PAIA manual

The details · Last updated 1 November 2026

About this manual

This is the manual that section 51 of the Promotion of Access to Information Act 2 of 2000 (PAIA) asks every private body to publish. Fertility with Kara is a private body because Kara Raubenheimer runs it as a sole proprietor.

The manual explains:

• what records we keep, and which ones you can see without asking;
• how to ask for a record that isn’t published, what it may cost and how long it takes;
• when the law lets us, or makes us, refuse a request, and what you can do if you disagree;
• how we use personal information, as the Protection of Personal Information Act 4 of 2013 (POPIA) requires.

PAIA gives you the right to a record held by a private body when you need it to use or protect one of your rights (section 50). If you only want to know what personal information we hold about you, you don’t need the full procedure: see Your own information below.

Contact details

Kara Raubenheimer is the head of Fertility with Kara under PAIA. Because the business is a sole proprietorship, she is also its Information Officer under POPIA. There is no Deputy Information Officer.

• Name: Kara Raubenheimer, trading as Fertility with Kara
• Street address: 412 Friesland Lane, Lynnwood, Pretoria, 0081
• Postal address: 412 Friesland Lane, Lynnwood, Pretoria, 0081
• Phone: +27 84 402 5272
• Email: kara@fertilitywithkara.com
• Fax: none
• Website: fertilitywithkara.com

Please send requests for records, and questions about this manual, to the email address above. We handle requests in writing, by email or post.

The Regulator’s guide to PAIA

The Information Regulator has published a guide on how to use PAIA and POPIA (section 10 of PAIA). It explains, in plain language:

• what PAIA and POPIA are for;
• how to ask a public or private body for a record, and in what form;
• the help you can get from the Regulator;
• the remedies you have if a request is refused or not answered, including a complaint to the Regulator and an application to court;
• the fees, and the rules on records that bodies publish without a request.

You can read the guide in English on the Regulator’s website, where it is also available in the other official languages and in braille. If you would like a copy from us, email us and we will send you one.

Records we hold

These are the subjects we keep records on, and the kinds of record in each.

Website content

• The articles, videos, frequently asked questions and other pages of this website, and earlier versions of them.
• The free Starter Guide and the sources behind our articles.

Ebook sales

• For each order: the buyer’s name and email address, the book bought, the price, the date, the version of the terms of sale agreed to and when, PayFast’s payment reference and whether the payment went through.
• A record of each download: which book and when.
• The ebook files themselves, kept in private storage.

An order that is never paid is deleted automatically after 30 days.

Course enrolment

• For each enrolment in The Embryology Course with Kara: the reader’s name and email address, the date of enrolment and whether access was paid for or given free.
• Course orders: the amount, the dates, when the checkout consent was given, PayFast’s payment reference and whether the payment went through. An unpaid course order is deleted automatically after 30 days.
• If the reader sets a password, a scrambled (salted and hashed) version of it. We never keep the password itself.
• Single-use sign-in links, which expire after 30 minutes, or three days for the link in the welcome email.
• Counters of sign-in, password and checkout attempts, by email address or IP address, which are deleted after an hour.

Course progress, quiz scores and the name on a certificate are stored only in the reader’s own browser. We hold no record of them.

Mailing lists

• For the newsletter, the free Starter Guide, the ebook waiting list and the video launch list: the email address, the first name if one was given, which list it is, the confirmation that the person agreed to receive emails, and the date and time of signing up.

Contact messages and email

• Messages sent through the contact form: name, email address, topic, message, and the date and time.
• Our email correspondence with readers, buyers and suppliers, including our replies.

Financial and tax records

• Sales and payment reports from PayFast, invoices, receipts, bank statements and records of business expenses.
• Income tax returns and correspondence with the South African Revenue Service (SARS).

Suppliers

• The terms, data processing agreements and account and billing records for the services we use: PayFast (payments), Cloudflare (hosting, storage and sending email) and Google Workspace (our email inbox).

Books, course and professional records

• Drafts, artwork and source files for the ebooks, the course and the videos.
• Kara Raubenheimer’s registration with the Health Professions Council of South Africa (HPCSA) and her qualifications.

Legal and compliance records

• This manual, the privacy policy, the terms of sale, the terms of use and the medical disclaimer, with earlier versions.
• Requests made under PAIA and POPIA, and how we answered them.

