Privacy notice

Eastway and your selected practice

SWL AUGUSTYN (PTY) LTD, trading as Eastway Medical Health and Wellness, handles website bookings and agreed administration at the address below. Your selected practice handles your treatment, clinical records, accounts and relevant medical-scheme claims. Shared reception does not give every practice access to your records.

The booking form identifies your selected practice and practitioner. Find their contact details in the care partner directory, or ask reception to direct a privacy or records request to the practice’s Information Officer. Independent practices remain responsible for their own privacy notices and PAIA manuals.

Information Officer: Melinda Augustyn
reception@eastwaymedical.co.za · 083 250 4343

Physical address and delivery of correspondence: Shop 30a, Shopping on Eastway, corner of Midstream Ridge Drive and Eastway Drive, Midstream, Gauteng, South Africa. Email is the preferred first contact for records requests; please arrange delivery with the Information Officer.

Booking information and acknowledgements

We receive names, contact details, appointment choices and acknowledgements from you or your authorised representative, and booking updates from your practice. These support arranging appointments, contacting you and agreed administration. Required fields are marked. Without the required information or authority, we may be unable to arrange an online booking; call 083 250 4343 for assistance.

When you book for someone else, we also record your name, whether you are booking for another adult or a child, and the relevant authority acknowledgements. The acknowledgement wording, version, date, selected practice and submission channel are saved with the request. Booking for another person does not make you responsible for their account.

Your practice separately collects information needed for care, medical records, accounts, lawful claims and legal obligations. Health information receives special protection under POPIA; clinical confidentiality and records are also governed by the National Health Act. Processing may rely on service arrangements, legal duties or another lawful basis, with specific consent where required.

Booking is not consent to treatment, marketing, AI recording or clinical photographs. Those permissions are obtained separately where applicable. If authority to book is uncertain, or a young person needs confidential care, contact reception before using the form.

Sharing, service providers and processing locations

Information is limited to authorised staff and providers who need it for the relevant purpose. Eastway’s booking system uses its hosted application and database, Resend for transactional email, and Meta’s WhatsApp service where that channel is enabled and chosen. Communication providers and recipients may retain their own copies. Your practice may share necessary information with care providers and a scheme or insurer for relevant lawful claims; specific disclosure consent is obtained where required.

Providers may process information in South Africa or other countries. Please contact the Information Officer for the provider, country and transfer-safeguard details applicable to a particular service. No assurance that all processing stays in South Africa is made. Cross-border processing must have an applicable lawful basis and appropriate protection.

Access controls, encrypted booking storage, authenticated staff access, role restrictions and audit records help protect information. No website form should be used to send clinical records, identity documents or detailed case information unless the practice has specifically arranged a secure process.

Retention and deletion

Information is retained according to its purpose and applicable legal and professional obligations. Records are deleted or de-identified when no longer needed and lawful to do so. A withdrawal or deletion request does not remove information that must lawfully be retained.

• Administrative WhatsApp conversations: routine inbox retention is 90 days. Legal holds and clinical correspondence awaiting filing are exceptions.
• Database backups: the configured backup rotation is approximately 30 days. A change to the working database may therefore remain in a protected backup until rotation.
• Appointments, booking acknowledgements, accounts and audit records: retention is assessed by the Information Officer and relevant practice. These records are not automatically erased when an appointment ends or a user signs out.
• Clinical and financial records: the responsible practice applies its legal and professional retention requirements. Contact that practice for the period applicable to your records.

The Information Officer can explain retention for a particular record and review access, correction, deletion, restriction or objection requests. Consent can be withdrawn where consent is the basis for processing, without invalidating earlier lawful processing.

Website technical data and cookies

The site uses essential cookies and browser storage for preview access, secure patient/staff sessions, preferences and protection against abuse. The server may process connection information, including IP address and browser details, for security and request handling. Signing out ends the relevant session; disabling essential cookies can prevent sign-in.

