PAIA Manual
Compiled in terms of section 51 of the Promotion of Access to Information Act 2 of 2000, as amended by the Protection of Personal Information Act 4 of 2013.
| Version | v2.2 — supersedes v2.1 |
|---|---|
| Effective date | 4 August 2026 |
| Private body | Vowels Africa (Pty) Ltd, trading as RemMed SA |
| Registration number | 2025/722562/07 |
| Information Officer | Yaseen Samsodien |
| Deputy Information Officer | None appointed |
| Information Regulator registration | 2026-063725, registered 4 August 2026 |
| Published at | remmed.co.za/paia |
| Review cycle | Annually, and on any material change to the records held or the particulars in section 3 |
| Next scheduled review | 4 August 2027 |
1. Purpose of this manual
1.1 The Promotion of Access to Information Act 2 of 2000 ("PAIA") gives effect to the constitutional right of access to information held by the State and by private bodies, where that information is required for the exercise or protection of any right.
1.2 Section 51 of PAIA requires every private body to compile a manual describing the records it holds and explaining how a person may request access to them. From 1 January 2022 no private body is exempt from this obligation, and non-compliance with section 51 is an offence under section 90 of PAIA.
1.3 This manual is that manual. It also carries the information regarding the processing of personal information required by the Regulations made under the Protection of Personal Information Act 4 of 2013 ("POPIA").
1.4 This manual is updated in terms of section 51(2) of PAIA as and when required.
2. About Vowels Africa (Pty) Ltd t/a RemMed SA
2.1 Vowels Africa (Pty) Ltd is a private company incorporated in the Republic of South Africa on 15 September 2025, trading as RemMed SA. It is a private body as defined in section 1 of PAIA and a responsible party as defined in section 1 of POPIA.
2.2 RemMed operates a revenue recovery platform for South African medical practices. The platform reads medical aid remittance advices delivered to a mailbox the practice controls, reconciles the claim lines against what was billed, classifies discrepancies against scheme reason codes, and presents the practice with recovery actions ranked by value and by how soon the resubmission window closes. The platform is read-only: it holds no write access to any practice billing system and takes no recovery action of its own.
2.3 In respect of medical aid remittance and claim data, RemMed acts as an operator on behalf of the medical practice, which is the responsible party for that data. In respect of its own website visitors, prospective customers, platform users, employees and suppliers, RemMed acts as a responsible party.
3. Particulars of the private body — section 51(1)(a)
| Registered name | Vowels Africa (Pty) Ltd |
|---|---|
| Trading name | RemMed SA |
| Registration number | 2025/722562/07 |
| Date of incorporation | 15 September 2025 |
| Enterprise type | Private company |
| Financial year end | February |
| Income tax reference number | 9714807196 |
| Registered office | 57 Innis Road, Wynberg, Cape Town, Western Cape, 7800 |
| Postal address | 57 Innis Road, Wynberg, Cape Town, Western Cape, 7800 |
| Directors | Yusri Mathews; Yaseen Samsodien |
| Head of the private body | Yaseen Samsodien |
| Information Officer | Yaseen Samsodien, appointed 1 July 2026 |
| Deputy Information Officer | None appointed |
| Information Regulator registration number | 2026-063725 |
| Date registered with the Information Regulator | 4 August 2026 |
| Email — PAIA and POPIA requests | privacy@remmed.co.za |
| Email — general | hello@remmed.co.za |
| Telephone | +27 79 211 3719 |
| Website | remmed.co.za |
The Information Officer of a private body is, by operation of law, the head of that body. The Information Officer has been registered with the Information Regulator in accordance with section 55(2) of POPIA. No Deputy Information Officer has been designated; all requests are directed to the Information Officer.
Note on the particulars above. Section 51(1)(a) of PAIA requires this manual to state the postal and street address, phone number and, where available, electronic mail address of the head of the private body. All of those particulars are recorded above and no field in this manual is outstanding.
