Meditrac is built for healthcare, so security and privacy sit at the core of the platform. This page describes the safeguards we put in place to protect practice and patient information.

For how we collect and use information, see our Privacy Policy, POPIA and Compliance pages.

Security at the core

Sensitive patient information is protected with role-based access, strong authentication, encrypted identifiers and an audit trail. The aim is simple: the right people in your practice can do their work, without exposing records more widely than necessary.

Practice isolation

Meditrac is multi-tenant. Access controls in the application and in the database are designed so one practice cannot see another practice’s patients, notes, scripts or stock. A patient who uses the portal at more than one Meditrac practice still has a separate chart at each.

Role-based access

Practice owners invite their team and assign roles so practitioners, reception staff and other users only see what they need. Reception can run the diary and demographics without opening clinical notes or prescription line items by default. Additional seats can be added as the team grows, each with their own access rather than a shared login.

Secure authentication

Access to Meditrac requires a signed-in account with a strong password. Practice admins and practitioners must use multi-factor authentication (an authenticator app). You are responsible for keeping credentials confidential and for signing out on shared devices.

Protected identifiers

South African identity numbers and passport numbers are stored with extra protection, displayed in masked form, and are not used as passwords or in web addresses. Prescription PDFs, logos and signature images are kept in private storage.

Activity tracking

Meditrac keeps an audit trail of relevant activity in the platform, including sign-in events, clinical work, scripts, stock, exports and support access. This helps practices understand who accessed or changed information and supports accountability around patient records.

Patient records

Consultations, patient information and clinical history are organised in a secure digital record for your practice. Patient portal access is limited to what the patient is allowed to see, such as their own appointments, shared visit summaries and issued scripts. Linking a portal account to a chart is approved by the practice — it is not automatic on ID number alone.

Support access

Kodecraft support does not have standing access to your patient charts. If you need help that requires looking at a record, access is granted by the practice, time-limited and purpose-bound, and recorded in the audit trail.

What we do not do

We do not send patient records to AI providers. We do not store subscription card numbers — payments are handled by Paystack. We do not sell personal information.

Your responsibilities

Security is shared. Practices should:

Give each person their own seat and login.
Grant the minimum access needed for each role.
Keep devices, passwords and networks under your control secure.
Tell us promptly if you suspect unauthorised access to your account.

Reporting a concern

If you believe there has been a security incident involving Meditrac, contact us through the website or at app.meditrac.co.za as soon as possible so we can investigate. Where a compromise affects a practice, we notify that practice without undue delay and no later than 72 hours after becoming aware of it.

Security