The Promotion of Access to Information Manual for GreenNotes Proprietary Limited, Registration Number 2024/592066/07
Published in terms of section 51 of the Promotion of Access to Information Act 2 of 2000 and the Protection of Personal Information Act 4 of 2013.
1.1 The Promotion of Access to Information Act 2 of 2000 (“PAIA”) gives effect to the constitutional right of access to information held by another person where that information is required for the exercise or protection of any rights (section 32(1)(b) of the Constitution).
1.2 The Protection of Personal Information Act 4 of 2013 (“POPIA”) gives effect to the constitutional right to privacy by regulating how personal information may be processed, and gives data subjects rights and remedies in respect of their personal information.
1.3 PAIA requires a private body to publish a manual that describes the records it holds and explains how to request access to them. POPIA requires the manual also to describe the purposes for which the body processes personal information, the categories of data subjects and of their information, the recipients to whom the information may be supplied, planned transfers of personal information outside South Africa, and the security measures in place.
1.4 This is the manual of GreenNotes Proprietary Limited (“GreenNotes”, “we” or “us”). GreenNotes provides an electronic health record and practice-management platform to healthcare practices through a web portal and Android and iOS apps (the “Services”).
1.5 Company Details
Section 51(1)(a) of PAIA
2.1 The head of GreenNotes for the purposes of PAIA is its Chief Executive Officer, who is also its Information Officer. Requests under PAIA, and requests and complaints about personal information under POPIA, should be sent to the Information Officer:
2.2 Head of the Private Body and Information Officer
2.3 The Information Officer coordinates all requests and may consult GreenNotes’ external legal advisers where necessary.
Section 10 of PAIA
3.1 The Information Regulator has published a guide on how to use PAIA and POPIA (“the Guide”). It is available in all official languages and in braille.
3.2 The Guide explains, among other things:
3.3 The Guide can be obtained from the Information Regulator’s website, or on request from our Information Officer.
3.4 Information Regulator
4.1 Most of the personal information in the Services is patient information that healthcare practices (our “Customers”) record about their own patients: clinical records, consultations, notes, documents, recordings, appointments, invoices and medical-aid claims. For this information the practice is the responsible party, and GreenNotes processes it only as the practice’s operator, on its instructions and under our Data Processing Agreement.
4.2 A patient who wants access to their personal information, or wants it corrected or deleted, should ask the practice concerned. The practice is the responsible party under POPIA, decides on access to its records and has the legal duties that go with them. If we receive such a request, we will promptly refer it to the practice, tell the requester that we have done so, and help the practice respond.
4.3 A request made to GreenNotes under PAIA for a record in our possession or under our control, including a record we hold for a practice, is dealt with under PAIA as set out in section 8. Where the record concerns a practice or its patients, we will notify and consult the practice, and any other third party, as PAIA requires (section 71), and consider the grounds for refusal that protect them, such as the privacy of patients (section 63) and information supplied in confidence (section 65). Where giving a requester access to a record about their physical or mental health might seriously harm them, we may first consult a health practitioner (section 61).
4.4 Unless the law requires it, we will not confirm to anyone other than the practice whether a particular person is a patient of a particular practice.
4.5 GreenNotes is the responsible party for other information, such as its own company, employment and financial records, and the account, subscription, support and marketing information described in section 7. Requests for those records are dealt with under this Manual.
Section 52 of PAIA
5.1 GreenNotes has not made a voluntary disclosure under section 52 of PAIA of categories of records that are automatically available. The following records are nevertheless available on our website without a PAIA request:
Section 51(1)(b) of PAIA
The following are the subjects on which GreenNotes holds records, and the categories of records held on each. Listing a category does not mean that access to it will be granted: every request is considered under section 8.
