INTRODUCTION AND PURPOSE

1. Mammoth X Proprietary Limited (the “Company”) recognises and gives effect to the constitutional right of access to information as contemplated in section 32 of the Constitution of the Republic of South Africa, 1996 (“the Constitution”), as well as the right to privacy. The Company is committed to protecting the rights of Data Subjects, including the right to privacy and the right of access to information held by the Company.

2. This Access to Information Manual (“Manual”) is prepared in accordance with the provisions of the Promotion of Access to Information Act 2 of 2000 (“PAIA”) and the Protection of Personal Information Act 4 of 2013 (“POPIA”). The purpose of this Manual is to facilitate requests for access to records held by the Company and to enable requesters to obtain such access in a manner that is efficient, accessible and compliant with applicable law.

3. PAIA gives effect to the constitutional right of access to information, subject to justifiable limitations, including, without limitation, the reasonable protection of personal privacy, commercial confidentiality, legal privilege and the effective, efficient and proper governance of public and private bodies. Such limitations shall be applied in a manner that appropriately balances competing rights and interests.

4. POPIA complements PAIA by promoting the protection of Personal Information processed by public and private bodies and by ensuring that access to information is balanced against the right to privacy.

5. This Manual provides a framework through which any person may request access to records held by the Company for the exercise or protection of any rights and sets out the procedures to be followed and the criteria to be satisfied to obtain such access.

6. The Company shall grant access to records where required to do so in terms of PAIA, subject to any lawful grounds for refusal as contemplated in the Act.

7. This Manual shall be interpreted in a manner consistent with PAIA and POPIA and shall not limit or detract from any rights afforded to requesters under applicable law.

8. This Manual must be read together with the Company’s Privacy Policy and Consent Framework, which govern the processing of Personal Information within the Mammoth Health Information Exchange (“HIE”).

9. A copy of this Manual shall be made available for inspection, free of charge, at the Company’s physical address and in such other manner as may be prescribed or required by law.

2. GLOSSARY OF ABBREVIATIONS AND DEFINITIONS 

3. CONTACT DETAILS 

   1. Information Officer: Kegomoditswe Magobe

   2. Email address: kego@mammoth.health

   3. Physical address: 67 Roscommon Road, Parkview, Gauteng, 2193  

   4. Postal Address:  Postnet suite 103, Private bag X782, Bedfordview, Gauteng, 2008

4. GENERAL INFORMATION 

   1. Name of private body: MammothX Proprietary Limited

   2. Registration number: 2025/525827/07,

   3. Website: www.mammoth.health

   4. General Email Address: info@mammoth.health

5. FURTHER GUIDANCE 

   1. PAIA affords a requester the right of access to records held by a private body where such records are required for the exercise or protection of any rights, including rights relating to Personal Information as contemplated in POPIA. Requests for access to records in terms of PAIA or POPIA must be made in accordance with the prescribed procedures and applicable fees, as set out in the Act and its regulations, as amended from time to time.

   2. To assist persons in exercising their rights under PAIA, a guide has been compiled in accordance with section 10 of PAIA by the Information Regulator. This guide contains information regarding the manner in which requests for access to records may be made, the rights of requesters, and the remedies available in terms of the Act.

   3. The guide is available from the Information Regulator and may be accessed via its official website or by contacting the Information Regulator directly.

   4. For further information regarding PAIA, POPIA, or the exercise of rights in terms of these Acts, requesters may contact the Information Regulator or, where applicable, the South African Human Rights Commission, using the details set out below.

6. PRIVACY PRACTICES 

   1. The Company processes Personal Information in accordance with POPIA and all applicable laws.

   2. Personal Information is collected and processed for lawful and legitimate purposes, including, without limitation:

      1. the provision of services to Data Subjects and the fulfilment of contractual and legal obligations owed to other natural or juristic persons;

      2. the implementation of instructions received from Data Subjects or authorised representatives;

      3. the communication of information relating to the Company’s products, services and offerings; and

      4. the improvement, development and alignment of the Company’s business operations and services to meet the needs of Data Subjects.

