Privacy Policy

1. Introduction

Welcome to Africa Care. We respect your privacy and are committed to protecting your personal data. This privacy policy explains what we collect, how we use it, who we share it with, how long we keep it, and your rights — including under the Protection of Personal Information Act (POPIA).

2. Data We Collect

• Identity Data: first name, last name, username or similar identifier; for practitioners, professional registration details.
• Contact Data: email address and telephone numbers.
• Health/Clinical Data: patient records, consultation notes, prescriptions, referrals, laboratory orders and results, and documents captured or uploaded during use of the platform, handled in compliance with applicable healthcare regulations.
• Biometric Data: where a patient has given explicit consent, a facial template derived from their photograph, used solely to help their clinician find the correct record. Never used for any other purpose, and deleted when consent is withdrawn.
• Audio and Images: dictation recordings, voice notes, and photographs of documents or patients captured by clinicians in the course of care.
• Technical Data: IP address, browser type and version, device and push-notification identifiers, time zone.

Data is collected directly from you, from your practice's staff in the course of care, and from integrated services (such as a laboratory returning results) at your clinician's request.

3. How We Use Your Data

We use personal data only to provide our clinical services: maintaining patient records, supporting consultations and prescriptions, delivering results, enabling communication between treating clinicians, managing accounts and subscriptions, securing the platform, and complying with healthcare law. We do not sell personal data, and we do not share it with anyone for advertising.

4. Who We Share Data With

We share personal data only with the service providers below, each strictly for the purpose stated. Every provider is bound by agreements requiring protection of your data equal to this policy and to our obligations under POPIA, and none may use your data for its own purposes — including the training of AI models.

• Google Cloud / Firebase (Google LLC, USA): Hosts the Africa Care platform and database — patient records, clinical documents, uploaded files, account data — with encryption in transit and at rest.
• Google Firebase Cloud Messaging (Google LLC, USA): Delivers push notifications to your device. Receives your device's push token; notification content is kept to the minimum needed.
• OpenAI, L.L.C. (USA): Processes dictation audio, clinical text and images for transcription and clinical drafting — only when AI features are enabled by you.
• Google Gemini (Google LLC, USA): Processes clinical text, documents and images for document reading and clinical drafting — only when AI features are enabled by you.
• Metered.ca (Canada): Relays encrypted audio/video streams for in-app calls between clinicians when a direct connection is not possible. Media transits the relay and is not stored.
• Paystack (Paystack Payments Ltd): Processes subscription payments made on the web portal. Card details are entered on and held by Paystack; Africa Care never stores card numbers. Not used in the iOS app.
• Lancet Laboratories (South Africa): Receives pathology orders and returns results for patients whose clinician uses the lab integration — patient identifiers and clinical order details as required for testing.
• Google Calendar (Google LLC, USA): Only if a clinician connects their own Google Calendar: receives that clinician's Africa Care appointments so they appear in their Google Calendar. Patient names are included only if the clinician switches them on. See section 8.

AI processing (OpenAI and Google Gemini) is optional and happens only after you give explicit permission in the app. You can withdraw that permission at any time in Settings → Advanced → AI features, and withdrawal is enforced by our servers — data is not sent to AI providers for an account that has not consented.

5. Data Retention and Deletion

• Account data is kept while your account is active.
• Clinical records are retained for the periods South African law and HPCSA guidance require of healthcare records, even after an account closes — this is a legal obligation on the treating practice.
• AI processing payloads (dictation audio, text and images sent for a result) are transient: they are processed to return your result and are not retained by the AI providers for any other use.
• Biometric facial templates are deleted when the patient's consent is withdrawn or the record is removed.
• Call media is relayed in real time and never stored.
• Google Calendar access and the Busy times copied from it are deleted when you disconnect Google Calendar.
• Account deletion can be requested in the app (Settings → Profile) or via our Account Deletion page. Approved requests are processed within 30 days; data under statutory clinical retention is placed beyond use until its retention period lapses.

You may revoke any consent you have given — AI processing in Settings → Advanced, biometric consent through your treating practice — and revocation takes effect going forward.

6. Data Security

We apply appropriate technical and organisational measures to prevent your personal data from being accidentally lost, used or accessed in an unauthorised way, altered or disclosed. Data is encrypted in transit and at rest, access is role-restricted within your practice, and administrative access is logged.

7. Your Legal Rights

Under POPIA and other applicable data protection laws you have rights to request access, correction, erasure (account deletion), and restriction of processing, and to object to processing. To exercise them, contact our Data Protection Officer at the address below or use the in-app flows described above.

8. Google Calendar (optional)

Clinicians can choose to connect their own Google Calendar. Nothing goes to or comes from Google Calendar unless you connect it.

• What we access: with your permission, Africa Care can see and edit the events in the Google calendars you own (not calendars others share with you), and reads your Google email address to show which account is connected.
• How we use it: we add, move and cancel your Africa Care appointments in your Google Calendar; we show the times of your other Google events as “Busy” in Africa Care so nobody books over them; and when you move or delete an Africa Care appointment in Google, we update it in Africa Care. For Busy times we keep only the start and end time — never the title, description, guests or location.
• Patient names: appointments appear in Google as “Follow-up (Africa Care)” unless you switch on “Show patient names in Google”.
• Storage: the access Google gives us is kept on our servers, never in the app, and used only to keep your calendars in step.
• What we never do: we do not sell this data, use it for advertising, or use it to train AI models. People at Africa Care do not read it unless you ask us for help, it is needed for security, or the law requires it.
• Disconnecting: Calendar → Google Calendar → Disconnect removes Africa Care’s appointments from your Google Calendar, deletes the Busy times and ends our access. You can also remove access at myaccount.google.com/permissions.

Africa Care’s use and transfer to any other app of information received from Google APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements.

9. Contact Us

If you have any questions about this privacy policy, our privacy practices, or content on the platform, contact us at:

support@africa-care.com

We respond to privacy and content reports within one business day.