Key points
- The City of Johannesburg counted 4,803,262 people at Census 2022, and 10.8% of them were born outside South Africa.1
- Gauteng had 3.63 million medical aid members in 2024, 21.3% of its people and more than any other province.2
- POPIA section 21 requires a written contract making any operator, software providers included, keep the section 19 security measures and report a compromise immediately.3
- HPCSA Booklet 9 keeps records for at least six years after they become dormant, and no entry may be removed from a health record.6
- wai drafts, a person at the practice approves and sends, the doctor signs, and records stay in South Africa.
Summary
A Johannesburg practice can use AI to draft notes and patient replies in 2026, with a written POPIA operator contract, records kept to HPCSA Booklet 9, the doctor signing every note and records hosted in South Africa. The Information Regulator, based in Woodmead, enforces POPIA.
Johannesburg practices now answer every WhatsApp and missed call the same afternoon, in the language the patient used, and doctors finish with every note signed and every medical aid claim ready to check. wai drafts the replies, the notes and the claims, a person at the practice approves or signs each one, and the records stay in South Africa.
Part of the HPCSA and OHSC hub, with the framework explained, a readiness checklist and 7 guides.
See it in your clinicThirty minutes on your own patients and doctors.
Request a demoSee a missed call from Soweto become a drafted text, and a Sandton specialist's note and medical aid claim prepared from the consult, in fifteen minutes.
| Body or law | Rule | What to ask | How wai meets it |
|---|---|---|---|
| HPCSA Booklet 9 | Records kept six years from dormancy, children to age 21 | Can every record be exported | Every record and action exportable |
| HPCSA Booklet 9 | No entry removed, corrections dated and signed | Who signs each note | Every draft, approval and signature logged |
| POPIA s19 | Reasonable technical and organisational safeguards | How is access controlled | Role-based least privilege, AES-256 at rest, TLS 1.3 in transit |
| POPIA s21 | Written operator contract, compromise reported immediately | Is the contract signed before go-live | Contract and named subprocessors, thirty days notice of changes |
| Information Regulator draft health regulations | Rules for schemes, administrators and insurers | Does the pathway touch a scheme or insurer | Data rights agreed in the contract |
The private care market in Johannesburg
Census 2022 counted 4,803,262 people in the City of Johannesburg, up from 4,434,631 in 2011, the largest population in Gauteng.1 At 10.8%, Johannesburg also had the highest share of residents born outside South Africa of any Gauteng district.1
The General Household Survey 2024 found 3.63 million medical aid members in Gauteng, 21.3% of the province, and 67.0% of Gauteng households said they would go first to a public facility, the second lowest share in the country.2 An estimated 1,433,000 Gauteng households said they would go first to a private doctor or specialist, and 267,000 to a private hospital.2
The rules a practice in Johannesburg works under
Doctors register with the Health Professions Council of South Africa, and its Booklet 9 sets the standard for patient records.6 Records are kept for at least six years after they become dormant, children's records until their 21st birthday, and no information may be removed from a health record. A correction is a line through the original entry, dated and signed in full, with the original left legible.6
The Protection of Personal Information Act 4 of 2013 requires the practice to secure the integrity and confidentiality of personal information with reasonable technical and organisational measures, and to keep checking that those safeguards work (section 19).3 Under section 21, any operator processing patient information for the practice, software providers included, must be bound by a written contract to keep those measures, and must tell the practice immediately if it suspects unauthorised access.3
The Information Regulator enforces POPIA from Woodmead North Office Park in Johannesburg.4 In September 2025 it published draft regulations on processing health information by insurers, medical schemes, scheme administrators and managed care organisations, for public comment.5
wai hosts each clinic's records in its own country, under that country's rules. We set this up with your clinic. wai is compliant with these rules and built for clinics in Johannesburg. Every message, draft, approval and signature sits in a log the practice can export.
The languages Johannesburg patients write in
Census 2022 found isiZulu the language most often spoken at home in Gauteng, rising to 23.1% from 19.8% in 2011.1 English fell to 9.2% from 13.3% and Afrikaans to 7.7% from 12.5%, while Sepedi, Sesotho, Setswana and Xitsonga all grew, and Shona reached about 2% in its first count.1
wai works in any language. A patient can answer intake questions by voice in isiZulu, Sesotho or any other language, and the doctor reads the answers in English before the visit.7 Each reply is drafted in the language the patient wrote in and approved by the practice before it is sent.