Optional external content, such as a video, map, messaging link or practitioner website, is governed by that provider’s notice when you choose to open or load it. Eastway booking acknowledgements do not authorise marketing or advertising tracking.

Access to records and complaints

See the PAIA manual and records-request process. It explains how to request Eastway-held records and how to contact an independent practice for its records. PAIA does not make clinical records public.

You may also contact the Information Regulator: enquiries@inforegulator.org.za · 010 023 5200.

Private patient information forms

From 4 October 2026, you can open the patient information form directly, scan the reception QR sign, or use a private link sent by reception. Complete one form per patient. This form collects the patient's full name, ID or passport number, date of birth, contact details, medical-aid membership and main-member details where applicable, and an emergency contact. If you complete the form for another adult or a child, it also asks for your name, relationship and authority to provide their information.

These details support patient registration, appointment and billing administration. Required fields are marked; email and WhatsApp permission are optional. Tell your emergency contact that you have named them. If you cannot provide a required detail, contact reception for assistance rather than entering someone else's information.

A private invitation link expires after seven days and accepts one submission. The reception QR sign opens a blank form for each patient and can be reused; it does not give access to anyone's submitted information. Your submitted information is stored in the encrypted administration database and is available to authorised reception and admin staff for review and appropriate filing with your selected practice. Reception verifies identity, contact details and representative authority before filing. Identity numbers and medical-aid details are not inserted into the WhatsApp conversation. Keep a private invitation link to yourself and the authorised person completing it. The retention and records-request arrangements described below also apply to these forms.

The form records the privacy acknowledgement and optional WhatsApp choice with their wording, version and time. WhatsApp permission covers appointment and administration updates and can be withdrawn by replying STOP. A previous STOP remains in place until you message START to Eastway. Submitting a form does not create an appointment, confirm scheme benefits, accept responsibility for another person's account or provide consent to treatment or marketing.

Information we collect

Depending on the feature you use, Eastway may collect:

• Your name, email address and mobile number.
• Your selected service, practitioner, appointment date and time.
• Patient access verification, session and account-security records.
• For invited provider users: work-account details, practitioner-account linkage, email verification challenges, session and device user-agent security records.
• Provider actions and audit records, including when an authorised practitioner opens an owned appointment or changes its operational status or time.
• A general enquiry topic and the message you choose to send.
• Your consent choices, including optional WhatsApp consent.
• Technical and security records needed to protect the website and prevent misuse.

Patient and provider mobile access

The Eastway mobile app uses the same patient and appointment records as the secure website patient tools. Patient access uses a private code sent by email or WhatsApp, where available, and short-lived session credentials. The app stores session credentials in the device's protected storage and does not store the verification code or the private preview password.

Eastway Provider is a separate app for invited, authorised practitioners and practice teams. Provider sign-in uses a work email address, password and emailed one-time code. The app does not persist the password or verification code. It stores revocable session credentials in the device's protected storage, while the service keeps limited session-security records such as expiry, revocation history and user agent.

Provider schedule lists disclose only the patient display name and appointment summary needed for the practitioner's own calendar or an explicitly assigned practice's calendars. Opening an authorised appointment can disclose the minimum patient contact and visit details needed to administer it; that detail access and provider appointment actions are recorded in an audit trail. Eastway Provider does not expose billing, payment, invoice or clinical-note tools.

Authorised practice teams can administer their assigned bookings and WhatsApp reception conversations. If staff notifications are enabled and the device user permits them, Eastway records a revocable device notification token and delivery status. Generic alerts are delivered through Expo and the platform notification service; they do not include patient names, clinical details or conversation text on the lock screen. Opening an alert still requires authorised app access.

Patients and providers must keep passwords and verification codes private, sign out on shared devices and protect access to their email account and phone. Eastway staff should not ask a patient to disclose a verification code.

