Dr Ashraf John Samuel Mohammed Grimwood home

How we protect your information

In plain language — because privacy you can't understand is not privacy.

Encrypted everywhere
Your record is encrypted on disk (AES-256) and on the wire (TLS). Documents live in a private vault opened only through short-lived signed links.
Least-privilege access
Access rules are enforced inside the database itself, per role: reception cannot read consultation notes, billing cannot open your chart. Staff accounts support two-factor authentication.
Every access is logged
Each time anyone opens your record, the who / what / when is written to a tamper-proof audit trail — and you can see it yourself in the patient portal.
Kept only as required
Health law requires clinical records be kept at least 6 years after your last visit (longer for children). Records are archived, never quietly deleted.
Privacy notice (POPIA)

Dr Ashraf John Samuel Mohammed Grimwood Family Practice collects your personal and health information for one purpose: to give you safe medical care and to run the administration around it (appointments, medical-aid claims, accounts).

Your record is seen only by the practice team involved in your care and billing. Every time anyone opens your record, that access is logged. Your information is encrypted, and we never sell or share it for marketing.

We share information outside the practice only where your care or the law requires it — for example with your medical scheme to process a claim, with a specialist we refer you to, or where legislation obliges us.

Your record is stored securely with our hosting provider in the United Kingdom, whose privacy law provides protection substantially similar to POPIA. It stays encrypted wherever it is, and this practice remains responsible for it at all times.

The law requires us to keep clinical records for at least 6 years after your last visit (longer for children). You may ask for a copy of your record, ask us to correct it, or complain to the Information Regulator at any time — start at reception.

Notice version 2026-07-23.1 — the same wording you sign at check-in.

Your rights (POPIA)

See your record — ask for a copy at any time (section 23), or read it directly in the patient portal.

Correct it — ask us to fix any detail that is wrong or out of date (section 24). Start at reception.

See who looked — the portal's Privacy page lists every access to your record.

Complain — if you believe your information was mishandled, you may complain to the practice's Information Officer or to the Information Regulator (South Africa): complaints.IR@inforegulator.org.za.