What a demo shows in Johannesburg
A patient in Soweto calls the Rosebank rooms at 1pm while the GP is with a patient. The missed call becomes a drafted text in her thread, she replies in Sesotho that her blood pressure tablets are running out, and wai drafts a reply with the first open slot from the doctor's busy times in Google Calendar, Outlook or Apple Calendar. Reception approves it within minutes.
In a Sandton specialist's rooms the scribe drafts the note during the consult, the specialist edits and signs it, and the codes and the medical aid claim are prepared from the signed note for the practice to check before submission. See missed-call follow-up for the reply patterns practices use.
For health systems, government and insurers in Johannesburg
The Gauteng Department of Health runs the province's public hospitals and clinics.8 Medical schemes, administrators and hospital groups in Johannesburg work under POPIA and, if adopted, the Regulator's health information regulations.5 wai builds one defined pathway at a time with the organisation's own teams, with records hosted in South Africa and data, configuration and model rights agreed in the contract. See wai for organisations.
Where to start
First, put a section 21 operator contract in place with every provider that touches patient information.3 Second, check record retention against Booklet 9, six years from dormancy and to the 21st birthday for children.6
Third, add the AI line to intake in English, isiZulu and Sesotho, using the consent form template. Fourth, count last month's missed calls and WhatsApp enquiries by hour, then book a Johannesburg demo and bring that count.
Bring a week of Johannesburg missed calls and messages, in every language they arrived in, and see the drafts your reception would approve.
Frequently asked questions
Does a Johannesburg practice need a contract with its software provider under POPIA?
Yes. Section 21 requires a written contract making the operator keep the section 19 security measures and report any suspected unauthorised access immediately.3
How long must patient records be kept?
HPCSA Booklet 9 says at least six years from when the record became dormant, and for children until their 21st birthday.6
Can an AI-drafted note be changed after the doctor signs it?
Booklet 9 says no entry may be removed, and a correction must be dated and signed in full.6 In wai every draft, approval and signature is logged and exportable.
Where is the Information Regulator?
At Woodmead North Office Park, 54 Maxwell Drive, Woodmead, Johannesburg.4
Are there new POPIA rules for medical schemes?
The Regulator published draft regulations on health information processed by insurers, medical schemes, administrators and managed care organisations in September 2025, for comment.5
Who sends the replies wai drafts?
Reception approves every reply before it is sent, and clinical questions go to the doctor.
Sources
- 1Statistics South Africa, 2024Census 2022 Provincial Profile, Gauteng, Report 03-01-76Read 15 October 2026Read source
- 2Statistics South Africa, 2025General Household Survey 2024, P0318Read 15 October 2026Read source
- 3Government Gazette, Republic of South Africa, 2013Protection of Personal Information Act 4 of 2013, ss19 to 21Read 15 October 2026Read source
- 4Information Regulator, 2026Information Regulator (South Africa), contact pageRead 15 October 2026Read source
- 5Information Regulator, 2025Draft regulations relating to the processing of a data subject's health or sex life by certain responsible parties, Government Gazette 53426 (draft for comment)Read 15 October 2026Read source
- 6Health Professions Council of South Africa, 2016Guidelines on the keeping of patient records, Booklet 9Read 15 October 2026Read source
- 7wai, 2026wai changelog, intake answered by voice in any languageRead 15 October 2026Read source
- 8Gauteng Provincial Government, 2026Department of Health, Gauteng Provincial GovernmentRead 15 October 2026Read source
Every Johannesburg patient answered the same afternoon, every note signed and every claim ready before the traffic on Jan Smuts.
Fifteen minutes with a clinician who uses wai daily, on your own enquiries and consults. We reply within one working day.
Partner with us
See it on your own patients, then build it with us
Thirty minutes on your own patients, doctors and rules, in your market. We reply within one working day, and the clinics that partner with us early shape what we build next.
See what wai does between the visits