How we use it

We use this information to respond to enquiries, create and manage appointments, send requested booking communications, operate the patient and provider tools, link authorised practitioners to their own calendars, record security and appointment actions, keep appropriate records and protect the service from fraud or abuse.

General enquiry forms are not intended to collect symptoms, diagnoses, medical-aid details or identity numbers.

Why information is requested

Supplying information is voluntary, but Eastway cannot create or manage an appointment, verify patient access or answer an enquiry without the details needed for that service. Information is processed to provide requested healthcare administration, meet legal and record-keeping duties, protect patients and the service, and act on consent where optional communications are selected.

The app does not contain advertising trackers and Eastway does not use patient information for targeted advertising.

Email and WhatsApp

When you contact reception on WhatsApp, Eastway stores your number, WhatsApp profile name, text conversation and attachment information in its encrypted reception inbox. Authorised staff can retrieve supported attachments from WhatsApp to view or download them in the secure staff web inbox. Attachment contents are not permanently stored in the inbox; downloaded files and relevant clinical content must be handled and filed in the appropriate patient record. Attachment access is recorded. Access is limited to authorised staff according to their role and conversation assignment. Clinical correspondence is restricted to its assigned clinician and authorised readers, and must be filed in the correct patient record. Inbox messages normally expire after 90 days. Clinical correspondence awaiting filing and conversations under a legal hold are retained longer. The filed patient record and protected backups follow their separate retention rules. General enquiries should not include medical information, and WhatsApp must not be used for emergencies.

Booking emails are sent to the email address supplied with the appointment. WhatsApp booking, waitlist, status, and reminder updates are optional and are used only when separate WhatsApp consent has been recorded for that mobile number. When WhatsApp booking is available and selected, an email address is optional. A sign-in code requested on WhatsApp verifies access to your booking; requesting that code does not opt you in to optional booking updates.

You can decline WhatsApp without affecting your booking and can ask Eastway to stop WhatsApp messages at any time. Email and WhatsApp are operated through external communication providers and messages may remain visible on the recipient's device or account.

When an authorised provider cancels or reschedules an appointment, Eastway may queue the related patient update through the communication channel recorded for that appointment. WhatsApp remains subject to the patient's separate consent choice. Providers may approve their own booking requests through a verified private number. Patient confirmations and messages are sent by Eastway; the provider's private number is not included in those patient messages.

Storage and safeguards

See processing arrangements and retention above for provider, access and record-handling information.

Your choices

You may ask Eastway to explain, correct or update information held about you, or to consider a deletion or objection request where applicable. Some records may need to be retained for legal, safety or operational reasons.

You can submit an account or data-rights request from the mobile app, use the deletion request form below, or email reception@eastwaymedical.co.za. We may need to verify your identity before acting on it. A request does not override medical, safety, tax or other legal record-retention duties that apply to Eastway.

An invited provider user may use the same privacy contact to ask about access, correction, objection or deletion of their provider-account information. The patient deletion form below is specifically for patient accounts and associated information.

Request account and data deletion

Use this form if you can no longer access the app or want Eastway to review deletion of your patient account and associated information. This records a request for identity-verified review; it does not immediately erase medical or appointment records.

Do not include symptoms, diagnoses, identity numbers, medical-aid details or other clinical information.

Security and urgent care

Eastway uses access controls and other safeguards appropriate to the website, but no online service or communication channel can guarantee absolute security. Keep patient access codes and provider credentials private and sign out on shared devices.

The website and app support service discovery and appointment administration; they do not provide a diagnosis, emergency response or a substitute for professional medical advice. Do not use the app, website, email or WhatsApp for urgent medical help. Contact emergency services immediately.

Privacy contact and complaints

SWL AUGUSTYN (PTY) LTD operates Eastway Medical Health and Wellness and is responsible for the information processed by these patient, provider and booking services. For access, correction, objection, deletion or other privacy questions, email reception@eastwaymedical.co.za.

You may also learn about POPIA rights or lodge a complaint through the Information Regulator South Africa.