BASELINE PAIA Manual

Prepared for section 51 of the Promotion of Access to Information Act 2 of 2000, as amended.

Version: baseline-paia-2026-10-10-v5 Compilation and revision date: 10 October 2026 Status: Factual completion verified - public release candidate

This manual follows the Information Regulator's Private Body PAIA Manual Template. It distinguishes verified administrative and development/test activity from records generated when the paid service operates. It does not claim independent legal approval, production activation or completed provider-contract/transfer review. It does not amend existing client consent wording.

1. Abbreviations

PAIA: Promotion of Access to Information Act 2 of 2000. POPIA: Protection of Personal Information Act 4 of 2013. IO: Information Officer. DIO: Deputy Information Officer. Regulator: Information Regulator of South Africa.

2. Purpose and business scope

The manual identifies BASELINE's access-to-information contact, record categories, processing purposes and intended recipients. It explains how to request records and where to obtain the official PAIA Guide.

The supplier is Shannon Smuts, a sole proprietor trading as BASELINE. The planned service is online coaching. The assessment remains R500 for a 60-minute consultation and the agreed written assessment. Coaching is not delivered through walk-in appointments at the correspondence address. Paid booking and checkout activation remain disabled in the public release candidate.

3. Key contact details

Head of the private body and registered Information Officer: Shannon Smuts. Trading name: BASELINE. Public telephone: 064 757 6648. Public email and PAIA contact: howzit@baselineathletics.co.za. Approved administrative/legal-service address: 9 Link Road, Port Alfred, 6170. Website: https://baselineathletics.co.za/.

The public supplier record identifies Shannon Smuts. A private read-only check of the retained registration PDF matched that name and registration wording; no registration identifier or private contact details are reproduced here.

Postal and administrative/legal-service correspondence address: 9 Link Road, Port Alfred, 6170. Post can be received here. Supervised PAIA inspection is permitted by prior appointment during weekday business hours, subject to estate access arrangements; contact the IO using the public telephone or email to agree a time and access. The address is for administration and PAIA access; coaching is delivered online only. Fax: none. No Deputy Information Officer has been designated; requests go to Shannon Smuts.

4. PAIA Guide and practical requests

The Regulator's Guide explains access rights, requests, assistance, decisions, fees and remedies. The following official electronic Guides are available in English, Afrikaans and isiXhosa. Contact the IO for help finding the Guide or completing a request. English and isiXhosa are selected for local Guide inspection copies. The official PDF files have been prepared for local inspection; this is not confirmation that printed copies are already placed at the address. Contact the IO to arrange supervised access and copies. Afrikaans remains available through the official web link.

Official PAIA page: https://inforegulator.org.za/paia/ English official PAIA Guide (PDF) Afrikaans official PAIA Guide (PDF) isiXhosa official PAIA Guide (PDF) Regulator enquiries: enquiries@inforegulator.org.za; 010 023 5200.

Requesting a BASELINE record

  1. Obtain Form 2 from the official PAIA page. Address the completed request to Shannon Smuts at howzit@baselineathletics.co.za, with subject "PAIA access request".
  2. Identify the requested record, your contact details and the right being exercised or protected; explain why the record is required. Specify the preferred access format and decision notification method. Provide evidence of authority if acting for another person.
  3. Request assistance if completing the form is difficult. Identity/authority must be verified before confidential records are disclosed. Do not send unrelated health details, passwords or payment-card information with a general enquiry.
  4. A decision is ordinarily due within 30 days. PAIA permits a qualifying extension, with notice. The IO will communicate the outcome, applicable grounds and any prescribed fees. A support acknowledgement aim does not replace this statutory period.
  5. Access remains subject to PAIA's requirements, third-party protection and lawful refusal grounds. Prescribed request/access fees and exemptions must be applied to the actual request; this manual does not invent a fee schedule.
  6. A refusal or failure to respond may be challenged through the Regulator using Form 5, or the applicable court route. PAIA's public-body internal appeal procedure is not presented as a compulsory BASELINE procedure. Consult the Guide for deadlines and the correct remedy.

