PAIA Manual

ML Meiring t/a Medifile is a sole proprietor that develops and operates the Medifile platform — a cloud-hosted, POPIA-compliant medical records management and practice management system for South African medical practices. Medifile provides secure digital storage of patient health records, OCR processing, specialist referral tools, and physical document scanning services. Medifile is not a medical practice and does not provide healthcare services.

Medifile is operated by a sole proprietor. There are no subsidiary companies, associated entities, or branches. Physical scanning services are conducted in Gauteng.

Any person (a “requester”) may request access to records held by Medifile in terms of PAIA:

• A data subject (or their authorised representative) requesting access to their own personal information held by Medifile
• A patient (or their legal representative) requesting access to their own health records that a Practice has stored on the Medifile platform
• Any person requesting access to records held by Medifile in its capacity as a private body

A request must be made using the prescribed Form C (available from the Information Regulator at justice.gov.za/inforeg) or in writing containing all the information required by Form C. It may be submitted:

• By email to: hello@medifile.co.za with subject line “PAIA Records Request”
• Via the online form at: medifile.co.za/records-request
• By post to: PO Box 100003, Moreleta Plaza, 0167, Pretoria

1. Full name and contact details of the requester
2. If acting on behalf of another person: proof of authorisation (power of attorney, guardian documentation, etc.)
3. A description of the record(s) requested, with sufficient detail to identify the record
4. The form in which access is requested (copy, inspection, transcription, etc.)
5. The right the requester is seeking to exercise or protect, and why access is necessary
6. If applicable: proof of identity (copy of ID or passport)
7. Payment of the prescribed request fee (see Part D)

• The record contains personal information of a third party who has not consented to disclosure and no other PAIA ground applies (sections 63–64)
• Disclosure would constitute an unreasonable invasion of a third party's privacy (section 63)
• The record is subject to legal privilege (section 67)
• Disclosure would endanger the life or physical safety of any person (section 66)
• The record is commercially confidential and disclosure would cause harm (section 68)
• Disclosure would prejudice the protection of the rights of a child (section 63(2)(a))
• The record does not exist or cannot be found after all reasonable steps have been taken

Where a request is refused, Medifile will provide written reasons and inform the requester of their right to appeal.

Internal review: Within 30 days of refusal, submit a written request for internal review to the Information Officer at hello@medifile.co.za. Medifile will respond within 30 days.

Complaint to the Information Regulator: PAIAComplaints@inforegulator.org.za · JD House, 27 Stiemens Street, Braamfontein, 2001 · justice.gov.za/inforeg.

Court application: After exhausting the above remedies, the requester may apply to the High Court for relief under section 82 of PAIA.

A non-refundable request fee is payable before Medifile is required to process a request. The prescribed fees are set by regulation under PAIA.

If access is granted, an access fee may be charged to cover reasonable reproduction costs, depending on the form of access requested. Medifile will provide a fee estimate before incurring reproduction costs.

No fee is charged for a request by a data subject for access to their own personal information held by Medifile in its capacity as a private body (as opposed to Patient Data held on behalf of a Practice). Medifile may waive fees in other circumstances at its discretion.

Medifile holds the following categories of records in its own capacity as a private body (not patient records held on behalf of practices):

• Corporate & operational: business documentation, contracts with customers/suppliers/sub-processors, financial records, invoices, employee/contractor records, insurance documents
• Customer & practice: practice registration and account information, subscription and billing records, support communications, aggregated non-patient audit logs
• Website & marketing: contact form submissions, aggregated/anonymised analytics, marketing communications records
• Compliance & legal: POPIA documentation, PAIA requests and responses, security incident records, regulatory correspondence

Patient health records, clinical notes, referrals, files, and all other data uploaded by medical practices are held by Medifile as Operator on behalf of the Practice as Responsible Party. These are not Medifile's own records for PAIA purposes and should be requested from the relevant Practice in the first instance.

Where a Practice has ceased to operate, or a patient cannot locate their treating Practice, Medifile will cooperate with legitimate access requests on a case-by-case basis. Contact hello@medifile.co.za.

• Records of other government bodies or public entities
• Records destroyed in accordance with lawful retention and destruction procedures
• Records whose existence Medifile is legally prohibited from disclosing