   3. Personal Information may be collected directly from Data Subjects or received from, and disclosed to, third parties where necessary for the purposes set out above, including, without limitation:

      1. regulatory authorities and supervisory bodies, including those to which the Company is subject;

      2. parties where disclosure is required in order to comply with applicable legislation, regulations or legal processes;

      3. third-party service providers, contractors and agents engaged by the Company to perform services on its behalf;

      4. parties to whom disclosure is necessary for the protection or enforcement of the Company’s rights, including its intellectual property; and

      5. parties where disclosure is required in the public interest or as otherwise permitted by law.

   4. Personal Information may be transferred to, stored in, or processed in jurisdictions outside the Republic of South Africa, provided that such transfers are conducted in accordance with POPIA and appropriate safeguards are implemented to ensure the continued protection of such information.

   5. The Company shall implement appropriate, reasonable technical and organisational measures to safeguard Personal Information against loss, damage, unauthorised access, disclosure or destruction.

   6. Where Personal Information is processed by third parties on behalf of the Company, such parties shall be contractually bound to implement appropriate security measures and to process such information only in accordance with the Company’s instructions and applicable law.

   7. The Company employs industry-standard security measures, including encryption technologies where appropriate, to protect Personal Information processed through its systems and digital platforms.

   8. Further details regarding the processing of Personal Information are set out in the Company’s Privacy Policy, which should be read together with this Manual.

7. TYPES OF RECORDS HELD BY THE COMPANY 

   1. The Company maintains records in the ordinary course of its business operations across various categories and subject matters.

   2. The categories of records maintained by the Company include, without limitation:

      1. corporate governance and statutory records;

      2. financial and accounting records;

      3. human resources and employment records;

      4. strategic and operational records;

      5. information technology and systems records;

      6. compliance, legal and risk management records;

      7. contractual and commercial records;

      8. records relating to shareholders, directors and corporate structure; and

      9. records relating to service providers, contractors and intermediaries.

   3. The Company also processes Personal Information relating to various categories of Data Subjects, including employees, contractors, service providers, users and other stakeholders.

   4. The inclusion of any category or subject matter of records in this Manual shall not be construed as an automatic entitlement to access such records, and all requests for access shall be assessed on a case-by-case basis in accordance with PAIA.

8. RECORDS AUTOMATICALLY AVAILABLE

   1. Certain records of the Company are available without the need to submit a formal request in terms of PAIA.

   2. Such records may include, without limitation:

      1. information published on the Company’s website;

      2. publicly available reports, notices and publications; or

      3. general information relating to the Company’s services and operations.

   3. Access to such records shall be subject to any applicable terms and conditions governing their use.

9. RECORDS AVAILABLE IN TERMS OF OTHER LEGISLATION

   1. In addition to records accessible in terms of PAIA, certain records may be available in terms of other applicable legislation.

   2. Such legislation includes, without limitation:

      1. The Constitution of the Republic of South Africa, 1996; 

      2. The Companies Act 71 of 2008; 

      3. The Electronic Communications and Transactions Act 25 of 2002; 

      4. The Consumer Protection Act 68 of 2008; 

      5. The National Health Act 61 of 2003; 

      6. The Protection of Personal Information Act 4 of 2013; 

      7. The Financial Intelligence Centre Act 38 of 2001; 

      8. The Financial Sector Regulation Act 9 of 2017; 

      9. The Insurance Act 18 of 2017; 

      10. The Long-term Insurance Act 52 of 1998; 

      11. The Short-term Insurance Act 53 of 1998; 

      12. The National Credit Act 34 of 2005; 

      13. The Employment Equity Act 55 of 1998; 

      14. The Occupational Health and Safety Act 85 of 1993; 

      15. The Unemployment Insurance Act 63 of 2001; 

      16. The Value-Added Tax Act 89 of 1991; 

      17. The Medical Schemes Act 131 of 1998; 

      18. The Financial Advisory and Intermediary Services Act 37 of 2002. 

   3. The above list is not exhaustive and may be amended from time to time as additional legislation becomes applicable to the Company.

   4. Access to records in terms of such legislation shall be subject to the provisions, procedures and limitations prescribed in the relevant legislation.

5. Types of personal information held by the Company

6. Other Parties 

   1. The Company maintains records relating to third parties, including, without limitation, contractors, suppliers, service providers, departments and other entities with which the Company conducts business.