Form 2 (request), Form 3 (outcome/fees) and Form 5 (complaint) are linked on the official PAIA page. Electronic links were checked on 10 October 2026. The BASELINE manual is in English. Linking the Regulator's translations does not claim BASELINE provides translation or Braille services.

5. Records available without a formal PAIA request

The approved public release candidate contains service descriptions, the R500 assessment offer, public business contact details and these six policy pages:

These documents are intended to be freely accessible on publication, together with the completed manual. The reviewed candidate is not evidence that the replacement website has been published. They can be identified in a request to the public email contact. Internal drafts/gap registers, private registration evidence, credentials and client/coach records are not public website content. Public access to the manual does not make private records automatically available.

6. Records associated with legislation

PAIA: the manual, IO/access arrangements and access request/decision records when created.

POPIA: the retained IO registration evidence, privacy and consent documents, processing/security documentation, and rights-request/consent records when created.

Electronic Communications and Transactions Act 25 of 2002: electronic supplier/contact/service disclosures and electronic transaction records when transactions are enabled.

Consumer Protection Act 68 of 2008: the approved service and cancellation/refund terms address consumer transactions and preserve applicable statutory rights. This is not a claim that every provision applies to every transaction.

The verified supplier is not VAT registered. No VAT registration number, company register, employee register or professional practice number is invented. Real accounting/tax, personnel and professional records are not asserted to exist on the basis of software capability. Where such records are actually created or held, applicable obligations and lawful access restrictions govern them. No general entitlement to every record is implied by this list.

7. Subjects and categories of records

The categories below separate verified current administrative records, fictitious development/TEST records and records generated when paid services operate. They do not assert that real client health records, live transactions or employment records already exist. Records may be held by BASELINE, its application, Bookem, Yoco or domain email; they are not all held in Firebase.

A. Client and coaching

Current: service descriptions, questionnaire definitions and approved consent/policy versions. Development/TEST: fictitious identities, intake/questionnaire submissions, consent histories, assessment drafts, private coach notes, immutable published assessments and implemented programme drafts/versions where used in rehearsal.

Paid operation: protected identity/contact and coach assignment records; consensual intake/health/training information; consent version/time evidence; assessment drafts and private notes; coach-approved assessment and training-plan publications, revisions and history. Clients receive authorised publications; unpublished drafts and coach-private notes remain restricted. GLP-1 programme onboarding has an additional implementation gate; an assessment does not establish programme readiness. Uploads/recording remain inactive in this MVP.

B. Appointments and communications

Current: Bookem service/reminder/notification configuration and domain/mailbox administration records. Development/TEST: fictitious booking, reservation, cancellation and reminder/confirmation email histories evidenced in retained provider records.

Operation: Bookem bookings, confirmations, reminders and service correspondence; email enquiries/messages when received, held in the domain email system; minimised application notification status if its separate notification service is activated. Providing an email address does not prove a particular enquiry has already been received.

C. Financial

Current: pricing/payment/invoice setup and merchant administration evidence. Development/TEST: Bookem test invoices and Yoco TEST payment/cancellation histories; no real funds are inferred. The separate private R50 test service has no booking/invoice created in the retained setup evidence.

Paid operation: Bookem invoices and associated accounting/booking references; Yoco transaction/payment/refund records and provider communications. Refund capability is not evidence of an existing refund. No external accounting ledger or issued real invoice is asserted without evidence. Records required by applicable tax/accounting law arise where the corresponding transactions occur.

D. Business and compliance

Current: supplier/public contact approvals, IO registration evidence, privacy/service/retention documents, PAIA preparation and access arrangements, consent-version administration, provider setup records, operational plans, source/configuration, release manifests and validation evidence. Public provider terms are reference documents; possession of their text is not proof of an executed supplier agreement.

