How Fit4Work Medicals collects, uses and protects personal information — including the health information that occupational medicals necessarily involve.
Who is responsible for your information
Fit4Work Medicals ("we", "us") is the responsible party for the personal information described in this policy, as that term is used in the Protection of Personal Information Act 4 of 2013 (POPIA).
For any question about this policy, or to exercise any of the rights set out below, contact us at L.serfontein13@gmail.com, on WhatsApp, or by phone on +27 82 490 4349.
What we collect
We collect only what a specific purpose requires:
Enquiry details you send us — name, company, approximate number of employees, phone number, email address and anything you write in your message.
Health information gathered during an assessment — medical history, examination findings, test results and the fitness outcome. This is collected only from the person being assessed, and only in the course of providing the service.
Visit counts. We count visits ourselves, with no cookies and no outside analytics company. For each page opened we keep the page, the site you came from (its address only), any campaign tag in the link and whether you arrived from an advertisement, the kind of device and its language, how long the page was open, how far down it was read and which parts of it you looked at, how fast it loaded, the buttons and links you tapped, and whether you started the enquiry form, which of its steps you reached, or tapped WhatsApp, phone or email. We also keep the province and city your internet connection is in, looked up from your IP address at the moment of the visit; the IP address itself is not kept (location data by DB-IP, db-ip.com, CC BY 4.0). A random number ties the pages of one visit together, and a yes/no note in your browser tells us whether you have visited before. The counts never hold health information: nothing you choose or type in the enquiry form, the review form or WhatsApp, and nothing that identifies you. We use them only to see which pages, sources and areas work.
A WhatsApp message started from this site ends with a short visit reference, such as "Ref F-4F2KQ". It lets us see which page and advertisement led to your message; on its own it does not identify you.
A review, if you choose to submit one, together with the name and role you give it.
Health information is treated differently
Health information is special personal information under section 26 of POPIA. We process it under the section 32 exemption that permits medical professionals to process health information where it is necessary for the proper treatment or care of the person concerned.
Clinical records are kept confidential. An employer who commissions an assessment receives the outcome — a certificate of fitness stating fitness for the role and any restrictions — and not the underlying clinical detail, unless the employee has specifically consented to more being shared.
Employees are told what is being assessed and why before an assessment begins.
Why we process it, and on what basis
To respond to an enquiry and provide a quote — on the basis of taking steps at your request before entering a contract.
To conduct assessments and issue certificates — to perform the contract with the employer, and under the section 32 exemption for health information.
To meet obligations under the Occupational Health and Safety Act 85 of 1993 and the Compensation for Occupational Injuries and Diseases Act 130 of 1993 — because the law requires it.
To understand which pages and advertisements bring enquiries — on the basis of our legitimate interest in running the practice, and with your consent where cookies are involved.
Who else sees it
We do not sell personal information, and we do not share it for anyone else's marketing. Information reaches third parties only where a service we use requires it:
WhatsApp (Meta Platforms) — when you choose to start a chat with us, the message and your number are handled by WhatsApp under their own terms.
Supabase — the database that stores reviews and website usage records.
Zeed Studios — our web developer, which hosts this website on its own server and runs its visit counts. It looks up the province and city from your IP address and does not keep the address.
Meta — where you have accepted analytics cookies, aggregate advertising measurement.
The employer who commissioned an assessment — the certificate of fitness and its outcome only.
How long we keep it
Occupational health records — retained for the periods required by health and safety legislation, which can extend for decades after employment ends where hazardous exposure is involved.
Enquiries that do not become work — kept no longer than 12 months.
Visit counts — kept in a form that does not identify you personally.
Reviews — kept until you ask us to remove them.
How it is protected
The website is served over HTTPS only, with strict transport security enforced.
Database access is governed by row-level security: website visitors can never read back stored records.
Administrative access requires an approved Google account on a fixed allowlist, enforced both in the application and in the database.
Clinical records are kept confidential and are not stored on this website.
Your rights
Under POPIA you may:
Ask what personal information we hold about you, and receive a copy.
Ask us to correct or delete information that is inaccurate, irrelevant, excessive, out of date or obtained unlawfully.
Object to processing based on legitimate interest.
Withdraw consent where processing relies on it — this does not affect processing already carried out.
Complain to the Information Regulator.
Cookies and similar technology
This website stores a small amount of information in your browser and, with your consent, allows advertising measurement. What is stored, and how to refuse or withdraw it, is set out in the Cookie Policy.
Changes
This policy may be updated as the practice or the law changes. The date at the top reflects the current version.