PAIA Manual

1. DEFINITIONS AND ABBREVIATIONS

1.1 In this manual, unless the context indicates otherwise:

1.1.1 "Head of the private body" means the person referred to in section 1 of PAIA who is responsible for StrokePath's compliance with PAIA;

1.1.2 "Information Officer" or "IO" means the person who deals with requests made to StrokePath under PAIA and who is the Information Officer for purposes of section 55 of POPIA;

1.1.3 "personal information" has the meaning given to it in POPIA;

1.1.4 "PAIA" means the Promotion of Access to Information Act 2 of 2000, as amended, and its Regulations;

1.1.5 "POPIA" means the Protection of Personal Information Act 4 of 2013, as amended, and its Regulations;

1.1.6 "Regulations" means the Regulations Relating to the Promotion of Access to Information, 2021;

1.1.7 "Regulator" means the Information Regulator (South Africa), established under section 39 of POPIA;

1.1.8 "requester" means any person making a request for access to a record of StrokePath; and

1.1.9 "StrokePath", "we", "us" or "our" means StrokePath Proprietary Limited, registration number 2026/623728/07.

2. INTRODUCTION AND BACKGROUND

2.1 PAIA gives effect to the constitutional right of access to information held by the State and to information held by another person that is required for the exercise or protection of any right, subject to justifiable limitations.

2.2 Section 51 of PAIA requires every private body to compile a manual setting out the procedure to request access to records held by it, and certain information about the processing of personal information.

2.3 StrokePath operates an online, subscription-based, self-guided information platform that makes available exercises, educational content, tools, guidance and recommendations to support persons who have experienced a stroke and those who care for them.

2.4 Where a request is made in accordance with PAIA, StrokePath is obliged to release the record requested, subject to the grounds for refusal set out in PAIA and any other applicable law.

3. PURPOSE OF THIS MANUAL

3.1 This manual is intended to help members of the public to:

3.1.1 understand the categories of records that StrokePath makes available without a person having to submit a formal request;

3.1.2 identify the subjects on which StrokePath holds records and the categories of records held under each subject, so as to facilitate a request for access;

3.1.3 understand the records StrokePath holds in accordance with other legislation;

3.1.4 obtain the contact details of the Information Officer and any Deputy Information Officer who will assist with requests;

3.1.5 understand how to use PAIA and how to obtain the Guide issued by the Regulator; and

3.1.6 understand how StrokePath processes personal information, and how you may exercise your rights in respect of that information.

4. CONTACT DETAILS (section 51(1)(a) and (b))

4.1 Head of the private body / responsible party:

4.1.1 StrokePath (Pty) Ltd (StrokePath Proprietary Limited), registration number 2026/623728/07

4.1.2 Information Officer: Denisha Vassan

4.1.3 Principal place of business and postal address: 5 North Street, Illovo, Sandton, 2196

4.1.4 Email (PAIA and POPIA requests): compliance@mystrokepath.com

4.1.5 Website: www.mystrokepath.com

4.2 All requests for access to records, and all requests or enquiries relating to personal information, must be directed to the Information Officer using the details above.

5. THE GUIDE ON HOW TO USE PAIA

5.1 The Regulator has, in terms of section 10 of PAIA, published a Guide containing information reasonably required by a person who wishes to exercise a right under PAIA and POPIA.

5.2 The Guide is available in each of the official languages and in Braille. It contains, among other things, a description of the objects of PAIA and POPIA; the manner and form of a request for access; the assistance available from the Information Officer and the Regulator; the remedies available in law regarding an act or failure to act; and the provisions requiring bodies to compile a manual and how to obtain access to it.

5.3 The Guide may be obtained from the Regulator. The Regulator's contact details are set out in clause 18 of this manual. The Guide is also available on the Regulator's website at www.inforegulator.org.za.

