Privacy Policy
Last updated: 2 November 2026
1. Who We Are
Medicaputare (Pty) Ltd ("Medicaputare", "we", "us", or "our") is a South African health technology company registered under registration number K2022801892, with registered address at 1 Sinatra Close, Shere, 0084, Pretoria, South Africa.
We operate the Medicaputare EML Portal and related services (collectively, the "Service") that provide structured digital access to clinical reference content for healthcare professionals and institutions in South Africa.
Information Officer: Dr Rephaim Mpofu Contact Email: queries@medicaputare.co.za Postal Address: 1 Sinatra Close, Shere, 0084, Pretoria, South Africa
We are committed to protecting your personal information in accordance with the Protection of Personal Information Act, 2013 (POPIA) and other applicable South African data protection laws.
2. What Personal Information We Collect
We collect only the personal information necessary to provide, maintain, and improve the Service. We do not collect or process patient health information, protected health information, or special personal information as defined under POPIA (such as health data, biometric data, or medical records).
2.1 Information You Provide Voluntarily
| Category | Examples | Purpose |
|---|---|---|
| Account information | Full name, work email address, professional role, organisation name, phone number | Account creation, verification, subscription management |
| Organisation details | Institution name, physical address, tax number, billing contact | Invoicing and subscription administration |
| Payment information | Credit card details, billing address | Payment processing (processed by Payfast; card details are entered on Payfast's hosted payment page and are not stored by us) |
| Communications | Emails, support requests, feedback | Customer support, service improvement |
2.2 Information Collected Automatically
| Category | Examples | Purpose |
|---|---|---|
| Usage data | Pages accessed, features used, search queries, time spent | Service improvement, usage analytics, content optimisation |
| Technical data | IP address, browser type, device type, operating system | Security monitoring, troubleshooting, analytics |
| Session data | Login timestamps, session duration | Account security, activity audit |
2.3 Information We Do NOT Collect
We do not collect, process, or store:
- Patient medical records or health information
- Personal health information (PHI) as defined in any applicable health privacy law
- Special personal information as defined in POPIA (health, biometric, criminal behaviour, etc.)
- Information about minors (our Service is intended for adult healthcare professionals)
- Location data beyond IP-based general geographic region
3. Purpose of Processing
We process your personal information only for the following specific, lawful purposes:
- To provide and maintain the Service — account registration, authentication, content delivery, feature access;
- To manage subscriptions and billing — invoicing, payment processing via Payfast, account administration;
- To communicate with you — service updates, technical notices, security alerts, support responses;
- To improve the Service — usage analytics, performance monitoring, content optimisation;
- To comply with legal obligations — tax records, regulatory compliance, lawful requests from authorities;
- To protect our rights and property — fraud prevention, security incident investigation, enforcement of our Terms of Use.
We do not process your information for any purpose other than those stated above without obtaining your prior consent.
4. Legal Basis for Processing (POPIA)
Under POPIA, we process your personal information on the following lawful grounds:
- Performance of a contract — processing necessary to provide the Service under our Terms of Use;
- Compliance with a legal obligation — processing required by South African law (e.g. tax record-keeping);
- Legitimate interests — processing necessary for our legitimate business interests (security, analytics, fraud prevention) that do not outweigh your privacy rights;
- Consent — where we otherwise require your permission, we will obtain it before processing.
5. Sharing of Personal Information
We do not sell, rent, or trade your personal information. We share your information only in the following limited circumstances:
5.1 Service Providers
We engage trusted third-party service providers who process personal information on our behalf, subject to written agreements that require them to:
- Process information only for the specific purposes we instruct;
- Maintain appropriate security measures;
- Comply with POPIA and applicable data protection laws.
Our current service providers include:
| Provider | Purpose | Jurisdiction |
|---|---|---|
| Payfast (a Network International company) | Payment processing — hosted payment page; card details are entered by the payer on Payfast's page | South Africa (group parent: United Arab Emirates) |
| Hostking | Web hosting and infrastructure | South Africa |
| — | Usage analytics (server logs only) | — |
5.2 Legal Requirements
We may disclose your personal information if required to do so by:
- South African law or regulatory obligation;
- A court order or legal process;
- A lawful request from the Information Regulator (South Africa);
- To protect our rights, property, or safety, or that of our users or the public.
