator.org.za).

4.6 A copy of the Guide is also available in the following two official languages, for public inspection during normal office hours, by prior arrangement with the Information Officer:

4.6.1 English and isiZulu.

4.7 The contact details of the Regulator are:

The following categories of records are automatically available without a formal PAIA request.

The Company keeps records in accordance with the following legislation, where applicable to its operations. Records held under this legislation are not necessarily available to the public; access is subject to PAIA and to the legislation concerned.

8.1 Purpose of processing personal information

The Company processes personal information for the following purposes:

8.1.1 registering and managing member and subscriber accounts on the Website;

8.1.2 processing monthly and annual subscriptions and once-off purchases of content (payments are processed by a third-party payment service provider);

8.1.3 providing members with access to paid content and resources;

8.1.4 sending newsletters and service communications, and direct marketing where the data subject has consented or is an existing customer, in accordance with section 69 of POPIA;

8.1.5 responding to enquiries, requests and complaints;

8.1.6 maintaining, securing and improving the Website, including through analytics;

8.1.7 managing relationships with service providers and suppliers;

8.1.8 managing employment or contractor relationships, where applicable; and

8.1.9 complying with legal, regulatory, tax and accounting obligations.

8.2 Description of the categories of data subjects and of the information or categories of information relating thereto

The Company does not request or collect health information or other special personal information (as defined in section 26 of POPIA) through the Website. Should this change, for example with the introduction of a community forum or similar features, this manual will be updated.

8.3 The recipients or categories of recipients to whom the personal information may be supplied

The Company does not sell personal information. All operators that process personal information on the Company’s behalf are bound by written agreements as required by sections 20 and 21 of POPIA.

8.4 Planned trans-border flows of personal information

8.4.1 Only one of our Company’s service providers (Google Analytics) stores or processes personal information on servers located outside the Republic.

8.5 General description of information security measures to be implemented by the responsible party to ensure the confidentiality, integrity and availability of the information

The Company has implemented, or is implementing, the following safeguards:

8.5.1 encryption of data in transit between users and the Website (SSL/TLS);

8.5.2 payment card details are captured and processed by a PCI DSS-compliant payment service provider and are not stored by the Company;

8.5.3 strong passwords and multi-factor authentication for administrative access to the Website and business systems;

8.5.4 access to personal information restricted to persons who need it to perform their functions;

8.5.5 regular software, theme and plugin updates and security patching;

8.5.6 firewall, anti-malware and security monitoring on the Website;

8.5.7 regular secure backups of Website data;

8.5.8 written operator agreements with service providers that process personal information on the Company’s behalf; and

8.5.9 a procedure for notifying the Regulator and affected data subjects of security compromises, as required by section 22 of POPIA.

9.1 A copy of the Manual is available:

9.1.1 on the Website at [www.mymenopause-sa.co.za/paia-manual];

9.1.2 at the head office of Ulwazi Health Hub (Pty) Ltd. for public inspection during normal business hours, by prior arrangement with the Information Officer;

9.1.3 to any person upon request and upon the payment of a reasonable prescribed fee; and

9.1.4 to the Information Regulator upon request.

9.2 A fee for a copy of the Manual, as contemplated in Annexure B of the Regulations, shall be payable per each A4-size photocopy made.

The head of Ulwazi Health Hub (Pty) Ltd. will on a regular basis update this manual, and in any event whenever there is a material change to the information it contains.