6. POLICY WITH REGARD TO CONFIDENTIALITY OF INFORMATION

6.1 StrokePath will protect the confidentiality, integrity and availability of the information to be processed for the purposes of PAIA, and of any and all information belonging to third parties that is in StrokePath's possession or under its control, in accordance with the provisions of POPIA.

6.2 Prior to divulging any such third party information, StrokePath will, in terms of PAIA, provide the third party the opportunity to (i) consent to the access (in whole or subject to redaction of sensitive information) or (ii) deny access to the information in terms of any applicable law.

7. RECORDS AVAILABLE WITHOUT A REQUEST (SECTION 52)

7.1 At this stage, no notices have been published by the Information Regulator on the categories of records automatically available without a person having to request access thereto in terms of PAIA. The following categories of records are available without a person having to submit a formal PAIA request, and may be obtained from our website or on request to the Information Officer:

7.1.1 documentation and information relating to StrokePath which is held by the Companies and Intellectual Properties Commission in accordance with the requirements set out in section 25 of the Companies Act 71 of 2008;

7.1.2 the StrokePath Terms and Conditions of Use;

7.1.3 the StrokePath Privacy Policy;

7.1.4 this PAIA manual;

7.1.5 all StrokePath social media platforms;

7.1.6 information about our subscription plans, the education hub and our services published on the Platform; and

7.1.7 marketing and general information published by us on the Platform or other public channels.

7.2 The availability of a record under this clause does not create any entitlement to any other record, and StrokePath has not, at the date of this manual, published a notice under section 52(2) of PAIA describing categories of records automatically available.

8. RECORDS HELD IN TERMS OF OTHER LEGISLATION

8.1 StrokePath holds and maintains records in accordance with, among others, the following legislation (as amended from time to time). This list is not exhaustive and the mention of a statute does not mean StrokePath holds records under it, or that such records are available for access under PAIA:

8.1.1 Basic Conditions of Employment Act 75 of 1997;

8.1.2 Broad-Based Black Economic Empowerment Act 53 of 2003;

8.1.3 Companies Act 71 of 2008;

8.1.4 Compensation for Occupational Injuries and Diseases Act 130 of 1993;

8.1.5 Constitution of South Africa Act 108 of 1996;

8.1.6 Copyright Act 98 of 1987;

8.1.7 Consumer Protection Act 68 of 2008;

8.1.8 Criminal Procedure Act 51 of 1977;

8.1.9 Deeds Registries Act 57 of 1937;

8.1.10 Debt Collectors Act 114 of 1998;

8.1.11 Electronic Communications and Transactions Act 25 of 2002;

8.1.12 Employment Equity Act 55 of 1998;

8.1.13 Finance Act 2 of 2007;

8.1.14 Income Tax Act 58 of 1962;

8.1.15 Insolvency Act 24 of 1936;

8.1.16 Labour Relations Act 66 of 1995;

8.1.17 Long Term Insurance Act 52 of 1998;

8.1.18 Magistrates Court Act 32 of 1944;

8.1.19 Mine Health and Safety Act 29 of 1996;

8.1.20 Mineral Petroleum Resources Development Act 28 of 2002;

8.1.21 Occupational Diseases in Mines and Works Act 78 of 1973;

8.1.22 Occupational Health and Safety Act 85 of 1993;

8.1.23 Prevention of Organised Crime Act 14 of 1998;

8.1.24 Regulation of Interception of Communications and Provision of Communication Related Information Act 70 of 2002;

8.1.25 Skills Development Act 97 of 1998;

8.1.26 Skills Development Levies Act 97 of 1999;

8.1.27 South African Revenue Service Act 34 of 1997;

8.1.28 Unemployment Insurance Act 63 of 2001; and

8.1.29 Value Added Tax Act 89 of 1991.

8.2 Although we have used our reasonable endeavours to supply you with a list of applicable legislation it is possible that the above list may be incomplete. Wherever it comes to our attention that existing or new legislation allows a requester access on a basis other than that set out in PAIA, we shall update the list accordingly.

