PAIA manual
Last updated 11 November 2026
Prepared under section 51 of the Promotion of Access to Information Act 2 of 2000 ("PAIA"), as amended by the Protection of Personal Information Act 4 of 2013 ("POPIA"), by Neil Cuninghame Consulting (Pty) Ltd, registration number 2014/155763/07, which provides Hello by Kinilo. Compiled on 30 October 2026 and revised on 11 November 2026.
1. Purpose of this manual
This manual helps anyone who wants to obtain records held by the company. It explains what records the company holds, how to ask for them, what it costs, and how the company processes personal information. It is available at hello.kinilo.co.za/legal/paia, at the company's address, and from the Information Officer on request, free of charge.
2. Contact details
| Item | Details |
|---|---|
| Head of the private body and Information Officer | Neil Cuninghame, director, registered with the Information Regulator |
| Postal and street address | 2 Meyrickton Place, Hillcrest, 3650, KwaZulu-Natal, South Africa |
| Telephone | +27 83 638 8934 |
| hello@kinilo.co.za | |
| Website | https://hello.kinilo.co.za |
3. The Information Regulator's guide
The Information Regulator has published a guide on how to use PAIA and POPIA, in each official language. It is available on the Regulator's website and from the Regulator:
| Item | Details |
|---|---|
| Website | https://inforegulator.org.za |
| eServices portal | https://eservices.inforegulator.org.za |
| enquiries@inforegulator.org.za | |
| Telephone | 010 023 5200 |
4. Records available without a request
The terms of service, privacy policy, operator agreement, acceptable use policy, sub-operators list, data deletion page, security page and this manual, all at hello.kinilo.co.za/legal.
5. Records held in terms of other legislation
The company keeps records as required by, among others, the Companies Act 71 of 2008, the Income Tax Act 58 of 1962, the Tax Administration Act 28 of 2011, the Electronic Communications and Transactions Act 25 of 2002, POPIA, PAIA, and the Consumer Protection Act 68 of 2008 to the extent it applies.
6. Categories of records held
| Subject | Records |
|---|---|
| Company | Incorporation documents, director records, resolutions |
| Finance and tax | Accounting records, invoices, bank and Paystack records, tax returns |
| Customers (practices) | Practice account records, users and roles, modules and plans, invoices and billing history, accepted versions of the terms and operator agreement, support requests |
| Platform operation | Platform log, health records, backup and restore records, incident register, compliance documents |
| Information processed for practices | Patients' contact details, appointments, messages and related records, held as operator on behalf of each practice. These are the practice's records: requests for them must be made to the practice concerned, and the company will refer any such request to it |
| Suppliers | Agreements and correspondence with Cloudflare, Meta, Resend, Paystack and others |
7. How to request access
A request is made on Form 2 prescribed under PAIA (available from the Regulator's website or from the Information Officer), sent to the Information Officer at the email address above. The requester must give enough detail to identify the record and themselves, say in what form access is wanted, and, if asking on behalf of someone else, show the authority to do so. Where a right is being exercised or protected, the requester must say what it is.
The company decides within 30 days of receiving the request, which it may extend once by up to 30 days where PAIA allows, and tells the requester. Access may be refused only on the grounds PAIA sets out in Chapter 4 of Part 3, for example to protect the privacy of a third party, commercial information of the company or a third party, or confidential information.
8. Fees
The fees prescribed in the PAIA regulations apply: a request fee, which is not payable by anyone asking for their own personal information, and where applicable an access fee for searching, preparing and reproducing records, with a deposit where the search will take long. The current amounts are published by the Information Regulator, and the company tells the requester the amount before any work is done.
9. Processing of personal information
Purpose. The company processes personal information to provide Hello by Kinilo to healthcare practices (sending their WhatsApp messages and running their Inbox), to manage practice accounts, users and billing, to keep the platform secure, and to meet its legal obligations.
| Data subjects | Information |
|---|---|
| Patients of practices using Hello (processed as operator) | Names, mobile numbers, email addresses, dates of birth, appointment details, message content and receipts, consent and opt-out status. Treated as special personal information (health) |
| Practice owners, associates and reception staff | Names, email addresses, roles, professional registration or sealed identity numbers, two-step sign-in secrets (encrypted), sign-in records, alert preferences and mobile numbers |
| Practices (as customers) | Practice name, profession, contact and billing details |
| Suppliers and correspondents | Names, contact details, correspondence |
Recipients. Cloudflare, Inc. (hosting and storage); Meta Platforms, Inc. (WhatsApp messaging); Resend (emails, without patient information); Paystack (card payments, without patient information); Domains.co.za (the company's email mailbox, in South Africa); and, on a practice's instruction, the practice's own appointment software. The company does not sell personal information or share it for marketing.
Transborder flows. Practice databases and backups are held by Cloudflare in the European Union. Cloudflare, Meta and Resend are based in the United States, and Meta may process WhatsApp message content outside South Africa except where its local storage in South Africa applies. The company relies on section 72 of POPIA for these transfers.
Security measures. Each practice's information is held in a separate database in the European Union, encrypted at rest; credentials are additionally encrypted; backups are sealed with a key belonging to each practice and locked against early deletion; access is by one-time sign-in links with optional or compulsory two-step sign-in; the company has no standing access to practices' patient information; every page carries a strict content security policy; and security incidents are handled under a written plan, including immediate notice to affected practices under section 21 of POPIA.
10. Objection, correction and deletion
Data subjects may object to processing on Form 1, and ask for correction or deletion on Form 2, prescribed under the POPIA regulations, sent to the Information Officer. Requests about patients' information are referred to the practice concerned, which controls it, and the company helps the practice respond.
11. Availability and updates
This manual is updated whenever the information in it changes and reviewed every year. The company submits its PAIA annual report to the Information Regulator between 1 April and 30 June each year.