Privacy Policy
Last updated: 2026-03-25. Version 1.0.
1. Introduction
ClinicDiary is a cloud-based practice management platform for South African healthcare professionals. This Privacy Policy explains how we collect, use, store, and protect personal information when you use our marketing website, application, and patient portal.
This policy applies to all users — practice administrators, practitioners, receptionists, and patients accessing the patient portal.
2. Information We Collect
| Category | Data Points | Lawful Basis (POPIA) |
|---|---|---|
| Account information | Email address, name, workspace slug | Contract (Section 11(1)(b)) |
| Practice information | Practice name, address, contact details, practitioners | Contract |
| Patient data | Demographics, medical aid details, clinical records, visit history | Legitimate interest; patient consent via practice |
| Payment information | Processed by Paystack — we do not store card details | Contract |
| Usage data | Pages visited, features used, session duration | Legitimate interest |
| Device information | Browser type, OS, IP address, device fingerprint | Security (legitimate interest) |
| Communication data | Contact form messages, support emails | Consent |
3. How We Use Information
- Provide and maintain the service
- Process payments via Paystack
- Send transactional emails (magic links, notifications, invoices)
- Improve the service based on usage patterns
- Comply with legal obligations
- Enforce our Terms of Service
4. Data Processing & Tenancy Model
- Tenant isolation: Each practice's data is completely isolated. No shared tables, no data contamination between tenants.
- No cross-tenant access: Practice A cannot see Practice B's data under any circumstances.
- No data mining: We do not analyse patient data for advertising, profiling, or AI training.
Sub-processors
- Paystack — payment processing
- Email delivery provider — transactional emails
- Cloudflare — CDN and bot protection
- Object storage — backups and attachments
- Error logging service — application errors only (no patient data in logs)
5. Data Sharing
We do not sell personal information. We share data only with:
- Sub-processors listed above, for service delivery
- Medical aid schemes, when the practice submits claims via MediKredit (data controlled by the practice)
- Law enforcement, only when legally compelled by a valid South African court order
6. Data Security
- Encryption in transit (TLS)
- Encryption at rest where applicable
- Role-based access control within each practice
- Two-factor authentication available for all users
- Full audit trail of data access and changes
- Automatic backups with point-in-time recovery
- Regular security reviews
7. Data Retention
| Data | Retention Period |
|---|---|
| Active account data | Duration of subscription + 30 days |
| Cancelled workspace data | 30 days after cancellation, then deleted |
| Audit logs | 7 years (SA regulatory requirement for healthcare records) |
| Backups | Rotated on a 30-day rolling basis |
| Contact form submissions | 12 months |
8. Your Rights (POPIA Sections 23–25)
- Access: Request a copy of your personal information
- Correction: Request correction of inaccurate data
- Deletion: Request deletion of your data (subject to legal retention requirements)
- Objection: Object to processing of your personal information
- Portability: Request your data in a machine-readable format
To exercise any of these rights, contact us using the details in Section 12. We will respond within 30 days.
9. Children's Data
ClinicDiary does not knowingly collect data from children under 18 directly. Patient data for minors is entered by the parent/guardian or the healthcare practitioner. The practice is the responsible party for patient data under POPIA.
11. Changes to This Policy
We may update this policy as the platform evolves. Significant changes will be communicated via email to registered users. Continued use after 30 days of notice constitutes acceptance.
12. Contact
For privacy-related questions or to exercise your rights, contact us via the contact page.
If you are unsatisfied with our response, you may escalate your complaint to the Information Regulator of South Africa.