PAIA and POPIA manual

1. About this manual

This manual of West Technology Group (Pty) Ltd (registration 2023/0672402/07) (the Company, we), which operates the Care Ops platform, is published under section 51 of the Promotion of Access to Information Act 2 of 2000 (PAIA) and sets out what section 51, as amended by the Protection of Personal Information Act 4 of 2013 (POPIA), requires.

It is available on this page and, free of charge, at our address in section 2. The "In short" notes help you find your way; they are not part of the manual.

2. Our contact details

The Information Officer is responsible for compliance with POPIA and PAIA and for dealing with requests under both.

3. The Information Regulator's guide

The Information Regulator has published a guide, in each official language, on how to exercise the rights in PAIA and POPIA (section 10 of PAIA). It is available from the Regulator's website at inforegulator.org.za and at its offices (section 12). We will also give you a copy on request.

4. Records available without a request

Our privacy policy, terms of service and this manual, with every earlier version of each, are available on this website without a formal request. We have not published a notice under section 52 of PAIA.

5. Records kept under other laws

Records are kept in terms of, among others:

• Companies Act 71 of 2008
• Income Tax Act 58 of 1962, Value-Added Tax Act 89 of 1991 and Tax Administration Act 28 of 2011
• Basic Conditions of Employment Act 75 of 1997, Labour Relations Act 66 of 1995, Employment Equity Act 55 of 1998 and Unemployment Insurance Act 63 of 2001
• Electronic Communications and Transactions Act 25 of 2002
• Protection of Personal Information Act 4 of 2013 and Promotion of Access to Information Act 2 of 2000

6. Records we hold

Records hosted for a Tenant belong to that Tenant, which is the responsible party for them. A request for them should be made to the Tenant (for example your scheme, administrator or employer). If you send it to us, we will pass it to the Tenant promptly and help it respond.

7. How we process personal information

7.1 Purposes

• Providing the Platform to Tenants for administering insurance and employee benefit cover.
• Applications, enrolment, health assessment, policy administration, premium collection and member communication, for Tenants.
• Securing the Platform, keeping an audit trail and preventing fraud, including device fingerprinting of staff sign-ins, which is used for security only.
• Running our business: contracts, billing, employment and compliance.

7.2 Data subjects and categories of information

7.3 Recipients

• The Tenant, and the underwriter, administrator, broker and employer involved in the cover, each to the extent it needs.
• The policy administration system the scheme uses (for example PBT Group's i2), or its administration desk by email, to register cover and collect premiums.
• The operators in section 8.
• Authorities, where the law requires.

How long information is kept is set out in section 9 of our privacy policy.

8. Operators and transfers across borders

All information stored by the Platform is kept in Amazon Web Services' Cape Town, South Africa (af-south-1) region, including backups. The Platform's database, search, cache, messaging and authorisation services run on our own servers there. Each operator below processes personal information only on our instructions, under a written agreement requiring the security measures of section 19 of POPIA.

Where personal information goes outside South Africa, we rely on section 72 of POPIA: an agreement binding the recipient to protection substantially similar to POPIA's, the data subject's consent, or the transfer being necessary for a contract with or in the interest of the data subject. Staff dictation in the assistant uses the speech recognition of the staff member's own browser, provided by its maker, and does not pass through the Platform.

8.1 AI processing by Anthropic

Every AI feature sends text to Anthropic PBC in the United States, which acts as our sub-operator. No AI feature runs for an organisation on Care Ops until that organisation has accepted our AI operator agreement, which binds us and Anthropic to the protections in sections 19 to 21 and relies on a binding agreement under section 72(1)(a).

The health questions are asked by an AI assistant, which handles special personal information, so it also needs the member's consent (section 72(1)(b)). A member gives it by continuing past the first screen of a sign-up, where a line says so and links to section 5 of our privacy policy, for themselves and for each person they add, as parent or guardian or with that person's agreement. The assistant is told only each person's first name, age, sex and relationship and the answers given; typed ID numbers, email addresses and phone numbers are removed first. Without consent the questions are not asked online and are answered another way. Consent can be withdrawn at any time, as can the organisation's acceptance. No decision about cover is made solely by AI.

How long Anthropic keeps what it is sent is set by its commercial terms with us and is being confirmed; this section will state it once it is.