Development/TEST: fictitious security/access, notification and lifecycle evidence and preserved review exports/backups. Operation: access requests/outcomes, privacy/consent records, actual supplier agreements where entered into, security/retention/disposal and backup records as implemented and activated. Nothing here asserts completed certifications, contracts or legal review.

E. Personnel and contractors

The evidence reviewed does not establish current employment files, payroll or contractor engagement records. Owner/IO and authorised project/provider administrator identities are business administration records, not proof of employment or a contractor agreement. Personnel/contractor identity, engagement and payment records are conditional future categories only if people are employed or contracted and such records are actually created. Applicable obligations must be mapped when that happens.

8. Processing of personal information

8.1 Purposes

Current documented purposes include business administration, IO registration, domain/mail hosting, supplier/provider setup, and fictitious provider/application testing. The public howzit mailbox is established by retained configuration and current mail routing; existing enquiry contents were not inspected. The planned replacement website offers enquiry contact links, with paid bookings disabled.

Planned paid-service purposes are protected identity/access, consensual assessment/coaching, appointment/payment administration, delivery of approved client material, service communications, consent and financial records, privacy-rights handling, retention and security. Health information is not intended for unrelated marketing or public analytics.

8.2 Data subjects and information categories

Current evidence: proprietor/IO and authorised project/provider administrators - names, roles, approved contact details and administrative registration/setup evidence. Fictitious local/provider test clients have identity, booking, TEST invoice/payment, assessment and communication records. No real paid-client health record or personnel relationship is inferred from these fictitious and administrative records.

Planned: enquirers - contact details and message content; clients - identity/contact, booking/payment references, consent and supplied health/training information; coach - identity, authority and access records; suppliers/operators - business contacts and relevant arrangements. Personnel/contractor information is a conditional future category only if such relationships arise.

8.3 Recipients and service providers

Current website and domain email: Register Domain SA. Retained cPanel/mailbox evidence and current public DNS agree: Register Domain nameservers, RDSA mail exchangers and the retained apex address. This supports identifying Register Domain as the provider; DNS alone does not prove mailbox forwarding, message custody or backup locations. Hosting involves public site files, request/network metadata, mailbox addresses and any message content received. The provider privacy policy covers logs and email transport; it is not a readback of BASELINE's log settings.

Existing Google/Firebase/Cloud Run infrastructure and administrative/authentication preparation are documented. The production product contract selects a gated Cloud Run acceptance host; the final public app front door is deferred. Historical Firebase Hosting proposals do not establish that the paid app is publicly deployed. Protected identity, health intake, assessments and client/coach workspaces remain gated for real paid use.

Bookem and Yoco: established account/configuration and retained fictitious TEST booking, invoice, payment-status and communication records. Planned real processing covers appointment/contact/service and hosted payment details. The BASELINE application has no card collection endpoint. Public online assessment booking remains disabled; the private R50 service does not activate real payments.

Resend: prepared notification adapter, first acceptance OFF. If activated, it would receive recipient email and minimal protected-link/notification content, not health answers. It is distinct from the current domain mailbox and Firebase Authentication's email service.

Shannon/authorised coach and the client receiving their own approved material are planned product recipients. No accountant, employment administrator or additional contractor is invented. Real health-data AI processing, file uploads and recording/transcription remain inactive. A provider advertising an AI feature does not establish that BASELINE uses it.

8.4 Known locations and planned cross-border flows

Register Domain SA: its shared-hosting documentation states servers are in South Africa. Current DNS and retained hosting evidence support that provider identification. Exact mailbox/spam-filter/backup countries and any forwarding destinations are not established, so no all-South-Africa claim is made.

Google: the BASELINE runtime manifest selects africa-south1 (Johannesburg, South Africa) for Firestore/backend processing. This is selected configuration plus retained infrastructure evidence, not a fresh live readback. Firebase's official privacy documentation explicitly places Firebase Authentication processing in the United States. Planned authentication data includes email/account identifiers, IP address and user-agent/security metadata; health intake belongs in the protected database, not Auth. Other non-region-selected Google services can use global facilities.

