Privacy Policy

This policy is issued by Yolandé van der Riet, trading as Measure Pleasure, a registered dietitian (HPCSA) and qualified personal fitness trainer (REPSSA) based at Virgin Active Foreshore, Cape Town, South Africa.

Under the Protection of Personal Information Act, 2013 (POPIA), I am the "responsible party" for any personal information you share with me when you enquire about my services, book a consultation, become a client, or contact me by email.

Information Officer: Yolandé van der Riet. You can reach me using the details on the Contact page of this website.

These terms come up throughout this policy. They're defined in POPIA and I've summarised them here.

• Personal information — any information that identifies you or could be used to identify you (name, contact details, ID number, and so on).
• Special personal information — a protected category under POPIA that includes information about your health. Because I'm a dietitian and personal trainer, most of what I collect falls into this category.
• Data subject — the person the information is about. In this policy, that's you.
• Responsible party — the person or entity that decides why and how personal information is processed. In this case, that's me.
• Operator — a third party that processes personal information on my behalf under a contract (for example, my email provider or booking system).
• Processing — anything done with personal information: collecting, storing, using, sharing, updating, or deleting it.

This website is a simple information site. When you visit these pages, I don't collect any personal information about you. There are no contact forms, no newsletter sign-ups, no visitor analytics, no advertising cookies, and no tracking of any kind.

The only interactive element on the site is the Contact button. Clicking it opens your own email application with my address filled in, so you can send me a message. When you write and send that email, it goes from your account through your email provider to mine. I only receive what you choose to include. From the moment I receive that email, any personal information you've shared — your name, your email address, your message, any attachments — becomes information I hold, and this policy tells you how I look after it from there.

If you don't contact me and don't become a client, I never collect anything about you.

When you first contact me

The email you send me typically includes your name, your email address, and whatever you've told me about why you're reaching out. That's the starting point.

When you become a client

If you book a consultation or ongoing sessions with me, I need more information to do my job properly. This usually includes:

• Your full name and contact details
• Your date of birth
• A physical address, where relevant
• Emergency contact details, where relevant
• Payment details (handled through my payment provider — I don't store card numbers)
• Medical aid details, if you plan to submit for reimbursement

Health information (special personal information)

Because I'm a registered dietitian and personal trainer, my work depends on understanding your health. I collect and use:

• Your medical history and current health conditions
• Medications, supplements and treatments you take
• Body measurements, weight, and body composition where relevant
• Dietary preferences, restrictions, allergies and intolerances
• Fitness level, injury history and physical limitations
• Lifestyle factors relevant to your care (sleep, stress, activity, alcohol, and similar)
• Your goals, session notes, and progress over time

POPIA classifies health information as special personal information and requires it to be handled with extra care. I'm allowed to process it under section 27(1)(b) of POPIA because the processing is necessary for the provision of professional healthcare services by a health professional registered with the HPCSA, and because you give me informed consent when you engage my services.

You don't have to share personal information with me. Sharing it is voluntary, and you can decide what you're comfortable providing. But because my work is clinical, some information is genuinely needed to give you safe, appropriate care.

If you choose not to share certain information, here's what that means in practice:

• Contact details: without an email address or phone number, I can't reply to enquiries, confirm appointments, or send follow-ups.
• Medical history and health information: without a full picture of your health, I may not be able to plan your care safely or ethically. In some cases I may need to decline to work with you, or refer you elsewhere.
• Payment and medical aid details: without these, I can't invoice you or process reimbursement.

Where reasonably possible, I collect information directly from you — through email, in-person conversation, online consultation, or intake and assessment forms I ask you to complete. Direct collection is my default, in line with section 12 of POPIA.

In two limited circumstances, I may collect information from other sources:

• With your explicit consent, I may receive relevant information from another health professional involved in your care (for example, a referring GP, physiotherapist, biokineticist or chiropractor).
• In a genuine medical emergency, I may receive information about you from emergency services, medical staff, or a person acting on your behalf.

• To provide dietetic consultations, individualised meal plans, and personal training services
• To assess your health, plan your care, and track your progress over time
• To schedule, confirm and follow up on appointments
• To communicate with you about your care
• To process payments and issue invoices
• To meet my professional, legal and regulatory obligations
• To respond to enquiries you send me
• With your specific opt-in consent only, to send you newsletters, wellness content, or occasional updates

I will not use your information for a purpose that's materially different from these without asking you first.

Some of the information I collect and keep is required by law or by the bodies that regulate my professions:

• HPCSA guidelines require me to keep patient records of consultations, assessments, treatments and communications for a minimum period after our last engagement.
• The Income Tax Act and SARS require me to keep financial and tax-related records for at least five years.
• The Medical Schemes Act and BHF require me to keep records of transactions submitted to medical aids for the required audit period.

POPIA requires a lawful basis for every act of processing. I rely on one or more of the following, depending on the situation:

• Your consent, which you can withdraw at any time
• The performance of a contract for services with you
• Compliance with a legal or professional obligation (HPCSA, SARS, and similar)
• The protection of your legitimate interests, including your vital interests in a medical emergency
• My legitimate interests as a healthcare practitioner, where these aren't overridden by your rights

Your health information is treated with additional safeguards:

• It's only accessed by me, and by any person directly involved in your care (with your consent)
• It's stored on password-protected devices and in access-controlled cloud services
• It's never shared for marketing, research, or commercial purposes
• It's only shared with other health professionals with your written consent, or where required by law, or in a genuine emergency where sharing is necessary to protect you
• It's retained in line with HPCSA record-keeping requirements

I do not sell your personal information. I share it only in the situations below, and only to the extent needed.

