PAIA Manual

1. Acronyms and definitions

2. Purpose and status of this Manual

This Manual is prepared for PrimaEdge as a private body in terms of section 51 of PAIA. It assists a person to identify records held by PrimaEdge, understand which records may be available without a formal request, understand how to request access to other records, and understand relevant aspects of PrimaEdge's processing of personal information for purposes of PAIA and POPIA.

This Manual must be read, where relevant, with PrimaEdge's Privacy Notice, POPIA Consent Notice, Member/App Terms of Service, Employer Services / Commercial Terms and Data Governance Statement.

The inclusion of a record category does not mean that every record in that category exists in every case or that access will automatically be granted. Access remains subject to PAIA, POPIA, confidentiality obligations, health-information protections, legal privilege and any applicable ground of refusal.

3. Particulars of PrimaEdge

4. Information Officer and access contacts

A DIO should be listed only if one has actually been designated. The applicable Information Officer / Head of Private Body must be registered with the Information Regulator before taking up POPIA Information Officer duties.

5. Information Regulator guide on how to use PAIA

1. The Information Regulator has published a Guide explaining how to exercise rights under PAIA, including the objects of PAIA and POPIA, procedures for requests, assistance available, fees and remedies.
2. The current Guide and prescribed PAIA forms are available from the Information Regulator. The Regulator currently publishes Form 2 for a Request for Access to Record, Form 3 for the outcome of a request and fees payable, and Form 5 for complaints.
3. Current Regulator contact details should be checked when required. The Regulator currently publishes telephone number 010 023 5200 and email enquiries@inforegulator.org.za.

6. Records available without a formal PAIA request

Records deliberately made public by PrimaEdge may generally be accessed without a formal PAIA request, subject to the manner in which they are published or otherwise made available.

Direct application or account access does not convert confidential or personal records into public records and does not create access rights for another person.

7. Records available in terms of other legislation

PrimaEdge may hold records required by legislation applicable to its business and activities. The applicability of a statute to a particular record depends on the activity and record concerned.

This list is not intended to state that every listed statute applies to every PrimaEdge activity or record, nor is it exhaustive of legislation that may apply from time to time.

8. Subjects and categories of records held

9. How to request access to a record

1. A requester seeking access to a record not otherwise available must use the prescribed PAIA form applicable at the time of the request. Under the current Regulations this is Form 2, Request for Access to Record, submitted to the Information Officer / Head of Private Body or designated access contact.
2. For a request to a private body, the requester must identify the right sought to be exercised or protected and explain why the requested record is required for the exercise or protection of that right.
3. The request must identify the requested record with sufficient detail, identify the requester and any authorised representative, provide appropriate proof of identity or authority, indicate the preferred form of access where applicable and provide contact details for communications concerning the request.
4. PrimaEdge will notify the requester of prescribed fees, if any, in accordance with PAIA and the applicable Regulations. PrimaEdge will not create an ad hoc fee regime inconsistent with the prescribed framework.
5. A valid request will be considered within the period prescribed by PAIA, subject to any lawful extension. Access may be granted, partially granted or refused where PAIA permits or requires refusal.
6. A Member who can already view particular information through the app does not need to submit a PAIA request merely to use that functionality. A request for additional records or information not made available through self-service may still be made under the applicable legal framework.
7. A request for a data subject's own personal information may also engage rights under POPIA. PrimaEdge will apply the appropriate legal framework having regard to the nature of the request.

10. Grounds of refusal and protected interests

1. PAIA contains grounds on which access to records of a private body must or may be refused. Depending on the record, these may include protection of third-party privacy; commercial information; confidential information; safety and security interests; legally privileged material; research information; and other interests protected by PAIA.
2. In the PrimaEdge context, a request by an Employer or other third party for an individual Member health record will not be treated as permissible merely because the Employer sponsors or pays for the service. The request must be assessed under PAIA, POPIA, applicable health-confidentiality requirements and any other applicable law.
3. Access to technical or security records may be restricted where disclosure would expose credentials, security architecture, vulnerabilities, access controls or other information in a manner that creates a material security or legal risk.
4. Where a request is refused, PrimaEdge will communicate the decision and applicable reasons and remedies in accordance with PAIA, subject to any lawful restriction on disclosure of the protected information itself.

11. Processing of personal information

11.1 PrimaEdge processes personal information for purposes connected with its health and wellness services and business operations. These may include Member registration and account administration; health screening, early risk identification, health management and referral; Member-selected functionality; programme administration; medical-scheme submissions where lawfully authorised; aggregated and appropriately de-identified Employer reporting; research, statistical analysis, trend analysis and population-level health insights where permitted; communications and support; security and fraud prevention; contractual administration; legal/regulatory compliance; corporate administration; finance; personnel administration; and supplier/operator management.

11.2 Categories of data subjects and information

11.3 Recipients or categories of recipients

Depending on the processing activity and applicable law, information may be supplied to authorised PrimaEdge personnel and health professionals; the relevant Member; operators and service providers; medical schemes or authorised recipients where the applicable Member choice or another lawful basis permits; professional advisers; regulators, courts or public authorities where legally required; and participating Employers only to the extent permitted by the service model, Member choices and law.

Participating Employers are not, merely by sponsoring or procuring PrimaEdge services, entitled to individual Member health results. Employer reporting is intended to be aggregated and appropriately de-identified and subject to the additional safeguards described in the related PrimaEdge documents.

11.4 Transborder flows

PrimaEdge's current operating model is that the production database containing Member information is hosted in South Africa. Routine storage of, or access to, personal information from outside South Africa: none identified at present, consistent with the confirmation already recorded in PrimaEdge's Privacy Notice, Section 6 TO CONFIRM against third-party providers. Any applicable transborder information flow will be handled in accordance with applicable law.

11.5 Security measures

PrimaEdge applies technical and organisational safeguards appropriate to its operating model and risk profile. The Data Governance Statement describes the current governance and technical controls in greater detail.

12. Availability of this Manual

1. Once finalised, the Manual will be made freely available on PrimaEdge's website and at its principal place of business for public inspection during normal business hours, and will be made available to the Information Regulator upon request as required by PAIA.
2. A person requesting a printed or reproduced copy may be charged only such fee as is lawfully permitted.
3. PrimaEdge may also upload the Manual through the Information Regulator eServices facility. Such upload does not replace the obligation to keep the Manual available through the channels required by PAIA.

13. Remedies and complaints

1. If a requester is dissatisfied with a decision of PrimaEdge, or a request is not dealt with within the applicable period, the requester may use the remedies available under PAIA, including a complaint to the Information Regulator and, where applicable, proceedings before a competent court.
2. The Regulator currently publishes Form 5 for a PAIA complaint and provides PAIA guidance and complaint information through its website and eServices facilities.

14. Review and updating

1. PrimaEdge will review this Manual when reasonably necessary, including where its records, services, processing activities, public particulars or applicable legal requirements materially change.
2. Version control must be maintained so that the current published Manual can be identified.

15. Related PrimaEdge documents

This Manual forms part of PrimaEdge's broader privacy and information-governance framework and should be read, where relevant, with the Privacy Notice, POPIA Consent Notice, Member/App Terms of Service, Employer Services / Commercial Terms and Data Governance Statement.