The same telephone number appears in Annexure A to the Website Terms of Use, which carries an equivalent requirement under section 43(1)(b) of the Electronic Communications and Transactions Act. Any change to it must be made in both documents in the same deployment.
4. The PAIA Guide — section 10
4.1 The Information Regulator has published a guide on how to use PAIA, containing the information a person reasonably requires to exercise the rights that PAIA confers. It is available in each official language and in braille.
4.2 The guide may be obtained from the Information Regulator at:
| The Information Regulator (South Africa) | Woodmead North Office Park, 54 Maxwell Drive, Woodmead, Johannesburg |
|---|---|
| Postal address | PO Box 31533, Braamfontein, Johannesburg, 2017 |
| General enquiries | enquiries@inforegulator.org.za |
| PAIA complaints | PAIAComplaints@inforegulator.org.za |
| POPIA complaints | POPIAComplaints@inforegulator.org.za |
| Website | inforegulator.org.za |
| eServices portal | eservices.inforegulator.org.za |
5. Records automatically available — sections 51(1)(c) and 52
5.1 Section 52 of PAIA allows a private body, on a voluntary basis, to publish a notice listing categories of records that are automatically available without a formal request. RemMed has not published a notice under section 52.
5.2 The following are nevertheless available on the website without any request or fee:
- This PAIA Manual
- The Website and Platform Privacy Notice
- The Website Terms of Use, including the disclosures required by section 43 of the Electronic Communications and Transactions Act 25 of 2002
- The Cookie Notice, published at remmed.co.za/cookies
- The Refund and Cancellation Policy, published at remmed.co.za/refunds
- Published pricing and product descriptions
5.3 In addition, a subscribing practice may obtain the Named Sub-Operator Register on written request to the Information Officer, subject to the confidentiality provisions of its Master Services Agreement.
6. Records held, by subject and category — section 51(1)(e)
The listing of a category below does not mean that a record within it will be released. Every request is assessed against the grounds for refusal in Chapter 4 of PAIA, set out in section 10 of this manual.
| Subject | Categories of records |
|---|---|
| Corporate and statutory | Memorandum of incorporation, certificate of incorporation (COR14.3), share register, register of directors, board and shareholder resolutions, minutes, statutory registers |
| Financial | Annual financial statements, management accounts, budgets and financial models, banking records, invoices and statements, tax returns and SARS correspondence |
| Customer and commercial | Master Services Agreements and schedules, order forms, proposals and quotations, Remittance Review reports, recovery statements, customer correspondence and support records |
| Supplier and procurement | Supplier agreements, data processing agreements, service level documentation, the Named Sub-Operator Register |
| Employment and human resources | Employment contracts, personnel files, payroll, PAYE and UIF records, leave records, disciplinary records, workplace policies, confidentiality and restraint undertakings |
| Information governance | This manual, the Privacy Notice, the Cookie Notice and consent records, records of processing operations, retention schedule, information security policy, security compromise register, data subject request register, Information Officer registration records |
| Product and technical | Product specifications, scheme parser documentation and coverage records, system architecture and configuration, access control records, system and access logs, backup and recovery records |
| Intellectual property and brand | Source code and repositories, trade mark and domain records, brand assets and design tokens, the Remeez persona specification |
| Marketing | Website content, campaign material and performance data, enquiry and lead records, marketing consent records |
| Records held for practices (operator capacity) | Medical aid remittance advices, parsed claim-line data, reconciliation and discrepancy records, recovery action records — held on behalf of a practice and dealt with under section 6.1 |
| Records held by third parties on RemMed's behalf | Records hosted by service providers disclosed in the Named Sub-Operator Register. These remain under RemMed's control for the purposes of PAIA. |
6.1 Records held in an operator capacity
Records in the operator category above belong to the medical practice concerned, which is the responsible party for them. RemMed holds them on the practice's documented instruction under a Master Services Agreement, and may not release them to any third party without the practice's authority.