   2. Such records may be held either by the Company or by such third parties on behalf of the Company and may constitute records that are in the possession of, or under the control of, the Company for purposes of PAIA.

   3. Records falling within this category include, without limitation:

• employee, work or service-related records that are held by a third party on behalf of the Company; and

• records held by the Company relating to such third parties, including financial records, correspondence, contractual documentation, records provided by such third parties to the Company, and records generated by or within the Company concerning such third parties.

10. STEPS TO CONSIDER BEFORE SUBMITTING A REQUEST 

    1. A requester is advised to consider the following matters prior to submitting a request for access to records in terms of PAIA, to determine whether a request is appropriate and to ensure compliance with the requirements of the Act.

2. Step 1: Access to Personal Information

   1. A Data Subject seeking access to his or her own Personal Information may, in certain instances, obtain such information without resorting to the formal request procedures prescribed by PAIA.

   2. Such information may include, without limitation:

• account information;

• personal records; and

• voice recordings or other records relating directly to the Data Subject.

3. Data Subjects are encouraged to contact the relevant department or service channel of the Company in order to request access to such information directly.

4. The Company reserves the right to levy reasonable administrative fees in respect of the retrieval and provision of such records, where applicable.

3. Step 2: Applicability of PAIA

   1. A requester must determine whether PAIA applies to the request.

   2. In terms of section 7(1) of PAIA, the Act does not apply to a record of a public or private body if:

• the record is requested for the purpose of criminal or civil proceedings;

• the request is made after the commencement of such proceedings; and

• the production of, or access to, such record is provided for in any other law.

3. Where section 7(1) applies, the requester shall not be entitled to request access to such record in terms of PAIA and must instead utilise the applicable rules of discovery or procedures prescribed by the relevant legal forum.

4. The Company reserves the right to recover any costs, expenses or damages incurred as a result of a requester submitting a request in contravention of section 7(1) of PAIA.

4. Step 3: Existence of a Record

   1. PAIA applies only to records that are in existence at the time the request is received by the Company.

   2. The Company is not obliged to create a record that does not exist at the time of the request.

   3. Accordingly, PAIA may not be used to obtain information, explanations or reasons for decisions unless such information is already recorded and exists in documentary or recorded form.

5. Step 4: Possession or Control of the Record

   1. A requester must determine whether the record requested is in the possession of, or under the control of, the Company.

   2. Access to a record may only be granted where such record is held by the Company or is under its control at the time the request is made.

   3. Where a record is no longer in the possession or under the control of the Company, the requester must direct the request to the person or entity in possession of or having control over such record.

11. ACCESS TO RECORDS AND PROCEDURE RECORDS 

    1. Access to records held by the Company shall be granted only where the requester has complied with the requirements prescribed in PAIA and any applicable procedures set out in this Manual.

2. Who May Request Access to Records

   1. In terms of section 50 of PAIA, any person who requires access to a record of a private body for the exercise or protection of any rights may submit a request for access to such record.

   2. The Company shall grant access to a requested record where:

• the record is required for the exercise or protection of a right;

• the requester has complied with the procedural requirements prescribed by PAIA; and

• access to the record is not refused on any lawful ground for refusal as contemplated in Chapter 4 of PAIA.

3. Categories of Requesters

   1. Personal Requesters

• A Personal Requester is a Data Subject who seeks access to a record containing Personal Information relating to himself or herself.

• Subject to applicable law, the Company shall provide access to such Personal Information, provided that the requester has complied with the applicable procedural requirements.

• A Personal Requester shall not be required to pay a request fee; however, the Company may charge the prescribed fees for the reproduction of records.

2. Other Requesters

• An Other Requester is any requester who is not a Personal Requester and who seeks access to records relating to third parties or general Company records.

• An Other Requester shall be entitled to request access to records in terms of PAIA, provided that such requester satisfies all requirements prescribed by the Act, including demonstrating that the requested record is required for the exercise or protection of a right.

• The Company shall not be obliged to grant access to such records where a lawful ground for refusal applies.

• An Other Requester shall be required to pay the prescribed request fee and any applicable access fees in accordance with PAIA.