Operators (trusted service providers)

I use a small number of third-party tools to run my practice. Each is contractually bound (in line with sections 20 and 21 of POPIA) to process your information only for the purposes I set, to keep it confidential, and to apply appropriate security safeguards. These include the providers of:

• My email and communications system
• My scheduling and booking system
• My payment processor
• My secure cloud storage for client records
• Any online consultation platform we use for a session

Other health professionals

With your explicit consent, I may share relevant information with another health professional involved in your care — for example, your GP, physiotherapist, biokineticist, or chiropractor — where doing so supports your treatment.

Regulators and legal requirements

I may disclose information where required by law, a court order, or a regulatory body (the HPCSA, SARS, or the Information Regulator, for example). Where the law permits, I will let you know before doing so.

Some of the tools I rely on — email, cloud storage, video consultation platforms — may store or process data on servers outside South Africa. Where this happens, I make sure, in line with section 72 of POPIA, that either:

• The country of the recipient has laws providing an adequate level of protection for personal information; or
• The service provider is contractually bound to standards substantially similar to POPIA (for example, through EU Standard Contractual Clauses or the provider's own data processing agreement); or
• The transfer is necessary to perform a contract with you, or you have given consent to the transfer.

I take reasonable and appropriate technical and organisational steps to protect your information from loss, unauthorised access, modification or disclosure, in line with section 19 of POPIA. These include:

• Password-protected and encrypted devices
• Access-controlled cloud services with multi-factor authentication where available
• Secure storage of any physical records
• Restricted access on a need-to-know basis
• Regular review of my security practices

No system is ever completely secure. If I become aware of a security compromise that has affected or is likely to affect your personal information, I will notify you and the Information Regulator as soon as reasonably possible, in line with section 22 of POPIA.

I only keep your information for as long as I need it for the purposes it was collected, or as long as I'm legally required to.

• Client health records: a minimum of six years from the date of your last consultation, in line with HPCSA record-keeping guidelines. Records of minor clients are kept until the client reaches the age of 21, or for six years from the last consultation, whichever is longer.
• Financial and tax records: at least five years from the end of the applicable tax year, as required by SARS.
• Enquiries and general correspondence: up to two years from our last contact, unless we have an ongoing relationship.
• Marketing and newsletter subscriptions: until you unsubscribe or ask me to delete your information.

After these periods, I securely delete, destroy, or anonymise your information.

POPIA gives you a set of rights over your personal information. You have the right to:

• Ask whether I hold personal information about you, and to request a copy of what I hold
• Ask me to correct information that's inaccurate, misleading, or out of date
• Ask me to delete or destroy your information, subject to my legal and professional retention obligations
• Object to the processing of your information on reasonable grounds
• Withdraw consent to processing at any time, where consent is the legal basis (this doesn't affect processing already carried out)
• Object to direct marketing at any time, without giving reasons
• Submit a complaint to the Information Regulator (see section 20)

How to exercise your rights

To make a request, contact me using the details on the Contact page. For formal access requests, POPIA and PAIA prescribe two forms:

• POPIA Form 2 — to request access to, or correction or deletion of, your personal information.
• POPIA Form 1 — to object to the processing of your personal information.

I'm happy to help you complete either form, or to accept a plain-language request by email. I may need to verify your identity before I can act on a request. I will respond as soon as reasonably possible, and in any event within 30 days.

Where I process your information based on your consent, you can withdraw that consent at any time by emailing me using the details on the Contact page. Withdrawing consent won't affect processing I've already done in good faith, and it won't affect processing that's based on another legal ground (for example, records I'm required by law to keep).

I only send direct marketing (newsletters, wellness content, event invitations) if you've specifically opted in — for example, by subscribing to a newsletter. Every marketing email includes a clear unsubscribe link. You can also opt out at any time by emailing me.

I don't knowingly collect personal information about a child under 18 without the verifiable consent of a parent or legal guardian. When I work with a minor as a client, this happens through the parent or guardian, who gives consent on the child's behalf and shares the information needed for their care.

I don't make decisions about you based solely on automated processing. Every clinical and care-related decision involves my professional judgement.

This website may include links to other websites — for example, my HPCSA or professional body listings. This policy only covers information I collect. Once you follow a link to another website, that website's own privacy policy applies. I'm not responsible for how those sites handle your information.

I may update this policy from time to time — for example, if I change how I work, adopt a new tool, or if the law changes. The "effective from" date at the top of the policy will always show when it was last updated. If I make material changes, I'll let existing clients know before they take effect.

If you have a concern about how I handle your personal information, please email me first so I can try to resolve it. Your feedback is genuinely welcome — it's often the fastest way to sort things out.

You also have the right to lodge a complaint directly with the Information Regulator of South Africa:

In line with the Promotion of Access to Information Act, 2000 (PAIA), I maintain a PAIA Manual that sets out the records I hold and how you can request access to them. A copy is available on request — email me using the details on the Contact page.

This policy is governed by, and interpreted in accordance with, the laws of the Republic of South Africa.

For any question about this policy, or to exercise any of your rights under POPIA:

Yolandé van der Riet, trading as Measure Pleasure
Virgin Active Foreshore, Cape Town, South Africa

Please use the Contact page of this website for my current email and phone number.