PAIA Manual

Manual in terms of Section 51 of the Promotion of Access to Information Act 2 of 2000

Stazalog (Pty) Ltd, trading as StazaCare, Registration No. 2018/235771/07

1. Introduction and Purpose

1.1 This Manual is compiled by Stazalog (Pty) Ltd, trading as StazaCare ("StazaCare", "we", "us", "the private body"), in accordance with section 51 of the Promotion of Access to Information Act 2 of 2000 ("PAIA").

1.2 PAIA gives effect to section 32 of the Constitution of the Republic of South Africa, 1996, which guarantees every person the right of access to information held by the State, and to information held by another person that is required for the exercise or protection of any right.

1.3 This Manual explains the records StazaCare holds, which of those records are available without a formal request, how to request access to a record under PAIA, the fees that may apply, and the remedies available to a requester who is dissatisfied with the outcome of a request.

1.4 This Manual does not itself grant a right of access to any record. It is a guide to the procedure. Access to a specific record remains subject to the grounds for refusal set out in Chapter 4 of PAIA.

2. Contact Details

Private body	Stazalog (Pty) Ltd, trading as StazaCare
Registration number	2018/235771/07
Head of the private body / Information Officer	[Name to be inserted — to be registered with the Information Regulator on its eServices portal before this Manual is published]
Postal / contact address	[To be confirmed]
Telephone	082 304 4740
Email	stazalog@gmail.com

Note: in terms of PAIA, the "head" of a private body that is a company is the person duly authorised by that company, and this role is fulfilled by the same Information Officer appointed under section 55 of the Protection of Personal Information Act 4 of 2013 ("POPIA"), as referred to in our Privacy Policy. That appointment must be confirmed and registered with the Information Regulator before this Manual is finalised and published.

3. The Guide on How to Use PAIA

3.1 The Information Regulator has, in terms of section 10 of PAIA, compiled a Guide on how to use PAIA, containing information to assist a person wishing to exercise a right of access to information. The Guide is available from the Information Regulator's website (www.inforegulator.org.za) in all official languages, including braille, and may also be requested directly from the Information Regulator.

3.2 The Information Regulator's contact details are: JD House, 27 Stiemens Street, Braamfontein, Johannesburg, 2001; email inforeg@justice.gov.za; website www.inforegulator.org.za.

4. Description of StazaCare's Structure and Functions

4.1 Stazalog (Pty) Ltd is a private company incorporated in South Africa. Trading as StazaCare, it develops and operates a cloud-based practice management platform for dental practices, providing patient management, appointment scheduling, clinical documentation, billing, laboratory work tracking, marketing communications, and related administrative functionality to subscribing dental practices ("Practices").

4.2 In relation to Practices' patients, StazaCare generally acts as an Operator (as defined in POPIA), processing personal information on the instructions of, and on behalf of, the Practice, which remains the Responsible Party. This distinction is important for understanding how requests concerning Patient information are handled, and is addressed further in Clause 7.3 below.

5. Records Automatically Available (No Request Required)

5.1 The following records are freely available to members of the public, without the need to submit a formal PAIA request, generally via our website:

• this PAIA Manual;

• the Privacy Policy;

• the Terms and Conditions;

• the Cookie Policy;

• the Refund and Cancellation Policy;

• the Payment Terms;

• general marketing and product information published on our website.

6. Records Available Under Other Legislation

6.1 Certain records concerning StazaCare may also be accessible under legislation other than PAIA, including:

• the Companies Act 71 of 2008 (certain company records held by the Companies and Intellectual Property Commission);

• the Protection of Personal Information Act 4 of 2013 (a data subject's right to request access to, or correction or deletion of, their own personal information, as described in our Privacy Policy);

• the Tax Administration Act 28 of 2011 and related tax legislation (in relation to records held by the South African Revenue Service).

7. Categories of Records Held by StazaCare

7.1 The table below describes the general categories of records held by StazaCare. Not all records in a category will necessarily be available, as access remains subject to the grounds for refusal in Chapter 4 of PAIA (for example, records protected by legal privilege, third-party commercial confidentiality, or the privacy of another person).

Category	Examples of Records
Corporate and statutory records	Certificate of incorporation, memorandum of incorporation, company registration documents, shareholder and director records, statutory registers
Financial and billing records	Financial statements, tax records, invoices, subscription billing records, PayFast transaction records (StazaCare does not hold card or bank account numbers directly)
Practice (client) records	Practice registration and account information, subscription and Plan details, correspondence with Practices, support tickets
Patient Personal Information	Patient records, clinical notes, dental charts, prescriptions, sick notes, appointment and billing records processed on the Platform on behalf of a Practice. See Clause 7.3 below regarding how requests for this category are handled.
Employee and human resource records	Employment contracts, payroll records, leave and performance records, recruitment records (where StazaCare has employees)
IT, security, and audit records	System audit logs, security incident records, access logs, technical documentation
Marketing records	Campaign templates, marketing consent records, website analytics (where applicable)
Legal and contractual records	Terms and Conditions, Operator Agreements, service provider and sub-operator contracts, insurance records

7.2 Where a request relates to a natural person's own personal information (for example, a Practice's registered Owner requesting their own account information, or an employee requesting their own HR file), the request may in most cases be more appropriately and efficiently dealt with under section 23 of POPIA (the data subject access right described in our Privacy Policy) rather than under PAIA. StazaCare will direct requesters to the most appropriate process.