12. HOW TO SUBMIT REQUEST FOR ACCESS 

    1. A requester may submit a request for access to records held by the Company to the Information Officer in accordance with the procedures set out in this Manual and the requirements of PAIA.

    2. Prior to submitting a request, a requester is advised to consider the provisions of this Manual, including the eligibility requirements and procedural steps, to ensure compliance with PAIA.

3. Submission of Request

   1. A requester shall complete the prescribed Form 2 in terms of PAIA (the “Request Form”).

   2. The completed Request Form shall be submitted to the Information Officer using the contact details set out in this Manual, including by electronic mail, post, or physical delivery, as applicable.

4. Required Information

The Request Form shall contain sufficient detail to enable the Information Officer to identify:

1. the record or records requested;

2. the identity of the requester;

3. the form of access required, where the request is granted; and

4. the contact details of the requester, including a postal address, email address or facsimile number.

5. Requirement to State a Right

   1. The requester shall state the right that is sought to be exercised or protected and shall provide a clear explanation as to why the requested record is required for the exercise or protection of such right.

   2. The requester shall demonstrate that access to the requested record is reasonably required for the exercise or protection of the identified right.

6. Requests Made on Behalf of Another Person

   1. Where a request is made on behalf of another person, the requester shall provide proof of the capacity in which such request is made, to the reasonable satisfaction of the Information Officer.

7. Processing of Requests

   1. The Company shall process a request within 30 (thirty) days of receipt thereof, unless an extension is permitted in terms of PAIA.

   2. The requester shall be notified in writing whether access to the requested record has been granted or refused.

   3. Where a requester requires the reasons for a decision to be provided in a particular manner, such requirement shall be specified in the Request Form.

8. Requests by Persons Unable to Complete the Request Form

   1. Where a requester is unable to complete the prescribed Request Form due to illiteracy or disability, such requester may make the request orally to the Information Officer.

   2. The Information Officer shall assist such requester by reducing the request to writing and ensuring that the request complies with the requirements of PAIA.

13. PRESCRIBED FEES 

    1. A requester shall be required to pay the prescribed request fee and any applicable access fees in accordance with PAIA and the regulations promulgated thereunder.

    2. 
       

    3. PAIA provides for two categories of fees, namely:

       1. a request fee, which is payable upon submission of a request by any requester other than a Personal Requester; and

       2. an access fee, which is payable in respect of the reproduction of records, as well as the time reasonably required for the search for, preparation of, and provision of access to such records.

    4. The prescribed request fee shall be payable upon submission of the Request Form, and proof of payment shall be provided to the Company in a form acceptable to the Information Officer prior to the processing of the request.

    5. Where the search for and preparation of a record for disclosure is likely to exceed the prescribed time threshold, the Company may require the requester to pay a deposit, calculated as a prescribed portion of the anticipated access fee, before proceeding with the request.

    6. The requester shall be notified by the Information Officer where a deposit is required and of the amount payable.

    7. The Company shall be entitled to withhold access to the requested record until all applicable fees, including any deposit and access fee, have been paid in full.

    8. Where a request for access is granted, the requester shall be required to pay the applicable access fee for the reproduction of records and for the search for and preparation of such records, including any time reasonably required in excess of the prescribed threshold.

    9. Where a request for access is refused, the requester may apply for a refund of any deposit paid, in accordance with the provisions of PAIA.

    10. A Personal Requester shall not be required to pay a request fee but may be required to pay the prescribed fees for the reproduction of records.

    11. Where a requester qualifies for exemption from the payment of any fee in terms of PAIA, such requester shall provide the reasons for such exemption, which shall be considered by the Company in accordance with applicable law.

14. CONSIDERING THE REQUEST 

    1. Receipt of Request

A request for access to records shall be deemed to have been received by the Company once all the procedural requirements prescribed by PAIA have been satisfied.

2. Processing of Request

   1. Subject to the provisions of PAIA, the Company shall process a request within 30 (thirty) days of receipt thereof.

   2. The Company may extend the period for processing a request in accordance with PAIA where circumstances reasonably require such extension, including where the request is complex or requires the retrieval of multiple records.