| Subject | Categories of records |
|---|---|
| Company and governance | Incorporation documents, memorandum of incorporation, share register, records of directors, minutes and resolutions, statutory returns |
| Finance and tax | Financial statements, accounting records, bank records, invoices issued and received, tax and VAT records |
| Customers and users | Customer agreements and accepted terms, practice and user account records, subscription and billing records, payment records, support tickets and correspondence |
| Records held for Customers (see section 4) | Patient and clinical records, documents, consultation recordings and transcripts, appointments, patient invoices and medical-aid claims, and the change history of these records, all held as the practice’s operator |
| Employees and contractors | Employment contracts, personnel files, payroll, leave, training, performance and disciplinary records, benefits records |
| Information technology and security | System and access logs, device records, security incident records, backups, technical documentation |
| Sales and marketing | Enquiries and leads, webinar and demo registrations, consent records, website analytics |
| Suppliers and service providers | Supplier agreements, data processing agreements, supplier and payment records |
| Legal and compliance | PAIA and POPIA records (including requests received and this Manual), correspondence with regulators, insurance records, records of legal proceedings |
GreenNotes keeps records in terms of the following legislation, where it applies to GreenNotes:
| Legislation | Records |
|---|---|
| Companies Act 71 of 2008 | Incorporation records, memorandum of incorporation, registers of directors and securities, minutes, financial statements |
| Income Tax Act 58 of 1962 and Tax Administration Act 28 of 2011 | Tax returns, PAYE records, IRP5 certificates, supporting records |
| Value-Added Tax Act 89 of 1991 | VAT records, where GreenNotes is registered for VAT |
| Electronic Communications and Transactions Act 25 of 2002 | Records of electronic transactions and of terms accepted electronically |
| Consumer Protection Act 68 of 2008 | Customer agreements and related records, where the Act applies |
| Protection of Personal Information Act 4 of 2013 | Information Officer registration, records of data subject requests and security compromises, data processing agreements |
| Promotion of Access to Information Act 2 of 2000 | This Manual, records of requests and decisions, annual reports to the Information Regulator |
| National Health Act 61 of 2003 | Health records held on behalf of Customers, who remain responsible for them (see section 4) |
| Basic Conditions of Employment Act 75 of 1997 and Labour Relations Act 66 of 1995 | Employment contracts, time and remuneration records, leave records, disciplinary and grievance records |
| Employment Equity Act 55 of 1998 | Employment equity records, where the Act applies to GreenNotes |
| Unemployment Insurance Act 63 of 2001 and Unemployment Insurance Contributions Act 4 of 2002 | UIF registrations and returns |
| Skills Development Levies Act 9 of 1999 | Registrations and levy returns |
| Compensation for Occupational Injuries and Diseases Act 130 of 1993 and Occupational Health and Safety Act 85 of 1993 | Registrations, and records of workplace injuries and health and safety |
Section 51(1)(c) of PAIA
7.1 This section summarises how GreenNotes processes personal information. Our Privacy Policy gives more detail.
Patients, including prospective patients who complete an intake form before their first appointment:
This includes special personal information (health information) and, where patients are minors, the personal information of children.
