Privacy policy

Draft for review. This policy has not yet been reviewed by a lawyer and must be approved before SafeNexus Practice takes real patient information.

Who we are

SafeNexus (Pty) Ltd ("SafeNexus", "we") provides SafeNexus Practice, software that practices use for online booking, their diary, patient records and patient messages. Contact: hello@safenexus.co.za.

Two different roles

Practice and patient information: we are the operator

When a practice uses SafeNexus Practice, the practice is the responsible party under the Protection of Personal Information Act (POPIA) for the information about its patients, and SafeNexus is its operator. We process that information only on the practice's instructions and under a written operator agreement. Patients with questions about their information should contact their practice first.

Our own customers and this website: we are the responsible party

For the people who sign up for SafeNexus Practice, staff accounts, and visitors to this website, SafeNexus is the responsible party.

What we collect

For practice accounts: the practice's name, contact details and practice type; staff names, email addresses, roles and passwords (stored only as secure hashes).
For patients, on the practice's behalf: the details a patient gives when booking or that the practice records, which can include health information, a special category under POPIA.
For website visitors: what you send us when you email or message us. This website does not use advertising or tracking cookies.

How patient information is protected

Each practice's information is kept separate, and staff see only what their role needs.
Opening or changing a patient record is recorded in an audit trail.
Patients' consent is recorded, including which channels they may be messaged on and whether they agreed to marketing.
Messages to patients never contain medical details.
Information is encrypted in transit and hosted with providers that meet POPIA's security requirements. Where any provider stores information outside South Africa, it does so under the protections POPIA section 72 requires.

Who we share it with

We use service providers to run SafeNexus Practice, such as hosting, email, SMS and WhatsApp messaging providers. They act on our instructions and may use the information only to provide their service. We do not sell personal information.

How long we keep it

Patient records are kept for as long as the practice instructs, in line with the HPCSA's guidance on keeping patient records (generally at least six years after the last visit, and longer for children). When a practice leaves SafeNexus, it can export all of its information, and we then delete it from our systems as agreed in the operator agreement.

If something goes wrong

If we have reason to believe patient information has been accessed by someone not allowed to, we tell the practice without delay so that it can notify the Information Regulator and the people affected, as POPIA requires.

Your rights

You may ask to see, correct or delete personal information we hold about you, object to its processing, and complain to the Information Regulator (inforegulator.org.za). For patient records, contact your practice.