7.3 Patient Personal Information: because StazaCare acts as an Operator (not the Responsible Party) in respect of a Practice's Patient records, a request from a Patient (or their authorised representative) for access to their own clinical or personal records should, in the first instance, be directed to the Practice that treated them, as the Practice is legally responsible for that information and for responding to such requests. Where a PAIA or POPIA request concerning Patient Personal Information is nonetheless submitted to StazaCare, we will notify the relevant Practice promptly and provide reasonable assistance to the Practice in responding, in accordance with our Operator Agreement with that Practice, but we will not ordinarily grant access to Patient Personal Information directly without the Practice's involvement.

8. How to Request Access to a Record

8.1 A request for access to a record must be made using the prescribed Form 2 (Request for Access to Record) under the PAIA Regulations, which can be obtained from the Information Regulator's website or requested from StazaCare using the contact details in Clause 2.

8.2 The completed form must be submitted to the Information Officer using the contact details in Clause 2, and must provide sufficient detail to enable the record to be located, as well as proof of the requester's identity.

8.3 Where the request is made on behalf of another person, the requester must submit proof of authority to act on that person's behalf.

8.4 If a private body's records are required to exercise or protect a right, the requester must state, in the request, the right that is sought to be exercised or protected, and why the requested record is required for that purpose.

8.5 StazaCare will respond to a request within 30 days of receipt, as required by section 56 of PAIA, and may extend this period once, by up to a further 30 days, in the circumstances permitted by section 57 of PAIA, with notice to the requester.

9. Fees

9.1 A request fee and, where access is granted, an access fee for reproduction and/or search and preparation time, may be payable, calculated in accordance with the fee schedule prescribed under the PAIA Regulations. As these prescribed fees are set and periodically adjusted by the Minister of Justice and Correctional Services, the current fee schedule should be obtained from the Information Regulator's website (www.inforegulator.org.za) or requested from StazaCare using the contact details in Clause 2, rather than relied upon as stated in this Manual.

9.2 Where the estimated access fee would exceed the prescribed threshold, StazaCare may require a deposit before further processing the request, as contemplated in section 54(2) of PAIA.

9.3 No fee is payable for a request for access to a requester's own personal information under POPIA (as opposed to a PAIA request).

10. Grounds for Refusal

10.1 PAIA sets out limited grounds on which StazaCare may, or in some cases must, refuse a request for access to a record, including where the record contains:

• personal information about a third party, where disclosure would constitute an unreasonable invasion of that person's privacy (including, in particular, Patient Personal Information, as described in Clause 7.3);

• commercial information of StazaCare or a third party, the disclosure of which could reasonably be expected to cause financial or commercial harm;

• information subject to legal professional privilege;

• information that could reasonably be expected to jeopardise the safety of a person or the security of property or systems (including IT security records);

• information that would be protected from disclosure in legal proceedings.

10.2 Where a ground for refusal applies only to part of a record, StazaCare will, where reasonably possible, sever that part and grant access to the remainder, as required by section 28 of PAIA.

11. Internal Appeal and External Remedies

11.1 An internal appeal process is not compulsory for private bodies under PAIA, and StazaCare does not operate a separate internal appeal structure. A decision by the Information Officer to refuse a request, in whole or in part, is treated as final within StazaCare.

11.2 A requester who is dissatisfied with a decision may lodge a complaint with the Information Regulator, or apply to a court of competent jurisdiction for appropriate relief, within the time periods prescribed by PAIA.

Information Regulator address	JD House, 27 Stiemens Street, Braamfontein, Johannesburg, 2001
Information Regulator email	inforeg@justice.gov.za / PAIAComplaints@inforegulator.org.za
Information Regulator website	www.inforegulator.org.za

12. Availability of This Manual

12.1 This Manual is available on StazaCare's website and may be requested, free of charge, from the Information Officer using the contact details in Clause 2. This Manual will be reviewed and updated at least annually, and whenever there is a material change to the records StazaCare holds or the Information Officer's details.

13. Related POPIA Rights

13.1 Separately from a PAIA request for access to a record, a data subject (including a Practice, a User, or, through their Practice, a Patient) has rights under Chapter 3 of POPIA to request access to, correction of, or deletion of their own personal information, as described in StazaCare's Privacy Policy. Such a request should be directed to the Information Officer using the contact details in Clause 2, and, where it concerns Patient Personal Information, will typically be referred to the relevant Practice in accordance with Clause 7.3 above.