Records you can get without a request

You don’t need to make a PAIA request for these. They are free to read on this website (section 52 of PAIA):

• the articles, videos, frequently asked questions and resources;
• the privacy policy, terms of sale, terms of use, medical disclaimer and this manual;
• the description, contents and sample pages of each ebook in the shop;
• the free Starter Guide, which we email to you when you sign up for it;
• Module 1 of The Embryology Course with Kara, which anyone can read before enrolling.

If you can’t use the website, email us and we will send you a copy of any of these free of charge.

Records kept under other laws

We keep some records because another law requires them. Listing a record here doesn’t mean that anyone may see it: access is still decided under PAIA or under the law concerned.

• Income Tax Act 58 of 1962: income tax returns and the records behind them. As a sole proprietor, Kara Raubenheimer is taxed personally on the business’s income.
• Tax Administration Act 28 of 2011: the records, books of account and documents behind each tax return, which section 29 requires us to keep, generally for five years from the date the return is submitted.
• Value-Added Tax Act 89 of 1991: VAT records, if and while the business is registered for VAT.
• Electronic Communications and Transactions Act 25 of 2002: the seller details and terms that section 43 requires an online seller to show, published in our terms of sale.
• Protection of Personal Information Act 4 of 2013: records of the consent people gave to receive our emails, and of requests to see, correct or delete personal information or to object to its use.
• Promotion of Access to Information Act 2 of 2000: this manual and records of requests made under it.
• Health Professions Act 56 of 1974: Kara Raubenheimer’s HPCSA registration.

How to ask for a record

1. Download Form 2, Request for access to a record, from the Information Regulator’s website.
2. Fill it in. The form asks you to say which record or records you want and who you are, how you would like to receive them (for example a copy by email), a postal address or fax number in South Africa, and how else you would like to hear our decision. You must also say which right you want to use or protect, and explain why you need the record for it (section 53 of PAIA). If you ask on behalf of someone else, include proof that you may act for them.
3. Email the form to kara@fertilitywithkara.com, or post or deliver it to 412 Friesland Lane, Lynnwood, Pretoria, 0081.

If a fee applies, we will tell you in writing before we go further (see Fees). We will decide and tell you our decision as soon as reasonably possible, and within 30 days of receiving your request, or of receiving any details missing from it (section 56).

We may extend that period once, by up to 30 more days, if the request is for a large number of records, if we need to consult someone else before deciding, or if you agree in writing. We will tell you within the first 30 days, with the reasons (section 57). If a record is about another person or business, the law may require us to tell them and give them a chance to respond before we decide, which takes longer (section 71).

If we don’t give a decision in time, the law treats your request as refused (section 58). If we can’t find a record, or it doesn’t exist, we will tell you so in an affidavit that explains how we searched (section 55).

Your own information

Under POPIA you can ask us, free of charge, whether we hold personal information about you (section 23). Email us with proof of your identity and we will tell you, and give you a copy or a description of the information, including who has had access to it, within a reasonable time. If a fee is allowed for the copy, we will give you a written estimate first.

You can also ask us at any time to correct or delete your information (section 24), or object to our using it (section 11(3)). Email us, or use Form 2 (for correction or deletion) or Form 1 (for an objection) under the POPIA Regulations, which are on the Regulator’s website. Our privacy policy explains more.

Fees

The PAIA Regulations set the fees that a private body may charge, and say when no fee applies. There are two kinds:

• A request fee, which we must ask you to pay before we process a request, if one is prescribed (section 54(1)).
• An access fee, if we grant the request, to cover copying, any postage and the time needed to find and prepare the record beyond the hours the Regulations allow (section 54(6) and (7)).

If finding and preparing the record will take longer than the prescribed hours, we may ask for a deposit of up to one third of the access fee. We repay the deposit if your request is refused (section 54(2) and (4)). We may keep a record back until the fees are paid (section 54(5)).

Whenever we ask for a fee or a deposit, we will tell you the amount in writing, and that you may complain about it to the Information Regulator or apply to a court (section 54(3)). The only fee for a record that is published without a request is a prescribed fee for copying it (section 52(3)).

When we may refuse

PAIA lists the only grounds on which a private body may refuse a request (sections 62 to 70). In some cases we must refuse; in others we may. Briefly, a request can be refused if giving the record would:

• unreasonably reveal personal information about another person, including someone who has died (section 63);
• reveal another person’s or business’s trade secrets, or financial, commercial, scientific or technical information that would likely harm them, or information they gave us in confidence (section 64);
• break a duty of confidence that we owe someone under an agreement (section 65);
• endanger someone’s life or physical safety, or put at risk the security of a building, property or computer system (section 66);
• reveal a record that is privileged from production in legal proceedings, unless the privilege has been waived (section 67);
• reveal our own trade secrets, or financial, commercial, scientific or technical information that would likely harm the business, or information that would put us at a disadvantage in negotiations or competition, or a computer program we own (section 68);
• reveal information about research being done by another person or by us, where that would seriously disadvantage the research or the people doing it (section 69).

