Security and POPIA
Patient information, kept the way you promised it would be.
What is built in, in plain English, with the technical detail underneath for your information officer.
Built in
Six things we build into every product.
Member cards and staff cards
A card that proves who someone is, and nothing more.
Digital member cards and staff ID cards are built so that a scan can check a person but can never sign them in or expose their identity numbers.
The QR never signs in
A card scan only checks. A staff card is ID only. Signing in on a shared computer needs the staff member to approve on their own phone with Face ID or fingerprint.
Revocable at once
Re-issue a lost card and the old QR stops working. Remove a staff role and their staff card stops working that moment.
No ID numbers on a card
No SA ID, passport or medical-aid numbers. Anyone scanning sees only "valid member" and a first name and initial.
Every scan logged
Each scan is written to the audit trail. Phone sign-in is single use, lasts 90 seconds and is audited too.
On every deployment
Done for every practice before go-live.
We do these for every practice, pharmacy and facility before go-live. None of them costs extra.
POPIA roles
Who is responsible for what.
The Protection of Personal Information Act gives each party a different job. This is how the product is organised around them.
Responsible party
You decide why and how patient information is used.
- Tells patients what it holds and why
- Decides who on staff holds which module
- Answers patient requests about their information
Operator
We run the software and servers on your instructions.
- Works under a written operator agreement
- Processes information only for the practice
- Keeps the safeguards on this page in place
Data subject
The person the information is about stays in view.
- Sees their own record in their vault
- Can see who has accessed their vault
- Approves sharing with their clinicians
This page explains how the product is organised. It is not legal advice. Your information officer should review the operator agreement before you sign.
We list what is built, and we say what is not.
We do not hold any third-party security certifications today. What we can do is show you exactly what is built into each product, so you can check it against the list yourself.
Questions from your information officer?
Request a demo and ask for the security walk-through.