Privacy Policy

Last updated: 30 October 2026

1. Who we are

Pierre van Ryneveld Optometrist is a trading name of Fochville Oogkundiges Inc., registration number 2015/436524/21 (referred to in this policy as “PvR”, “we”, “us” or “the practice”). We are responsible for deciding why and how personal information is processed in connection with our optometry practice, website and patient administration.

Our practice is located at Shop 9, Ryneveld Lifestyle Centre, 75 Ryneveld Avenue, Pierre van Ryneveld, Centurion, 0157. Our registered office is Shop 2, Park Street, Fochville, Gauteng, 2515.

2. Information Officer

The default Information Officer is Anne Nortman in her capacity as the director and head of the private body. No Deputy Information Officer has been designated.

Privacy, patient-record and access requests may be sent to info@pvroptom.co.za, delivered to the practice address or discussed by calling 012 662 0188.

3. Personal information we process

Depending on how you interact with the practice, we may process:

• names, identity or passport information, date of birth and contact details;
• parent, guardian or responsible-person information where a patient is a child or dependant;
• appointment choices, booking history, attendance information and communications;
• eye-health history, symptoms, examination findings, prescriptions, referrals, clinical notes and other information needed for appropriate eye care;
• medical-scheme, membership, dependant, benefit and claim information;
• quotations, invoices, payment, account and transaction information;
• spectacle, frame, lens and contact-lens requirements and order information;
• copies of information or documents a patient is asked to send by email or WhatsApp;
• marketing preferences, consent records and objections;
• website information such as IP address, browser information, cookies, device information and page activity; and
• information required by law, professional standards, insurers, auditors or regulators.

Health information and certain information about children receive additional protection under POPIA. We process this information only where it is necessary for treatment, care, practice administration, medical-scheme claims or another lawful purpose.

4. Why we process information

We process personal information to:

• arrange and confirm appointments;
• identify patients and maintain accurate patient records;
• conduct eye examinations and provide services within the registered practitioners’ professional scope;
• prepare prescriptions, quotations and orders;
• obtain or confirm medical-scheme benefits and submit lawful claims through Healthbridge or another authorised switch;
• manage payments, accounts, refunds, debtors and financial records;
• communicate about appointments, recalls, orders and patient enquiries;
• refer a patient to an ophthalmologist or another healthcare practitioner when appropriate;
• comply with legal, tax, professional, insurance, recordkeeping and regulatory duties;
• protect patients, staff, systems and the practice against fraud, misuse or security incidents;
• improve practice administration and website performance; and
• send permitted marketing communications and manage opt-outs.

Booking an appointment does not amount to consent for unrelated marketing.

5. Online booking and practice software

PvR uses OptiMax practice-management software and the MXOpti online-booking service supplied by OptiMax (Pty) Ltd. An appointment submitted through the PvR booking portal is confirmed immediately when the platform displays or sends confirmation. Patients should contact the practice if they do not receive confirmation or if any booking information appears incorrect.

The booking and practice-management systems may process identity, contact, appointment, medical-scheme, billing, communication and clinical-administration information on our behalf. The public booking interface is delivered through technology providers that may include cloud and messaging infrastructure. PvR remains responsible for selecting appropriate operators and requiring suitable privacy and security safeguards.

6. Who may receive information

We may disclose relevant information to:

• authorised PvR staff and treating optometrists;
• medical schemes, administrators and Healthbridge for benefit enquiries and claims;
• OptiMax and MXOpti for practice-management, support and booking functions;
• laboratories, lens suppliers, frame suppliers and other providers needed to fulfil an order;
• ophthalmologists or other healthcare practitioners involved in a referral or the patient’s care;
• payment, accounting, audit, insurance, legal, website-hosting, email, backup, security and technical-support providers;
• Google Analytics, connected through Google Site Kit, where the visitor’s analytics consent permits it;
• regulators, courts, law-enforcement bodies or government authorities where disclosure is required or authorised by law; and
• another recipient where the patient has authorised the disclosure or it is otherwise lawful.

We do not sell patient information to data brokers.

7. Email and WhatsApp

Patients may be asked to send prescriptions, identity documents or medical information by email or WhatsApp. SMS is not used for receiving these documents. Email and WhatsApp are convenient but may carry privacy risks outside the practice’s direct control. Patients should send sensitive documents only to the confirmed PvR contact details and only when requested.

We limit access to authorised staff and place relevant information in the appropriate patient or administrative record. Duplicate copies in communication channels should not be retained longer than necessary.

8. Marketing communications

PvR may send newsletters, promotional email, WhatsApp messages or bulk SMS communications where POPIA permits this. Unsolicited electronic marketing will be sent only where the recipient has consented or where the existing-customer provisions of POPIA apply.

Marketing messages will identify the sender and provide a reasonable, free way to object or unsubscribe. An objection will be recorded so that we can honour it. Transactional messages about appointments, orders, accounts or patient care are not marketing messages.

9. Cookies and website analytics

The website uses necessary cookies for security, functionality and consent management. Google Analytics is connected through Google Site Kit. CookieYes and Google Consent Mode are configured so that non-essential categories are denied by default until the visitor makes a choice.

Cookie settings can be changed through the banner where available or through the browser. Blocking necessary cookies may affect website functionality.

10. International processing

Some technology, communication or cloud providers may process information outside South Africa. Where this occurs, PvR will require an appropriate legal basis and safeguards consistent with section 72 of POPIA. We do not claim that every service or backup is hosted exclusively in South Africa.

11. Security

We use reasonable administrative, technical and physical safeguards appropriate to the information and risks involved. These may include access controls, passwords, role restrictions, encryption where appropriate, backups, confidentiality duties, software maintenance and measures to detect or respond to security incidents.

No electronic system or communication method is completely secure. Patients should contact us promptly if they believe information sent to or held by the practice has been compromised.

12. Retention

Patient health records are generally retained for seven years after the record becomes dormant, unless a longer period is required or justified. Records relating to a patient who was under 18 when treated are retained until at least the patient’s 21st birthday, or for seven years after the record became dormant if that is later. Longer periods apply where required by law, professional guidance, a complaint, litigation, insurance requirements or the circumstances of the patient.

Medical-aid, billing and financial records are generally retained for seven years, subject to tax, audit, dispute and legal-hold requirements. General enquiries, website information, booking data and communication copies are retained only for as long as reasonably necessary for their purpose. Marketing consent and objection records may be retained for as long as needed to demonstrate consent or honour an opt-out.

When information may no longer lawfully be retained, it will be securely deleted, destroyed or de-identified where reasonably practicable.

13. Your rights

Subject to POPIA, PAIA and other applicable law, you may ask us to:

• confirm whether we hold personal information about you;
• provide access to your personal information or patient record;
• correct or update inaccurate or incomplete information;
• delete or destroy information that we are no longer authorised to retain;
• object to particular processing, including direct marketing; or
• explain how your information has been used or shared.

We may need to verify identity and authority before releasing information. Some requests may be refused or limited where the law requires records to be retained, another person’s rights must be protected or a lawful ground for refusal applies.

14. Complaints

Please first contact the Information Officer at info@pvroptom.co.za so that the practice can investigate the concern.

A complaint may also be submitted to the Information Regulator of South Africa through inforegulator.org.za, by calling 010 023 5200 or 0800 017 160, or by writing to the appropriate complaints address listed by the Regulator. Its physical address is Woodmead North Office Park, 54 Maxwell Drive, Woodmead, Johannesburg, 2191.

15. Changes to this policy

We may revise this policy when our services, providers or legal duties change. The current version and revision date will be published on this website.