A request for access to such a record must be made to the practice. Where such a request is made to RemMed, the Information Officer will refer the requester to the practice, notify the practice, and assist the practice in responding. The same applies to a request by a patient of a practice for information concerning that patient.
7. Records available in terms of other legislation — section 51(1)(d)
Certain records are accessible under legislation other than PAIA, and access under that legislation follows its own procedure. The list below is not exhaustive and is amended from time to time.
- Companies Act 71 of 2008
- Protection of Personal Information Act 4 of 2013
- Income Tax Act 58 of 1962
- Tax Administration Act 28 of 2011
- Value-Added Tax Act 89 of 1991
- Electronic Communications and Transactions Act 25 of 2002
- Consumer Protection Act 68 of 2008
- Cybercrimes Act 19 of 2020
- Copyright Act 98 of 1978
- Trade Marks Act 194 of 1993
- Basic Conditions of Employment Act 75 of 1997
- Labour Relations Act 66 of 1995
- Employment Equity Act 55 of 1998
- Skills Development Act 97 of 1998
- Skills Development Levies Act 9 of 1999
- Unemployment Insurance Act 63 of 2001
- Unemployment Insurance Contributions Act 4 of 2002
- Compensation for Occupational Injuries and Diseases Act 130 of 1993
- Occupational Health and Safety Act 85 of 1993
- Broad-Based Black Economic Empowerment Act 53 of 2003
8. Processing of personal information
This section carries the information required by the Regulations made under POPIA. Fuller detail appears in the Website and Platform Privacy Notice.
| Item | Detail |
|---|---|
| Purposes of processing | Providing the RemMed platform to subscribing practices; identifying and reporting unpaid and under-paid medical aid claim amounts; account administration and authentication; billing and collection; customer support; sales and marketing to prospective practices; employment administration; and compliance with statutory obligations. |
| Categories of data subjects | Patients of subscribing practices (through remittance data); practitioners and practice staff; platform users; prospective customers and website visitors; employees, contractors and job applicants; supplier and service provider contacts. |
| Categories of personal information | Identifying and contact information; medical aid membership and claim information, including information concerning health; account and authentication information; financial and billing information; employment information; technical information such as IP address and access logs. |
| Special personal information | Information concerning health is present in medical aid claim-line data. It is processed in an operator capacity on the documented instruction of the practice, within section 32(1) of POPIA. Criminal behaviour information may arise in employment vetting. |
| Recipients or categories of recipients | Managed database, authentication and file storage; application hosting and content delivery; transactional email delivery; marketing and newsletter email delivery; electronic signature; secrets management; payment processing; professional advisers under duties of confidentiality; and any person to whom disclosure is required by law. A named list is maintained in the Named Sub-Operator Register and is available to a subscribing practice on written request. |
| Planned trans-border flows | Primary data storage and application compute in the United Kingdom (London region). Transactional email, marketing email, electronic signature and secrets management services provided from the United States. Payment processing takes place within the Republic of South Africa and involves no trans-border flow. Each trans-border flow is made under section 72(1)(a) of POPIA, on the basis of written agreements imposing protections substantially similar to POPIA and, for the primary hosting environment, the UK and EU General Data Protection Regulation together with independent certification including ISO/IEC 27001 and SOC 2. |
| Security measures | Encryption in transit and at rest; role-based access control on a least-privilege basis; multi-factor authentication on administrative access; logging and monitoring of access to practice data; where a practice supplies mailbox credentials directly, AES-256-GCM encryption at rest under a credential encryption key held in a secrets management system separate from the datastore; written data protection agreements with every service provider; and a read-only platform architecture holding no write credentials to any practice billing system. |
9. How to request access to a record
9.1 Making the request
- Complete Form 2 of the PAIA Regulations — "Request for Access to Record of Private Body". The form is available from the Information Officer and from inforegulator.org.za.
- Provide sufficient particulars to enable the Information Officer to identify the record, and to identify and contact you.
- State the right you are seeking to exercise or protect, and explain why the record is required for that purpose. A request that does not do this must be refused.
- State the form of access required, and if you wish to be informed of the decision in a particular manner, say so.
- If you are acting on behalf of another person, submit proof of your authority to the satisfaction of the Information Officer.
- Send the completed form to privacy@remmed.co.za, or to the Information Officer at 57 Innis Road, Wynberg, Cape Town, 7800, together with proof of payment of the request fee.
9.2 What happens next
- The request fee must be paid before the request is processed.
- The Information Officer will decide within 30 days of receipt of the request and will notify you in writing of the decision and, where access is granted, of any access fee payable.
- That period may be extended once, by a further 30 days, where the request is for a large number of records or requires a search through records held at another location. You will be notified in writing of the extension and of your right to complain to the Information Regulator about it.
- Where the preparation of a record is expected to exceed six hours, a deposit of not more than one third of the access fee may be required before preparation begins. The deposit is refundable if access is ultimately refused.
- Where a record contains information about a third party, that party may be given notice and an opportunity to make representations before a decision is taken.
- Access is given once all applicable fees have been paid.
9.3 Requests for your own personal information
A data subject may confirm free of charge, under section 23 of POPIA, whether RemMed holds personal information about them. A prescribed fee applies to a copy of the record itself. Requests for correction or deletion are made on Form 2 of the POPIA Regulations, and objections to processing on Form 1. These POPIA forms are distinct from Form 2 of the PAIA Regulations referred to in section 9.1. All are available from the Information Officer.
10. Grounds for refusal
The Information Officer must or may refuse access on the grounds set out in Chapter 4 of PAIA, which include:
- Unreasonable disclosure of personal information about a third party, including a deceased person (section 63)
- Commercial information of a third party — trade secrets, or financial, commercial, scientific or technical information the disclosure of which would be likely to cause harm, or information supplied in confidence the disclosure of which could put that party at a disadvantage in negotiations or commercial competition (section 64)
- Information the disclosure of which would constitute a breach of a duty of confidence owed to a third party (section 65)
- Information the disclosure of which could endanger the life or physical safety of an individual, or prejudice the security of property or of a system (section 66)
- Records privileged from production in legal proceedings (section 67)
- RemMed's own trade secrets and commercial information, and computer programs owned by RemMed (section 68)
- Research information of RemMed or of a third party, where disclosure would expose the researcher or the subject matter to serious disadvantage (section 69)
Access must nevertheless be granted where disclosure would reveal evidence of a substantial contravention of the law, or of an imminent and serious public safety or environmental risk, and the public interest in disclosure clearly outweighs the harm contemplated (section 70).
Where part of a record may be refused, access is given to the remainder of that record.
11. Remedies
11.1 There is no internal appeal against a decision of a private body. A requester dissatisfied with a decision may:
- Complain to the Information Regulator. On a form substantially corresponding to Form 5 of the PAIA Regulations, sent to PAIAComplaints@inforegulator.org.za, within 180 days of the decision. The Regulator generally expects the requester first to have given RemMed an opportunity to resolve the matter.
- Apply to court. Under section 78 of PAIA, within 180 days of the decision.
11.2 A data subject dissatisfied with the handling of a POPIA matter may complain to the Information Regulator at POPIAComplaints@inforegulator.org.za.
12. Availability of this manual
This manual is available:
- On the website at remmed.co.za/paia, free of charge
- At 57 Innis Road, Wynberg, Cape Town, 7800, for public inspection during normal business hours
- To any person on request, against payment of the prescribed reproduction fee
- To the Information Regulator on request, and uploaded to the Regulator's eServices portal
A copy in an official language other than English can be arranged on request to the Information Officer.
13. Updating this manual
The Information Officer reviews this manual at least annually, and whenever the particulars in section 3, the categories of records in section 6, or the processing described in section 8 materially change. The version number and effective date on the cover are updated on each revision, and the superseded version is retained for five years.
| Version | Date | Change | Approved by |
|---|---|---|---|
| v1.0 | 29 July 2026 | Manual first compiled. Particulars of the private body and the Information Officer left as placeholders pending registration with the Information Regulator. | Not adopted |
| v2.0 | 4 August 2026 | Full particulars of the private body, directors and Information Officer completed following registration with the Information Regulator under number 2026-063725. Fee annexure completed. Annual reporting position recorded. | Information Officer |
| v2.1 | 4 August 2026 | Statutory basis for the telephone number particular recorded at section 3. No change to the records held, the processing described at section 8, or the fee annexure. | Information Officer |
| v2.2 | 17 August 2026 | Records category at section 6 renamed from Health Check to Remittance Review. Section 8 updated to record marketing email delivery, secrets management and payment processing as recipient categories, and to record that payment processing involves no trans-border flow. Cookie Notice reference at section 5.2 corrected to a published address. | Information Officer |
Annexure A — Fees in respect of private bodies
Prescribed by Annexure B to the Regulations Regarding the Promotion of Access to Information, 2021. These are maximum amounts. A private body registered as a VAT vendor may add VAT. Charging more than the prescribed fee is unlawful, and a requester may complain to the Information Regulator.
| Item | Description | Amount |
|---|---|---|
| 1 | Request fee payable by every requester | R140.00 |
| 2 | Photocopy of an A4-size page or part thereof | R2.00 per page |
| 3 | Printed copy of an A4-size page or part thereof | R2.00 per page |
| 4 | Copy in computer-readable form on a flash drive provided by the requester | R40.00 |
| 5 | Copy in computer-readable form on a compact disc provided by the requester | R40.00 |
| 6 | Copy in computer-readable form on a compact disc provided to the requester | R60.00 |
| 7 | Transcription of visual images, per A4-size page | Outsourced — per service provider quotation |
| 8 | Copy of visual images | Outsourced — per service provider quotation |
| 9 | Copy of an audio record on a flash drive or compact disc | As for items 4 to 6 |
| 10 | Searching for and preparing the record for disclosure, for each hour or part of an hour reasonably required, excluding the first hour | R145.00 per hour, to a maximum of R435.00 |
| 11 | Deposit, where the search and preparation is expected to exceed six hours | One third of the access fee calculated under items 2 to 9 |
| 12 | Postage, email or other electronic transmission of the record | Actual expense, if any |
Personal inspection of a record at the registered office, including listening to a sound recording or viewing information held in electronic form, is free of charge. An appointment must be made with the Information Officer. Reproduction in any form attracts the fees above.
Annexure B — Prescribed forms
| Form | Purpose | Where to obtain it |
|---|---|---|
| PAIA Form 2 | Request for access to a record of a private body | Information Officer, or inforegulator.org.za |
| PAIA Form 3 | Outcome of request and of fees payable — issued by RemMed to the requester | Issued by the Information Officer |
| PAIA Form 5 | Complaint to the Information Regulator | inforegulator.org.za, or the online complaint form |
| POPIA Form 1 | Objection to the processing of personal information (section 11(3)) | Information Officer, or inforegulator.org.za |
| POPIA Form 2 | Request for correction or deletion of personal information (section 24) | Information Officer, or inforegulator.org.za |
| POPIA Form 3 | Request for consent to process personal information for direct marketing (section 69) | Information Officer, or inforegulator.org.za |
Use the current version of each form as published by the Information Regulator. Do not reproduce a superseded version — the forms have been revised more than once since 2021.
Adoption
This manual is adopted as the PAIA Manual of Vowels Africa (Pty) Ltd t/a RemMed SA, registration number 2025/722562/07, with effect from 4 August 2026.
| Information Officer | Yaseen Samsodien |
|---|---|
| Capacity | Information Officer and head of the private body |
| Information Regulator registration | 2026-063725 |