9. SUBJECTS AND CATEGORIES OF RECORDS HELD BY STROKEPATH

9.1 StrokePath holds records under the following subject categories. Access to any such record is subject to the grounds for refusal in clause 13 and to any other applicable law.

9.1.1 Corporate and governance records: applicable statutory documents, constitutional documents, statutory registers, resolutions and company-secretarial records, Board of Directors identity and contact information, Legal Compliance Records as applicable, Minutes of Shareholders' Meetings, Share Certificates, Shareholder Agreements, Share Registers, Statutory Returns to Relevant Authorities

9.1.2 Financial, tax and accounting records: financial statements, management accounts, invoices, banking and payment records, returns and supporting records;

9.1.3 Employee and human-resources records: records relating to our personnel and contractors, Employment Contracts, Labour Relations Records, Personnel Information, UIF Returns

9.1.4 Subscriber and user records: account, profile, subscription, sponsored-pass, payment and support records, and health-related information entered by or on behalf of Subscribers;

9.1.5 Supplier and service-provider records: agreements and records relating to our Payment Provider, hosting, IT, analytics and other service providers;

9.1.6 Content and intellectual-property records: the exercises, educational content, tools and related materials and the rights in them;

9.1.7 Marketing records: marketing materials, consents and preferences;

9.1.8 IT, technical and security records: system, log, security and data-protection records; and

9.1.9 Legal and compliance records: general legal correspondence, records relating to our POPIA, PAIA and other legal and regulatory obligations, insurance and correspondence.

9.2 StrokePath has taken reasonable measures to ensure that the records in its possession are complete, accurate, not misleading and are updated where necessary. We have taken reasonable measures to ensure the maintenance and security of the records in its possession.

9.3 We retain the records in its possession for the duration necessary in order to enable and promote the objectives of PAIA and in accordance with the provisions, if any, relating to the retention of records as required or authorised by law.

10. PROCESSING OF PERSONAL INFORMATION (POPIA)

10.1 StrokePath processes personal information as a responsible party under POPIA. A full description of how we collect, use, share, secure and retain personal information and of your rights, is set out in our Privacy Policy, which forms part of this manual by reference.

10.2 In summary: the categories of data subjects whose information we process include Subscribers, caregivers, persons in a Subscriber's care, website users, employees, contractors and suppliers; the categories of personal information include identity, contact, account, health (special personal information), payment, transaction, usage and communications information; the purposes of processing are those set out in our Privacy Policy; the recipients may include our Payment Provider, hosting and service providers, professional advisers and authorities; and personal information may be transferred outside South Africa only where a condition in section 72 of POPIA is met.

10.3 We apply appropriate, reasonable technical and organisational security measures, and enhanced measures for special personal information such as health information, as described in the Privacy Policy.

11. HOW TO REQUEST ACCESS TO A RECORD

11.1 A request for access to a record must be made on Form 2 (Request for Access to Record) prescribed under Regulation 7 of the Regulations, or on a form that corresponds substantially with it. The form is available from the Information Officer and on the Regulator's website.

11.2 The completed form must be submitted to the Information Officer at the email in clause 4. The requester must:

11.2.1 provide sufficient particulars to enable the Information Officer to identify the record and the requester;

11.2.2 identify the right the requester seeks to exercise or protect, and explain why the requested record is required for that purpose;

11.2.3 state the form of access required and how the requester wishes to be informed of the decision; and

11.2.4 if making the request on behalf of another person, state the capacity in which the request is made, to the Information Officer's satisfaction.

11.2.5 The Information Officer will decide on the request within 30 (thirty) days of receipt, and will notify the requester of the decision and of any fees payable, using Form 3 (Outcome of Request and of Fees Payable). This period may be extended by a further period not exceeding 30 (thirty) days in the circumstances permitted by PAIA.

11.3 Access to a record is not automatic. A request may be granted, refused, or granted in an altered or partial form, in accordance with PAIA.