Bookem: its published privacy policy, dated 25 June 2021, states that information supplied from outside the EU is transferred to and processed in the EU. Categories include account/contact and booking/transaction data. Its security article describes AWS S3 storage and geographically separate backups but names no specific country. Do not substitute an AWS region or claim the whole service is South African.

Yoco: its officially linked January 2024 PAIA manual lists possible processing destinations: South Africa, EU/Netherlands, Egypt, United States, United Kingdom, Ireland and Australia. These are provider-declared possible locations, not proof every BASELINE record goes to each. Merchant/account information is current; real customer payment processing is planned. The account's exact processing/backup path is not established here.

Resend: its DPA states primary processing is in the United States. The current subprocessor list identifies US providers, including hosting/sending services. If activated, cross-border categories would be minimised email/notification data. Subprocessor listing does not mean BASELINE uses every listed feature or sends health data to those companies.

Published Google/Resend processing terms and Bookem/Yoco privacy/security statements supply useful evidence. They do not, by themselves, prove account-specific contract acceptance or completed POPIA transfer review. Those operational safeguards remain an activation verification task; no implemented safeguard is manufactured in this manual.

8.5 Technical information-security measures

Current local evidence establishes protected application checks for verified identity/revocation, canonical account ownership, coach assignment, consent and explicit human publication. Production Firestore rules deny browser access. Local rehearsal records and preserved exports are separate from public release output.

Prepared production controls include server-side access enforcement, restricted service identities, server-only secrets without credential files, bounded requests, minimised notifications and independent lifecycle/maintenance fencing. The retention design includes supervised disposal and a rolling backup model. Configuration and tested mechanisms are not proof that production IAM, secret bindings, backup schedules, monitoring or operational restore controls have been activated.

Missing trust/activation prerequisites fail closed in the prepared launch path. The public release contains no health intake or card collection form. No certification, independent security audit, completed operator agreement, absolute deletion guarantee or implemented worldwide transfer safeguard is claimed.

9. Availability and inspection

The public release candidate provides this manual in accessible HTML and downloadable PDF. On website publication it will be freely available at https://baselineathletics.co.za/policies/paia-manual/. A copy can be requested from the IO at the public email/telephone, and supplied to the Regulator on request.

Supervised PAIA inspection at 9 Link Road, Port Alfred, 6170 is permitted by prior appointment during weekday business hours, subject to estate access arrangements. Contact the IO before attending to agree the time, access and the requested format. This administrative access is separate from online-only coaching; there are no coaching walk-ins.

English and isiXhosa official Guide PDFs have been prepared for local inspection. Printed-copy placement is not yet represented as complete. Request the Guide/manual or assistance arranging inspection/copies from the IO. Official English, isiXhosa and Afrikaans electronic Guide links remain available in section 4.

Applicable prescribed reproduction/access fees and exemptions follow the PAIA regulations; the electronic public manual is free. No invented fee or in-house translation/Braille capability is claimed. Indicate a preferred accessible format when making the request so the IO can assist.

10. Updating and issue

Shannon Smuts, head and registered Information Officer of BASELINE, is responsible for maintaining the manual as contacts, records, recipients and operations change. Version baseline-paia-2026-10-10-v5 was factually completed on 10 October 2026 using confirmed owner arrangements and reviewed system/provider evidence. It is prepared for owner publication approval; neither publication nor independent legal approval is claimed.

The six approved policy URLs and consent version baseline-mvp-2026-10-05-v2 are preserved. This manual does not activate paid booking, health processing or provider services.

Official references

PAIA Guide and request forms. Private Body PAIA Manual Template. Register Domain hosting and privacy. Firebase processing and security. Bookem privacy and security/backups. Yoco official legal documents. Resend processing terms and subprocessors.

Download the PAIA Manual (PDF)