Privacy policy

This policy explains what personal information MoveFree Therapy collects about you, why we need it, who else sees it and what you can do about it. It is written to meet the Protection of Personal Information Act 4 of 2013 (POPIA).

MOVE FREE (registration number K2026288063), trading as MoveFree Therapy, is the responsible party for the personal information described here, as that term is used in POPIA.

Corinne Landman is our Information Officer. Any question, request or complaint about your information should go to corinne@movefree.club and it reaches her directly.

Identity and contact details:

• your name, email address, phone number and date of birth
• your account login, and your notification preferences

Health information, which POPIA treats as a special category:

• your intake questionnaire answers — medical history, medication, injuries, and what brought you in
• clinical notes your practitioner records at each session, including assessment findings and treatment given
• exercise programmes prescribed to you, and the sessions you log against them

Appointment and financial records:

• your appointments, cancellations and attendance history
• invoices, payments and any pre-paid packages you hold

Technical information:

• cookies that keep you signed in and remember your display preferences (listed below)
• a device registration if — and only if — you switch on push notifications

We do not run advertising or analytics trackers on this site. There is no Google Analytics, no advertising pixel, and no third-party profiling of your visit.

• To treat you. Health information is what your practitioner plans and delivers treatment from — it is the core of the record.
• To run your appointments. Booking, confirming, reminding, rescheduling and cancelling.
• To bill you. Invoices, receipts, packages and payments.
• To keep the records we are required to keep as a healthcare practice.
• To keep the platform secure — an audit trail of administrative actions on your record.

We process this information because it is necessary to provide the treatment you have asked us for, because the law requires us to keep certain records, and — for health information specifically — because it is processed by or under the responsibility of a health professional bound by a duty of confidentiality, which is the basis POPIA provides for exactly this situation.

We do not sell your information, we do not share it for advertising, and we do not use it to make automated decisions about you.

Inside the practice, your clinical record is visible to the practitioner treating you and to the practice administrator. It is not visible to other clients, and it is not visible to practitioners at partner practices you have not been treated at.

Outside the practice, we rely on a small number of service providers who process information on our behalf, under contract and only on our instructions:

• Supabase — hosts the database and manages logins. This is where your records are stored.
• Vercel — hosts the website and the booking platform itself.
• Resend — delivers our email — confirmations, reminders and invoices.
• Africa's Talking — delivers our SMS messages.
• PayFast — processes online package payments. Your card details go to them directly and are never seen or stored by us.
• Google Calendar — receives your appointment time and name, but only where your practitioner has connected their own work calendar. No clinical information is ever sent to it.
• Google Maps — renders the map on our directions page. It loads in your browser, so Google sees that request.

We will also disclose information where the law requires it — a court order, or a report we are legally obliged to make — and we would tell you unless we were prohibited from doing so.

Some of the providers above host or process data outside South Africa. POPIA permits this where the receiving country or the contract provides comparable protection, and our agreements with these providers are on that basis.

If you would like to know where a particular category of your information is held, ask and we will tell you.

• Clinical records — 6 years from the last entry, in line with professional guidance for health records. Where the client was a minor, until they turn 21, and then for the same period.
• Invoices and payment records — 5 years, as tax law requires.
• Account details, contact details and notification preferences — until you ask us to close your account.
• Guest booking links — these expire on their own after the appointment has passed.

When you ask us to close your account, your login, contact details and preferences are removed. Clinical records are the exception: we are required to retain them for the periods above, so they are kept and access-restricted rather than deleted. We will tell you exactly what is being kept and until when.

Under POPIA you may:

• ask what we hold about you, and ask for a copy of it
• ask us to correct anything that is wrong or incomplete
• ask us to delete information we no longer have a reason to keep
• object to a particular use of your information
• withdraw consent to a channel of communication at any time
• complain to us, and to the Information Regulator, if you think we have handled your information badly

We handle these requests by hand rather than through a self-service button, so that we can confirm it really is you asking. There is no charge, and we aim to answer within 30 days.

You can also complain directly to the Information Regulator (South Africa), which supervises POPIA. You do not need to come to us first, though we would rather you did.

All of them are necessary for the platform to work or to remember a preference you set. None of them track you across other websites.

• Session cookies — keep you signed in and secure your session. Without these you cannot log in.
• A role hint cookie — sends you to the right dashboard on launch without an extra lookup.
• Theme, calendar-view, exercise-view and sidebar cookies — remember how you like the interface, nothing more.

If you use the app on your phone as an installed app, a saved workout in progress is stored on the device itself and never leaves it until you save the session.

• Access rules are enforced in the database itself, not only in the application, so one record cannot read another's.
• Everything travels over an encrypted connection, and calendar access tokens are encrypted where they are stored.
• Access to clinical records is limited to the practitioner treating you and the practice administrator, and administrative actions on your record are logged.

No system is perfectly secure. If a breach ever affected your information, POPIA requires us to notify you and the Information Regulator, and we would.

We treat children, and we hold records about them. Where the client is under 18, their information is provided and managed by a parent or guardian, who books on their behalf and gives consent for treatment.

A child's records are kept for longer than an adult's — see how long we keep it, above.

If we change how we handle your information — a new service provider, a new kind of information collected — we update this page, and the date at the top changes with it. Where a change matters to you, we will tell you rather than relying on you noticing.

Any question about this policy, any request about your information, or any complaint:

This policy is written in plain language for a small practice. It is not legal advice, and it has not been settled by an attorney.