These Data Processing Terms (“Terms”) apply whenever Vision Intelligence Consulting (Pty) Ltd (“VIC”) processes Personal Information on behalf of a client under a Service Level Agreement, engagement letter or other written agreement (“the Agreement”) that incorporates these Terms by reference. They give effect to section 21 of the Protection of Personal Information Act 4 of 2013 (“POPIA”). Capitalised terms not defined here have the meanings given in POPIA and in the Agreement.
1. Roles
1.1 In respect of Personal Information the Client provides to VIC for the services in the Agreement, the Client is the responsible party and VIC is the operator.
1.2 In respect of the Client’s own contact and account information, which VIC holds to administer the relationship, invoice and communicate, VIC is the responsible party and VIC’s Privacy Policy applies.
1.3 The Client warrants that it has lawful authority, and where required the necessary consents, to provide Personal Information to VIC for the purpose in the Agreement.
2. Scope and Instructions
2.1 The categories of Personal Information, the purpose of processing and the retention period for each engagement are recorded in the Agreement (normally in its data-protection annexure).
2.2 VIC processes Personal Information only on the Client’s documented instructions, being the Agreement and any written instruction from the Client’s authorised representative, and only for the purpose stated. VIC does not process Personal Information for its own purposes.
2.3 VIC may use anonymised, aggregated information derived from engagements to improve its methodologies and benchmarks, provided no such use identifies the Client, its practitioners, staff or patients.
3. Minimum Information and De-identification
3.1 VIC requests only the minimum information reasonably required for the service.
3.2 Documents containing patient-level information (such as remittances, motivations, correspondence and clinical records) must be de-identified by the Client before sharing, by removing names, identity and member numbers and contact details, unless the Agreement specifically requires identified information for the service. VIC may decline to process, or may return, any document that has not been de-identified.
4. Confidentiality
4.1 VIC treats all Personal Information as confidential, restricts access to the personnel working on the Client’s engagement, and ensures that every such person, whether employee or contractor, is bound by written confidentiality and POPIA undertakings no less protective than these Terms.
5. Security
5.1 VIC maintains appropriate, reasonable technical and organisational measures to prevent loss of, damage to, or unauthorised access to Personal Information, having regard to generally accepted information security practices. These include:
- access-controlled cloud storage with unique user credentials and multi-factor authentication;
- role-based access limited to the engagement team;
- secure transfer links or shared folders in preference to open email attachments for documents containing Personal Information;
- device security requirements for all VIC personnel, including screen lock, encryption and up-to-date software;
- periodic review of access rights and removal of access when personnel leave an engagement.
5.2 VIC will review these measures at least annually and whenever there is a material change in the services or the risk environment.
6. Electronic Tools and Sub-operators
6.1 VIC uses reputable cloud-hosted software services to store, organise, score and analyse information. These comprise: (a) cloud storage, email and productivity services; and (b) document-analysis and analytics tools.
6.2 Each such provider is engaged on written terms that require confidentiality, security measures substantially similar to POPIA, and that prohibit the provider from using the Client’s information for its own purposes, including the training of any software or model.
6.3 All findings, ratings and recommendations produced with the assistance of electronic tools are reviewed by a VIC consultant before delivery. No decision affecting the Client or any data subject is made on an automated basis alone.
6.4 A current list of providers, and the countries in which they host information, is available to the Client on written request to info@visionintelligence.co.za.
6.5 VIC will notify the Client in writing before adding a new category of sub-operator. The Client may object on reasonable data-protection grounds within ten (10) business days; if the objection cannot be resolved, either Party may terminate the affected service on written notice without penalty.
7. Cross-border Transfer
7.1 Some of the services in Clause 6 are hosted outside South Africa. VIC transfers Personal Information outside South Africa only to such services, and only where the recipient is bound by law, binding corporate rules or a binding agreement providing protection substantially similar to POPIA, including as to onward transfer, as contemplated in section 72 of POPIA.
7.2 Any other transfer of Personal Information outside South Africa requires the Client’s prior written consent.
8. Security Compromise
8.1 If VIC becomes aware, or reasonably suspects, that Personal Information has been accessed or acquired by an unauthorised person, VIC will notify the Client in writing without undue delay and in any event within seventy-two (72) hours, with the information reasonably available at that time, and will update the Client as further information becomes available.
8.2 VIC will take reasonable steps to contain and remedy the compromise and will cooperate with the Client in meeting its obligations under section 22 of POPIA, including any notification to the Information Regulator and to data subjects. VIC will not notify the Regulator or data subjects on the Client’s behalf unless the Client instructs it to.
9. Data Subject Requests and Regulator Enquiries
9.1 If VIC receives a request, complaint or enquiry from a data subject or the Information Regulator relating to the Client’s Personal Information, VIC will forward it to the Client promptly and will not respond substantively without the Client’s instruction.
9.2 VIC will provide reasonable assistance to the Client in responding. Assistance requiring more than incidental time may be billable at VIC’s standard rates, as provided in the Agreement.
10. Retention, Return and Deletion
10.1 VIC retains Personal Information for the period stated in the Agreement. Where no period is stated, engagement working files are retained for twelve (12) months after completion of the service for audit-trail and quality-assurance purposes, and are then securely deleted.
10.2 On the Client’s written request VIC will return or securely delete Personal Information earlier, unless retention is required by law or by professional rules, and will confirm deletion in writing.
10.3 Deletion includes deletion from VIC’s active systems and from sub-operator systems within the sub-operator’s standard deletion cycle. Encrypted backups are overwritten in the ordinary course and are not accessed except for disaster recovery.
11. Audit and Information
11.1 On reasonable written notice, and no more than once in any twelve-month period unless a security compromise has occurred, VIC will provide the Client with a written description of its security measures, its current provider list, and answers to reasonable questions about its processing of the Client’s Personal Information.
12. Versions and Changes
12.1 These Terms are versioned and dated. The version incorporated into an Agreement is the version in force on the date of last signature of that Agreement, and continues to apply to that Agreement unless the Parties agree in writing to adopt a later version.
12.2 VIC may publish a new version at any time. VIC will notify clients with active Agreements in writing of any new version and of the changes made. Prior versions remain available on request.
12.3 If these Terms conflict with the Agreement, the Agreement prevails to the extent of the conflict, save that nothing in the Agreement reduces the protection these Terms give to Personal Information.
Version History
| Version | Date | Change |
|---|---|---|
| v1.0 | 14 September 2026 | First published version. Applies to all Vision Intelligence Consulting services and divisions, including VIC Consulting, VIVA, VIS and VIA, and to any engagement in which VIC processes information on a client’s behalf. |
Prior versions are available on request to info@visionintelligence.co.za.