Persons connected with a patient, where the practice records them:
Personal information may be supplied to:
Our system of record, meaning the database and file storage, is hosted in South Africa (Google Cloud, Johannesburg). Some processing takes place in other countries:
| Purpose | Where | Personal information involved |
|---|---|---|
| AI-assisted transcription and clinical documentation, for practices that use these features | European Union, with the United States as a fallback. Groq transcribes in the United States. Patient Overview summaries may be processed in any region where Google provides the service. | Consultation audio, transcripts, clinical context and the patient details a clinician includes, patient summaries, and documents and images being scanned |
| Sending email | United States | Email addresses and message content, including documents a practice chooses to email, such as letters, invoices, statements and consent certificates |
| Sign-in, push notifications to the apps, and app crash reports | United States, and Google’s global infrastructure | User names, email addresses, and sign-in and device details. Notifications carry generic text and record identifiers, never patient names. Crash reports are designed to exclude patient information. |
| Some background and email-dispatch services | Belgium | Practice and patient information that those services handle while running. It is stored in South Africa, not Belgium. |
| Internal alerts to the GreenNotes team | United States | Record identifiers and, for following up incomplete sign-ups, the person’s first name and email address. No patient information. |
| Calendar sync, only when a clinician connects their own Outlook or Google calendar | Wherever the clinician’s calendar provider holds their calendar | Appointment times. Appointment details are hidden unless the clinician chooses to show them. |
| Sign-up and sales automation | Ireland | Details given at sign-up, such as the user’s name, speciality and contact details and the practice’s name, contact details and address; progress through sign-up; and the fact that a payment card was added, without its details. No patient information. |
| Our public website, analytics and advertising | United States, and other countries where those providers operate | Visitors’ IP addresses and browser and device information, cookie identifiers where cookies are accepted, and details described in our Privacy Policy, such as a hashed email address sent to Meta at sign-up. No patient information. |
We transfer personal information outside South Africa in accordance with section 72 of POPIA. We require each recipient, by written agreement, to provide protection substantially similar to POPIA’s conditions for lawful processing, including restrictions on further transfers, or we rely on another basis that section 72 permits. The current providers, purposes and processing locations are kept up to date on our Sub-processors page.
GreenNotes uses technical and organisational measures appropriate to the sensitivity of the information it processes. In general terms, they include:
Sections 50 and 53 to 58 of PAIA
A requester must be given access to a record of GreenNotes if the record is required for the exercise or protection of a right, the requester complies with the procedural requirements of PAIA, and access is not refused on a ground for refusal in PAIA (section 50). PAIA does not apply to a record requested for criminal or civil proceedings after those proceedings have started, where the production of the record is provided for in another law (section 7).
If a request is incomplete, we will tell the requester what is needed and help them to complete it.
The prescribed request fee may be payable before we process a request. If access is granted, the prescribed fees for reproduction, search and preparation, and delivery may also be payable. Where searching for and preparing a record will take longer than the period prescribed in the PAIA Regulations, we may require the prescribed deposit. The current fees are published on the Information Regulator’s PAIA fees page. The Information Officer will confirm the amounts payable, and access is given once the fees are paid.
A PAIA request is separate from asking us to confirm whether we hold personal information about you, which is free (section 9).
We will decide on a request within 30 days of receiving a complete request, and notify the requester of the decision and any fees using Form 3. We may extend this period once, by up to 30 days, where PAIA allows, and will tell the requester why. If we do not decide within the required period, the request is regarded as refused.
Where a request concerns a record about a third party, we will take reasonable steps to notify the third party within 21 days of receiving the request, and the third party will have 21 days to make representations before we decide.
GreenNotes may, and in some cases must, refuse access to protect:
Access must nevertheless be granted where disclosure would reveal evidence of a substantial contravention of, or failure to comply with, the law, or an imminent and serious public safety or environmental risk, and the public interest in disclosure clearly outweighs the harm (section 70).
GreenNotes has no internal appeal procedure. A requester or third party who is dissatisfied with a decision of GreenNotes may complain to the Information Regulator using Form 5 (Complaint Form) prescribed by the PAIA Regulations, generally within 180 days of the decision. Once the complaint procedure before the Information Regulator has been exhausted, the requester or third party may apply to a court for appropriate relief, in accordance with section 78 of PAIA.
9.1 Subject to POPIA, a data subject may:
9.2 Send requests to the Information Officer with proof of identity. For patient information held for a practice, contact the practice first (section 4); we will refer requests we receive to it and help it respond. The POPIA forms are available on the Information Regulator’s POPIA forms page, or from our Information Officer.
10.1 This Manual is available free of charge on our website, and for public inspection at our principal place of business during normal business hours. We will give a copy to anyone who asks for it, subject only to any prescribed fee for reproduction or delivery, and to the Information Regulator on request.
10.2 We review this Manual at least once a year, and whenever there is a material change to our processing activities, the records we hold, our sub-processors, our transfers of personal information outside South Africa or our contact details. The date at the top shows when it was last updated.