9. Security safeguards

9.1 Technical measures

• TLS 1.2 or higher on every connection, with strict transport security; servers in a private network.
• Encryption at rest with AES-256 keys in a key management service, for disks, files and backups; the most sensitive fields (identity numbers, names, dates of birth, contact details, addresses, health information, bank details, signatures, message contents) encrypted again, field by field, with AES-256-GCM; keyed hashes so that identity numbers can be matched without being decrypted.
• Passwords stored only as salted scrypt hashes; passkeys and authenticator apps for staff, which a Tenant can require; one-time codes for members and employers; rate limits on every sign-in; notices of sign-ins from new devices and places. Staff sign-ins are checked against a device fingerprint, which is hashed on the device before it is sent and used only for security: to recognise known devices, detect automated or disguised browsers, and tie each session to the device it was signed in on. It is never used for advertising, analytics or tracking, and never shared.
• Fine-grained, least-privilege permissions per scheme, group and record. Personal information is masked unless a role allows it, and revealing, exporting or answering a privacy request needs a specific permission and, where required, confirming identity again. Every reveal is logged.
• An audit trail of access, changes, exports and sign-ins that the application cannot alter or delete.
• A web application firewall, browser security policies, signed software builds, and secrets held in a dedicated secrets manager.
• Databases replicated across 3 data centres, continuous backups with point-in-time recovery kept for 35 days, and restores tested weekly.
• Staff screen recordings, used to fix faults, mask all text and form fields and never cover member, applicant or employer screens or health information.

9.2 Organisational measures

• Access to production systems limited to named people who need it.
• Confidentiality obligations on everybody with access to personal information.
• Written operator agreements with every provider in section 8.
• A register of privacy requests, each answered within 30 days.
• Regular review of our controls, and of this manual at least once a year.

10. Requesting a record under PAIA

1. Complete Form 2 of the PAIA Regulations (request for access to a record), available from the Regulator's website or from us, and send it to the Information Officer by email or post.
2. Identify the record, the form of access you want, and the right you want to exercise or protect with it. If you ask for someone else, include proof of your authority.
3. A request fee is payable, except for a request for your own personal information. Reproduction, search and preparation fees prescribed in the PAIA Regulations may also apply; we tell you of any deposit before we search.
4. We decide within 30 days, which we may extend once by up to 30 days as section 57 allows, and tell you why.
5. We may refuse access only on the grounds in Chapter 4 of Part 3 of PAIA, such as protecting another person's privacy, commercial information or confidential information, and will give reasons.

11. Your rights over your personal information

Under POPIA you may, free of charge for your own information:

• ask whether we hold information about you and for a copy of it (section 23);
• ask us to correct or delete it, using Form 2 of the POPIA Regulations (section 24);
• object to its processing, using Form 1 of the POPIA Regulations (section 11(3));
• withdraw consent where we rely on it; and
• not be subject to a decision based solely on automated processing (section 71).

Email the Information Officer, or ask your scheme. We confirm your identity, record the request, and answer within 30 days. A copy is provided as a readable file; erasure removes your identifying details and deletes your health information, documents and messages, except where the law or live cover requires them to be kept. Our privacy policy explains this in full.

12. Complaints and the Information Regulator

Please raise a complaint with our Information Officer first. You may also complain to the Information Regulator about a refusal under PAIA, generally within 180 days, or about our processing of your personal information, or apply to court.

Information Regulator (South Africa)
Woodmead North Office Park, 54 Maxwell Drive, Woodmead, Johannesburg, 2191
General enquiries: enquiries@inforegulator.org.za
POPIA complaints: POPIAComplaints@inforegulator.org.za
PAIA complaints: PAIAComplaints@inforegulator.org.za
Website: inforegulator.org.za

13. Security compromises

Where we have reasonable grounds to believe that personal information has been accessed or acquired by an unauthorised person, we notify the responsible Tenant immediately (section 21), and where we are the responsible party we notify the Information Regulator and the people affected as soon as reasonably possible (section 22), with enough information for them to protect themselves.

14. Updates to this manual

We review this manual at least once a year and whenever our processing changes materially. The date at the top shows when the version in effect was published, and every earlier version is kept on this page's version history.