Even so, we must give access if the record would reveal evidence of a serious breach of the law, or of an imminent and serious risk to public safety or the environment, and the public interest in disclosure clearly outweighs the harm (section 70). If only part of a record has to be refused, we give you the rest (section 59).

If we refuse, we will tell you why and which sections we rely on, without revealing what the record contains, and explain how you can complain or apply to court (section 56(3)).

If you disagree with our decision

There is no internal appeal for a private body. If you disagree with a refusal, a fee, the form of access or an extension of time, you can, within 180 days of our decision:

• complain to the Information Regulator on its complaint form (section 77A); or
• apply to a court for relief (section 78).

The same applies if we don’t answer in time, because that counts as a refusal. If you are another person or business whom a record concerns, you can also complain or apply to court about our decision to give access.

The Information Regulator

• Website: inforegulator.org.za
• PAIA complaints: PAIAComplaints@inforegulator.org.za
• General enquiries: enquiries@inforegulator.org.za
• Phone: 010 023 5200 or toll-free 0800 017 160
• Street address: Woodmead North Office Park, 54 Maxwell Drive, Woodmead, Johannesburg, 2191
• Postal address: P.O. Box 31533, Braamfontein, Johannesburg, 2017

How we use personal information

Section 51 of PAIA also asks for a short description of how we process personal information under POPIA. Our privacy policy gives the full detail.

Why we process it

• To sell and deliver the ebooks and the course: taking orders, confirming payments, sending download links and sign-in links, and dealing with questions and refunds.
• To send the free Starter Guide, the newsletter and news about the ebooks, the course and new videos to people who asked for them.
• To read and answer messages sent through the contact form or by email.
• To keep the financial and tax records the law requires.
• To protect the website and the course from abuse, for example by limiting how often a form can be sent.

Whose information, and what information

• Ebook buyers: name, email address, what they bought, payment reference and status, and download dates.
• Course readers: name, email address, enrolment and order details, and a scrambled version of their password if they set one.
• People on our mailing lists: email address, first name if given, which list, and the record of their consent.
• People who contact us: name, email address and whatever they write in their message. We ask people not to send health details; if they do, we use them only to reply.
• Suppliers: contact and account details of the businesses we buy services from.

We don’t collect card or bank details: you enter them on PayFast’s own payment page. We don’t knowingly collect information about children.

Who receives it

• PayFast receives the buyer’s name and email address and the order, to take the payment.
• Cloudflare hosts the website and the course and stores the orders, enrolments, mailing lists and contact messages. Cloudflare Email Sending sends our download, sign-in and Starter Guide emails.
• Google Workspace holds our email inbox, where contact messages, notices of course sales and email correspondence arrive.
• SARS and other authorities, where the law requires it.

We don’t sell or rent personal information to anyone.

Information sent outside South Africa

Cloudflare runs data centres around the world, including outside South Africa, so information on the website and the course may be stored or processed in other countries. Google may also store our email outside South Africa. We use these providers under their data processing terms, which commit them to protect personal information to a standard similar to POPIA’s (section 72 of POPIA).

How we keep it safe

• The website and the course use encrypted connections (HTTPS).
• Card and bank details are handled by PayFast and never reach us.
• Passwords are stored only as salted hashes, so nobody, including us, can read them back.
• Download links and sign-in links are long random codes that expire, and the ebook files are kept in private storage that can’t be reached without a valid link.
• Forms are limited in how often they can be sent, to stop automated abuse.
• Unpaid orders are deleted automatically after 30 days.
• The accounts that hold the information are protected by sign-in.

If we believe someone has accessed personal information without permission, we will tell the Information Regulator and the people affected as soon as reasonably possible (section 22 of POPIA).

Getting a copy and updates

This manual is available:

• on this page;
• by email, free of charge, if you ask us;
• for inspection at our street address during normal business hours, if you arrange a time with us first;
• to the Information Regulator, on request.

We review this manual at least once a year, and whenever what we do with records changes. The date at the top shows when it was last updated.