3. Notification of Decision

   1. The requester shall be notified in writing whether access to the requested record has been granted or refused.

4. Grounds for Refusal of Access

   1. The Company may refuse access to a record in accordance with Chapter 4 of PAIA.

   2. Without limiting the generality of the foregoing, grounds for refusal include, without limitation:

• Protection of Personal Privacy

Access may be refused where disclosure would involve the unreasonable disclosure of Personal Information relating to a third party who is a natural person.

• Protection of Commercial Information of a Third Party

Access may be refused where the record contains:

• trade secrets of a third party;

• financial, commercial, scientific or technical information, the disclosure of which could reasonably be expected to cause harm to the commercial or financial interests of that third party; or

• information disclosed in confidence by a third party, the disclosure of which could place that third party at a disadvantage in contractual or commercial negotiations.

• Protection of Confidential Information

Access may be refused where the record contains confidential information of a third party that is protected in terms of an agreement or by law.

• Protection of Safety and Security

Access may be refused where disclosure could reasonably be expected to endanger the safety of individuals or the security of property.

• Legal Privilege

Access may be refused where the record is privileged from production in legal proceedings.

• Protection of Commercial Information of the Company

Access may be refused where the record contains:

• trade secrets of the Company;

• financial, commercial, scientific or technical information, the disclosure of which could reasonably be expected to cause harm to the commercial or financial interests of the Company;

• information which, if disclosed, could place the Company at a disadvantage in contractual or commercial negotiations or competition;

• a computer program owned by the Company and protected by copyright.

• Protection of Research Information

Access may be refused where the record contains research information of the Company or a third party, the disclosure of which could place such research at a serious disadvantage.

15. DECISION 

    1. Determination of Request

       1. The Company shall, within 30 (thirty) days of receipt of a request that complies with the requirements of PAIA, determine whether to grant or refuse access to the requested record.

       2. The Company shall notify the requester in writing of its decision, together with the reasons for such decision where required in terms of PAIA.

       3. The Information Officer shall take all reasonable steps to locate the requested record.

       4. Where the requested record cannot be found or does not exist, the Information Officer shall notify the requester by way of affidavit or affirmation that it is not possible to give access to such record, and such notification shall be deemed to constitute a refusal of the request.

       5. Where a record is subsequently located after such notification, access shall be granted to the requester if the request would otherwise have been granted.

2. Extension of Time Periods

   1. The period of 30 (thirty) days referred to in clause 16.1 may be extended for a further period not exceeding 30 (thirty) days where:

• the request is for a large number of records;

• the request requires a search for records located at different offices or locations of the Company; or

• compliance within the initial period is not reasonably possible.

2. Where an extension is required, the Company shall notify the requester in writing of such extension, the reasons therefor, and the procedure available to the requester to apply to a court for relief.

3. Granting of Access

   1. Where a request for access is granted, the Company shall notify the requester in writing of:

• the applicable access fee payable, if any;

• the form in which access to the record will be granted; and

• the procedure available to the requester to apply to a court for relief in respect of any fees payable.

2. Access to the requested record shall be provided in the form reasonably requested by the requester, or, where no preference has been indicated, in a form reasonably determined by the Information Officer.

4. Refusal of Access

   1. Where a request for access is refused, the Company shall notify the requester in writing of:

• the reasons for the refusal;

• the provisions of PAIA relied upon in refusing access; and

• the procedure available to the requester to apply to a court for relief.

2. Failure by the Company to respond to a request within the prescribed period shall be deemed to constitute a refusal of the request.

5. Partial Access and Redaction

   1. In accordance with section 59 of PAIA, the Information Officer may grant access to a record with such deletions or redactions as are necessary to ensure that access is not given to information which is prohibited from disclosure.

6. Grounds for Refusal

   1. Access to records may be refused on the grounds set out in paragraph 15 of this Manual and in accordance with Chapter 4 of PAIA.

   2. Without limiting the generality of the foregoing, the Company may refuse access to records where:

• the request is frivolous, vexatious or manifestly unreasonable;

• compliance with the request would unreasonably divert the Company’s resources; or

• a lawful ground for refusal applies in terms of PAIA.

7. Mandatory Disclosure

   1. Notwithstanding any ground for refusal, the Company shall grant access to a record where such disclosure is required in terms of PAIA, including where the disclosure would reveal evidence of a substantial contravention of, or failure to comply with, the law, or an imminent and serious public safety or environmental risk, and where the public interest in disclosure clearly outweighs the harm contemplated in the relevant ground for refusal.

