Privacy and POPIA

hiDoc collects your phone number and email to verify your identity, appointment details to arrange care, and information you give your clinician for assessment and clinical records. With your optional analytics consent, Google Analytics measures public-page visits, traffic sources, navigation clicks, scroll depth, time engaged and privacy-safe booking-funnel stages. We never send names, contact details, symptoms, diagnoses, medicines, appointment identifiers, secure links or clinical records to analytics. Health information is sensitive. We use it to provide care, meet record-keeping duties, operate billing and respond to requests; it is not sold for advertising.

Only an authenticated patient can see their released documents in the records area. A treating clinician can access their own consultation workflow. Authorised administrative staff can manage bookings, prices, accounts and support requests. We log relevant clinical access and restrict records by role. Do not send clinical details through the general contact form.

Our infrastructure currently includes Supabase for the database and private clinical storage, Vercel for the application, Daily for private video rooms, speech-to-text and AI providers for clinician-reviewed draft notes, Resend for transactional email and PayFast for checkout. Google services may provide public search, campaign and aggregated website analytics, but hiDoc does not send patient identity, clinical reasons, diagnoses, medicines or document contents to advertising analytics. These providers may process information outside South Africa under appropriate safeguards. PayFast handles payment credentials; hiDoc does not store card numbers.

We retain clinical and transaction records for the period required by applicable law and professional guidance, with access limited to legitimate care and operational needs. The correspondence address for privacy notices is 3 Norwalk Road, Chloorkop, Johannesburg, 1624. The final company registration details will be added after hiDoc (Pty) Ltd is registered.

To ask about access, correction, objection or a privacy concern, use the contact form and select “Privacy request”. We may need to verify your identity before disclosing a clinical record. You may also contact the Information Regulator.