Privacy notice

Protection of Personal Information Act 4 of 2013 (POPIA). Version 1.0, effective 23 October 2026.

> DRAFT for publication on 23 October 2026. Items marked [VERIFY] must be settled before publication.

1. Who we are

Healthcare App builds software for occupational health, wellness screening and practice bookings. Clinics, practitioners and employers use our platforms to run their services. Healthcare App (Pty) Ltd, registration number 2019/612883/07 ("we", "us") is the responsible party for the personal information described in this notice, collected through https://healthcareapp.co.za, our forms, our systems and our services.

• Information Officer: Tshepo Mokitimi, Chief Executive Officer [VERIFY: Information Officer registration on the Information Regulator eServices portal]
• Contact: info@healthcareapp.co.za (subject line "POPIA"), telephone +27 66 248 6595
• Address: [VERIFY: an address for service must be published here (POPIA s18(1)(b)). Recommended: a PO Box or the CIPC registered office, so that no operating street address is published (group rule of 8 Oct 2026).]

2. What we collect

• Website visitors and enquiries: name, email address, phone number, organisation and your message.
• Customer accounts: the names, work email addresses, roles and professional registration numbers of the clinic, practice and employer users we set up, and their sign-in and audit records.
• Patient and employee records (on behalf of our customers): identity, contact, employment and health information that our customers capture in the platform. For these records the clinic, practice or service provider is the responsible party and we are its operator (see section 3).
• Billing: invoices and payment references. Card details are entered on the payment provider's pages; we never see or store them.

We collect information directly from you, from your employer or the organisation that booked a service for you, and from the practitioners who treat you. We collect only what we need for the purpose (s10).

3. Why we use it and our lawful basis

• To provide and support the software our customers subscribe to (s11(1)(b)).
• To keep the platform secure, including multi-factor sign-in, encryption, audit logs and incident response (s19; s11(1)(f)).
• To answer enquiries and send service notices. We send marketing only if you opted in (s69).
• To keep accounting records (s11(1)(c)).

When a clinic, practice or employer uses Healthcare App to record your health information, that organisation is the responsible party. Healthcare App (Pty) Ltd is its operator under a written operator agreement (s20 and s21). We process those records only on the customer's instructions, never sell them, and never use them for our own marketing. Requests about such a record go to the clinic or practice that treated you; if you contact us, we pass your request on to them within 5 working days.

4. Who we share it with (operators and third parties)

• Amazon Web Services (AWS South Africa (Pty) Ltd): hosting in the Cape Town region (af-south-1). Health records stay in South Africa and are encrypted at rest; ID numbers and clinical notes are encrypted at field level.
• Twilio SendGrid (United States): delivery of service emails.
• Microsoft 365: email and documents.
• Lovable: hosted this marketing website and a legacy screening application until 23 October 2026.
• Payment providers (for example Paystack or PayFast), only for subscription payments.

Every operator processes information only on our instructions, under a written agreement that requires it to keep the information secure and confidential (s20 and s21). We do not sell personal information.

5. Transfers outside South Africa

Service emails (SendGrid) and, until 23 October 2026, this website (Lovable) are processed outside South Africa. We rely on POPIA s72(1)(a) and (b). Health records are not transferred outside South Africa.

6. How long we keep it

• Customer records processed for clinics and practices: kept and deleted according to the customer's instructions and the law that applies to the customer. When a contract ends, data is returned to the customer and then deleted within 90 days, unless the law requires us to keep it.
• Customer user accounts and audit logs: 6 years after the account closes.
• Website enquiries that did not lead to a contract: 12 months.
• Invoices and accounting records: 5 years.

When the retention period ends, we delete or de-identify the information, unless a law, a court order or a pending claim requires us to keep it longer (s14).

7. How we protect it

Encrypted connections (HTTPS); encryption of databases and backups at rest; multi-factor sign-in for staff; access limited to the people who need it for their role; audit logs of access to health records; secrets kept in a password vault; and encrypted, access-controlled backups. If we believe a security compromise has affected your information, we will tell you and the Information Regulator as soon as reasonably possible (s22).

8. Automated decisions

The platform can flag results against clinical thresholds and draft summaries for a practitioner. A registered practitioner reviews and decides. The platform makes no decision with legal effect about a patient on its own.

9. Children

Our website and accounts are for organisations and adult users. Clinics that record a child's information in the platform are responsible for parental or guardian consent (s35).

10. Your rights

• Ask whether we hold personal information about you and receive a copy of it (POPIA s23; PAIA).
• Ask us to correct or delete information that is inaccurate, irrelevant, excessive, out of date, incomplete, misleading or unlawfully obtained (s24).
• Object to processing that relies on our legitimate interest or on yours (s11(3)), and object to direct marketing at any time (s11(3)(b)).
• Withdraw your consent at any time. This does not affect processing that already happened, or processing that the law requires (s11(2)(b)).
• Not be subject to a decision based solely on automated processing that has legal or similarly significant effects (s71).
• Complain to the Information Regulator (details below).

To use any of these rights, email info@healthcareapp.co.za with the subject "POPIA request". We may ask you to prove your identity first. We respond within 30 days. Access requests are free for your own information. For copies of records under the Promotion of Access to Information Act, see our PAIA manual [VERIFY: link to the PAIA manual once it is published].

11. Cookies and similar technology

This website uses only the storage it needs to work, for example to keep you signed in. Where the hosting platform counts visits, it does so without advertising cookies or cross-site tracking. We do not use advertising or social-media tracking cookies.

12. Complaints

Please contact our Information Officer first, so that we can put things right. You may also complain to the Information Regulator (South Africa), JD House, 27 Stiemens Street, Braamfontein, Johannesburg, 2001. Website https://inforegulator.org.za. Complaints: POPIAComplaints@inforegulator.org.za. General enquiries: enquiries@inforegulator.org.za.

13. Changes to this notice

We will publish any change on this page with a new version number and effective date. If a change materially affects how we use your health information, we will tell you before it takes effect.

Group: Healthcare App is part of the House of Experts group. Notice version 1.0, effective 23 October 2026.