16. REMEDIES available TO REFUSAL OF A REQUEST FOR INFORMATION 

    1. Internal remedies 

       1. The Company does not provide for internal appeal procedures in respect of decisions taken by the Information Officer in terms of PAIA.

       2. Accordingly, any decision taken by the Information Officer shall be final within the Company, and a requester who is dissatisfied with such decision shall be required to pursue such external remedies as may be available in terms of PAIA.

2. External remedies 

   1. A requester who is dissatisfied with a decision of the Information Officer to refuse access to a record may, within 30 (thirty) days of notification of such decision, apply to a court of competent jurisdiction for appropriate relief.

   2. Similarly, a third party who is dissatisfied with a decision of the Information Officer to grant access to a record may, within 30 (thirty) days of notification of such decision, apply to a court of competent jurisdiction for appropriate relief.

   3. For purposes of PAIA and POPIA, the courts having jurisdiction in respect of such applications include the Constitutional Court, the High Court, or any other court of similar status having jurisdiction.

17. AVAILABILITY OF THE MANUAL 

    1. This Manual shall be made available on the Company’s website at www.mammoth.health

    2. Copies of this Manual may also be obtained, free of charge, from the Company’s physical offices situated at 67 Roscommon Road, Parkview, Gauteng, 2193.

18. DISCLAIMER

    1. This Manual is intended as a guide to assist requesters in exercising their rights in terms of PAIA and does not purport to be exhaustive of, nor does it comprehensively address, every procedure or requirement provided for in PAIA or the Protection of Personal Information Act 4 of 2013 (“POPIA”).

    2. Requesters are advised to familiarise themselves with the provisions of PAIA and POPIA prior to submitting any request to the Company.

    3. The Company shall provide such reasonable assistance as may be required to enable a requester to complete the prescribed request forms, in accordance with the provisions of PAIA and applicable regulations.

    4. The Company makes no representation and gives no undertaking or warranty, whether express or implied, as to the completeness, accuracy or reliability of the information contained in this Manual or any information provided pursuant thereto.

    5. To the fullest extent permitted by law, the Company shall not be liable for any loss, damage, expense, liability or claim of whatsoever nature and howsoever arising, whether direct or indirect, arising from or in connection with the use of this Manual or any information provided by the Company, or any errors or omissions contained therein.

ANNEXURE A: PRESCRIBED FEES

1. In terms of PAIA and the regulations promulgated thereunder, two categories of fees may be payable in respect of a request for access to records, namely a request fee and an access fee.

2. Request Fee

   1. A request fee shall be payable by any requester other than a Personal Requester.

   2. A Personal Requester, being a requester who seeks access to a record containing Personal Information relating to himself or herself, shall not be required to pay a request fee.

   3. The prescribed request fee is currently R50.00 (fifty rand), which shall be payable upon submission of a request for access to records other than Personal Information relating to the requester.

3. Access Fee

   1. An access fee may be payable in respect of the search for, preparation of, and reproduction of the requested record, including any reasonable time required to locate and prepare such record for disclosure.

   2. The access fee shall not be payable in respect of a Personal Requester seeking access to his or her own Personal Information, save for the prescribed fees relating to the reproduction of such records.

4. Additional Costs

   1. Where a copy of a record is required to be posted to the requester, the requester shall be liable for the actual postal costs incurred.

5. Deposit

   1. Where a request is made by a requester other than a Personal Requester and the Information Officer is of the opinion that the search for and preparation of the requested record for disclosure will exceed six (6) hours, the Company may require the requester to pay a deposit.

   2. The deposit shall be calculated as one third (1/3) of the amount of the estimated access fee that would be payable if the request is granted.

6. Payment of Fees

   1. The Company may require payment of the prescribed request fee and any applicable deposit prior to processing the request.

   2. The Company shall be entitled to withhold access to the requested record until all applicable fees have been paid in full.

7. Schedule of Fees

   1. The applicable fees payable in respect of access to records shall be as prescribed in the regulations to PAIA, as amended from time to time.

The applicable fees payable upfront are as follows: