This page explains how your personal and health information is collected, stored, and protected when you engage in nutrition care with Stephanie Rouillard, Registered Dietitian (DT 0051179).

Purpose of this agreement

As part of your nutrition consultation, I need to collect and process information about your health, medical history, lifestyle, and dietary habits. This information is used exclusively to provide personalised nutrition care and monitor your progress.

Your data is treated as special personal information under South Africa's Protection of Personal Information Act (POPIA) and is handled in accordance with HPCSA confidentiality and record-keeping guidelines, including the updated Booklet 20: Ethical Guidelines on the Use of Artificial Intelligence (November 2025).

How your information is processed

1. Collection and Use

Your personal and health information is collected via a secure Google Form and used only for clinical assessment, nutrition planning, progress monitoring, and communication related to your care.

2. Storage and Security

All information is stored digitally on encrypted systems. Access is restricted to authorised personnel only. The following platforms are used in the management of your care:

• Google Workspace — intake forms, email communication, and document storage
• Granola — clinical session notes
• Notion — secure record organisation and practice management
• NutriDash — a custom-built patient dashboard for session preparation, clinical summaries, therapeutic plan management, and recipe generation (hosted on Vercel with database services provided by Supabase; accessible only to the treating dietitian)
• Zoho Invoice — invoicing and billing
• WhatsApp Business — patient communication (messages are treated as confidential clinical correspondence)
• Shopify — meal plan product purchases and digital delivery (transactional data only; no health information is stored on Shopify)

Laboratory and testing data from third-party providers (including DNAlysis/3X4 Genetics, Biometrix Labs/GI-MAP, and InBody) is received, interpreted, and stored in accordance with HPCSA and POPIA requirements. Test results are retained as part of your clinical record.

3. Transcription and Note-Keeping

To ensure accurate and compliant clinical documentation, consultations may be recorded and securely transcribed using WhisperFlow, a confidential AI-powered transcription tool.

• Audio and text data are processed solely for note-keeping and record-keeping purposes in line with HPCSA standards.
• Transcripts and recordings are encrypted and accessible only to the treating dietitian (and authorised assistants, if applicable).
• No information is shared or used for secondary purposes such as marketing or analytics.
• Transcriptions are stored for the same duration as clinical records and then permanently deleted.

By engaging in consultations, you consent to the use of transcription technology for these limited clinical documentation purposes.

4. Use of AI-Assisted Tools in Your Care

Stephanie Rouillard uses AI-assisted tools to support specific clinical and administrative tasks within the practice. These tools are used to enhance efficiency and personalisation of care — they do not replace clinical reasoning, professional judgement, or accountability, which remain with the treating dietitian at all times. All clinical outputs generated with AI assistance are authored, reviewed, edited, and finalised by the dietitian before being applied to your care.

Clinical tasks where AI assists the dietitian:

• Session note-keeping — extracting and structuring clinical information from consultation transcripts, which the dietitian then reviews and edits
• Therapeutic plan preparation — generating draft components of your plan based on your health profile, diagnoses, and goals, which the dietitian reviews, clinically edits, and finalises before sharing with you
• Recipe generation — producing recipe options aligned with your dietary requirements, intolerances, and clinical parameters, which the dietitian reviews before including in your plan
• Macro target calculation — assisting with nutritional calculations based on your clinical needs, which the dietitian verifies clinically
• Supplement interaction analysis — flagging potential interactions between your current medications and proposed supplements for the dietitian's clinical review
• Session preparation — drafting session prep notes from your health history, previous session data, and logged information, which the dietitian reviews before each consultation

Administrative AI uses include:

• Email triage and categorisation (sorting incoming emails by type, e.g. booking requests, supplier correspondence, general enquiries)
• Drafting administrative email responses (e.g. confirming appointments, responding to general enquiries)
• Invoicing and payment follow-ups

Tool selection and clinical oversight. The AI tools used in this practice are enterprise platforms selected for their security standards, contractual data protections, and clinical suitability. They are not free or consumer-grade public AI tools. AI-generated outputs are treated as drafts and analytical inputs to clinical decision-making — never as clinical decisions in themselves. Every AI-assisted clinical output is reviewed and clinically validated by the treating dietitian before being applied to your care, in line with HPCSA Booklet 20 (Ethical Guidelines on the Use of Artificial Intelligence) and HPCSA Booklet 9 (Seeking Patients' Informed Consent).

Understanding AI limitations. AI-assisted tools can occasionally produce inaccurate, incomplete, or biased outputs. This is precisely why every AI-generated clinical output is reviewed and clinically validated by your dietitian before being used in your care. AI tools are used to support clinical work — they do not replace it.

Important safeguards:

• All AI-generated clinical content is reviewed and approved by the treating dietitian before being applied to your care. AI tools assist with drafting and analysis — final clinical decisions are always made by your dietitian.
• All AI-assisted administrative outputs (e.g. drafted email responses) are reviewed and approved by the treating dietitian before being sent. No automated communication is ever sent without prior human review.
• For administrative email processing, clinical and health-related email content identified by the practice is handled directly by the treating dietitian and is not processed by AI tools.
• The AI service provider (Anthropic) processes data under API terms that prohibit the use of submitted data for model training. Data is processed transiently and is not retained beyond the immediate request.
• AI-assisted tools process data on servers outside South Africa (United States). The same cross-border safeguards described in Section 6 apply.
• The treating dietitian remains fully accountable for all clinical decisions and communications, in accordance with HPCSA Booklet 20.

Information you log via the NutriDash patient portal (including diary entries, symptom logs, and goal tracking) is used to support session preparation and may be processed by AI tools as described above.

Your right to opt out. You may request, at any time, that no AI-assisted tools be used in any aspect of your care or communication. This will not affect your access to care. If you opt out partway through your care, AI-generated outputs that have already been clinically reviewed and incorporated into your records will remain part of your clinical record (as is the case for any clinical documentation), but no further AI-assisted processing will occur. To opt out, please notify the practice in writing at contact@headoverhealth.info.

5. Sharing of Information

Your data will never be shared with third parties without your explicit consent, unless required by law or in a medical emergency.

If you request that your information be shared with another healthcare provider, this will be done only with your written consent.

6. Cross-border Storage

Some service providers store or process data on secure servers outside South Africa. These include:

• Google (United States)
• Notion (United States)
• Granola (United States)
• WhisperFlow (United States)
• Anthropic / Claude API (United States) — clinical and administrative AI processing. Patient health information including diagnoses, dietary data, and session context is processed transiently for care-related purposes as described in Section 4. Data is not retained or used for model training.
• Supabase (United States — AWS infrastructure) — database services for the NutriDash patient dashboard
• Vercel (United States) — hosting for the NutriDash patient dashboard
• Zoho (United States / India)
• Shopify (Canada / United States) — transactional data only
• DNAlysis / 3X4 Genetics — samples and reports processed domestically (South Africa)
• Biometrix Labs / GI-MAP — samples shipped to Diagnostic Solutions Laboratory (United States) for analysis

All cross-border providers maintain international privacy and security standards. Patient health information is processed by the AI service provider (Anthropic) transiently for clinical care purposes as described in Section 4 — the provider does not retain, store, or use this data for any other purpose, including model training. For administrative email processing, clinical and health-related content is identified and handled directly by the treating dietitian.

By consenting, you authorise this secure cross-border storage and processing, including the transient processing of health information for clinical care purposes.

7. Retention & Deletion

Records are retained for a minimum of six (6) years after your last consultation, in line with HPCSA record-keeping guidelines, after which they are securely deleted or anonymised.

Administrative logs relating to AI-assisted processing are retained for the same minimum period of six (6) years for compliance and audit purposes.

8. Your Rights

You have the right to:

• Access and review your records
• Request correction or deletion of inaccurate information
• Withdraw consent for processing (where legally permissible)
• Request that AI-assisted tools are not used in your care or communication
• Request information about what AI-assisted tools are used and how they process your data
• Lodge a complaint with the Information Regulator if you believe your data has been misused

Complaints & Contact

If you have any questions, wish to exercise your POPIA rights, or wish to opt out of AI-assisted processing, please contact:

Stephanie Rouillard: contact@headoverhealth.info

If you are not satisfied with the response, you have the right to lodge a complaint with:

Information Regulator (South Africa): inforeg@justice.gov.za | 010 023 5207 | https://inforegulator.org.za

Next step

Once you have read and understood this agreement, please return to the intake form and tick the consent box to confirm your acceptance.

This Privacy & POPIA Consent Agreement was last updated in May 2026 and may be updated periodically to reflect changes in practice, technology, or legislation.