12. FEES

12.1 Two types of fee may be payable under PAIA: a request fee (a standard fee payable by every requester before the request is processed) and an access fee (calculated on the basis of the prescribed rates for reproduction, search and preparation).

12.2 The fees payable are those prescribed in the Regulations from time to time. As at the date of this manual these include:

12.2.1 a request fee of R140.00;

12.2.2 R2.00 for every photocopy or printed A4 page (or part thereof);

12.2.3 R40.00 for a copy on a flash drive or compact disc supplied by the requester, and R60.00 for a compact disc supplied by StrokePath;

12.2.4 for a transcription of visual images or audio, the fee quoted by the service provider engaged to do so; and

12.2.5 access fees for the time reasonably required to search for and prepare the record for disclosure, at the prescribed rate, subject to the caps prescribed in the Regulations.

12.3 A deposit may be required where the Information Officer is of the opinion that the preparation of the record will take more than the prescribed number of hours. Access to a record will be withheld until all applicable fees have been paid. StrokePath may add VAT to the prescribed fees where it is a registered VAT vendor.

13. GROUNDS ON WHICH ACCESS MAY OR MUST BE REFUSED

13.1 StrokePath may or must refuse access to a record on the grounds set out in Chapter 4 of Part 3 of PAIA, which include:

13.1.1 the mandatory protection of the privacy of a third party who is a natural person (section 63);

13.1.2 the mandatory protection of the commercial information of a third party (section 64);

13.1.3 the mandatory protection of certain confidential information of a third party, disclosure of which would breach a duty of confidence (section 65);

13.1.4 the protection of the safety of individuals and the protection of property (section 66);

13.1.5 the protection of records privileged from production in legal proceedings (section 67);

13.1.6 the protection of the commercial information of StrokePath, including trade secrets and confidential information (section 68); and

13.1.7 the mandatory protection of research information of a third party or of StrokePath (section 69).

13.2 Access may nevertheless be granted where the disclosure of the record would reveal evidence of a substantial contravention of the law or an imminent and serious public-safety or environmental risk, and the public interest in disclosure clearly outweighs the harm contemplated (the public-interest override in section 70).

14. REMEDIES AVAILABLE

14.1 There is no internal appeal against a decision of the Head of a private body. A requester who is dissatisfied with a decision of StrokePath (or its failure to decide) may:

14.1.1 lodge a complaint with the Regulator, on the prescribed complaint form, within 180 (one hundred and eighty) days of the decision or of becoming aware of the matter; or

14.1.2 apply to a court with jurisdiction for appropriate relief in terms of PAIA.

14.2 The Regulator's contact details are set out in clause 18.

15. REQUESTS RELATING TO YOUR OWN PERSONAL INFORMATION

15.1 If you wish to access, correct, delete or object to the processing of your own personal information, you may exercise the rights described in our Privacy Policy by contacting the Information Officer. Where you request access to a record containing your personal information, the procedure and fees in clauses 11 and 12 apply.

16. AVAILABILITY OF THIS MANUAL

16.1 This manual is available: on our website at www.mystrokepath.com; on request to the Information Officer (who may charge the prescribed fee for a copy); at the office of the Regulator. It is available in English.

17. UPDATING OF THIS MANUAL

17.1 We will review and update this manual as and when necessary to reflect changes to our records, operations or the law. The current version is the version published on our website.

18. CONTACT DETAILS OF THE INFORMATION REGULATOR

18.1 The Information Regulator (South Africa)

18.1.1 Website: www.inforegulator.org.za

18.1.2 Physical address: Woodmead North Office Park, 54 Maxwell Drive, Woodmead, Johannesburg, 2191

18.1.3 Postal address: P.O. Box 31533, Braamfontein, Johannesburg, 2017

18.1.4 Telephone: 010 023 5200 or Toll free: 0800 017 160

18.1.5 General enquiries: enquiries@inforegulator.org.za

18.1.6 PAIA / POPIA complaints: complaints.IR@justice.gov.za