Meditrac is designed for healthcare practices in South Africa. This page explains how we approach the Protection of Personal Information Act 4 of 2013 (POPIA) when we provide the website and the Meditrac platform.

It should be read together with our Privacy Policy and Compliance overview. It is an overview of our approach, not legal advice for your practice.

Our role

When you create a Meditrac account, we act as the responsible party for information about you as a user, such as your name, email, practice profile, billing details and sign-in activity.

When your practice stores patient information in Meditrac — including appointments, clinical records, notes and prescriptions — your practice is the responsible party. Meditrac processes that information as an operator, on your instructions, so that the platform can function.

Why we process personal information

We process personal information to:

Provide and administer the Meditrac service.
Manage accounts, seats, permissions and secure authentication.
Keep an activity record that helps protect patient data.
Meet our legal, tax and security obligations.

We process this information because it is necessary to perform our agreement with you, to pursue legitimate interests in running a secure healthcare platform, or because the law requires it.

Special personal information

Health information is special personal information under POPIA. Practices must only record patient health information in Meditrac where they have a lawful basis to do so, typically as part of providing healthcare. Meditrac does not use special personal information for marketing.

Security safeguards

POPIA requires appropriate technical and organisational measures to protect personal information. Meditrac includes role-based access, secure authentication and activity tracking. See our Security page for more detail. Practices must also apply least-privilege access within their own team.

Data subject rights

Data subjects may request access to their personal information, ask for it to be corrected, or (where the law allows) object to processing or request deletion.

Patients should send these requests to the practice that holds their records. Meditrac users should contact us through the website or the application. We will help practices respond to patient requests that relate to information stored in the platform, where we reasonably can.

Operators and further processing

We may use carefully selected operators (for example hosting or payment providers) to deliver Meditrac. They may only process personal information as needed to provide those services, and they must protect it appropriately.

We do not sell personal information or use patient records for unrelated purposes.

Cross-border transfers

Some infrastructure used to provide Meditrac may be located outside South Africa. Where that happens, we take steps consistent with POPIA so that personal information remains protected.

Information officer

POPIA-related enquiries can be sent through the Meditrac website or at app.meditrac.co.za. We will direct your request to the appropriate person.

Complaints

If you are not satisfied with how a POPIA request or complaint has been handled, you may lodge a complaint with the Information Regulator (South Africa).

POPIA