5.3 Business Transfers
In the event of a merger, acquisition, or sale of all or substantially all of our assets, your personal information may be transferred to the acquiring entity, with notice provided to you.
6. Cross-Border Transfers
Our own systems and our hosting provider are located in South Africa, and our payment processor, Payfast, is a South African company. Payfast is a subsidiary of Network International, a group headquartered in the United Arab Emirates, so for card transactions we cannot exclude that a processing step may take place outside South Africa.
Where your personal information is transferred to a service provider in a jurisdiction outside South Africa, we rely on section 72 of POPIA and ensure that at least one of the following applies:
- The recipient is subject to a law, binding corporate rules, or a binding agreement that provides a level of protection for personal information that is substantially similar to the level of protection provided by POPIA; or
- The transfer is necessary for the performance of a contract between you and us, or for the implementation of pre-contractual measures taken in your interest; or
- You have consented to the transfer after being informed of the possible risks of the transfer and of the adequate level of protection that the recipient will apply.
If you have a question about a specific transfer, contact our Information Officer at queries@medicaputare.co.za.
7. Data Security
We implement appropriate technical and organisational security measures to protect your personal information against:
- Unauthorised access, loss, or damage;
- Unlawful processing;
- Accidental destruction or damage.
These measures include:
- Encryption of data in transit (TLS 1.2+);
- Access controls and authentication for all systems processing personal information;
- Regular security assessments and vulnerability testing;
- Staff training on data protection and confidentiality;
- Incident response and breach notification procedures.
In the event of a data breach involving your personal information, we will notify you and the Information Regulator as required by POPIA (Section 22).
8. Data Retention
We retain your personal information only for as long as necessary to fulfil the purposes for which it was collected, or as required by applicable law:
| Data Category | Retention Period | Reason |
|---|---|---|
| Account information | Duration of account + 5 years | Contract performance, legal retention |
| Billing records | 7 years from transaction date | Tax and accounting obligations |
| Usage analytics | 24 months (aggregated thereafter) | Service improvement |
| Support correspondence | 3 years from last contact | Service quality, dispute resolution |
| Communications opt-out records | Indefinitely (minimal data) | Honouring your preferences |
After the retention period, your personal information will be securely deleted or anonymised.
9. Your Rights Under POPIA
As a data subject under POPIA, you have the following rights:
9.1 Right to Access
You may request confirmation of whether we hold personal information about you, and request a copy of that information. We will respond within 30 days (or as prescribed by POPIA).
9.2 Right to Correction
You may request that we correct or update any inaccurate or incomplete personal information.
9.3 Right to Deletion
You may request that we delete your personal information, subject to legal retention obligations. Note that account deletion will result in loss of access to the Premium Tier.
9.4 Right to Object
You may object, on reasonable grounds, to the processing of your personal information where the processing is based on legitimate interests or direct marketing.
9.5 Right to Complain
If you believe we have processed your personal information in violation of POPIA, you may lodge a complaint with:
Information Regulator (South Africa) JD House, 27 Stiemens Street, Braamfontein, Johannesburg, 2001 Email: complaints.IR@justice.gov.za Website: www.justice.gov.za/inforeg
How to Exercise Your Rights
To exercise any of the above rights, contact our Information Officer at queries@medicaputare.co.za. We may require proof of identity before processing your request. We will respond within the timeframes prescribed by POPIA.
10. Cookies and Tracking
Our Service uses cookies and similar technologies for essential functionality and analytics:
- Essential cookies — required for authentication, session management, and security. These cannot be disabled.
- Analytics cookies — used to understand usage patterns and improve the Service. You may opt out via your browser settings.
You can manage cookie preferences through your browser settings. Disabling essential cookies will prevent the Service from functioning correctly.
We do not use cookies for advertising, profiling, or cross-site tracking purposes.
11. Links to Third-Party Websites
The Service may contain links to third-party websites (e.g., NDOH websites, regulatory authorities). This Privacy Policy does not apply to those websites. We encourage you to review the privacy policies of any third-party sites you visit.
12. Changes to This Privacy Policy
We may update this Privacy Policy from time to time to reflect changes in our practices, legal requirements, or operational needs. Changes will be posted on this page with an updated "Last updated" date.
For material changes (e.g., new purposes of processing, new categories of data collected), we will provide at least 14 days' notice to registered users via email.
13. Contact Us
If you have any questions, concerns, or requests regarding this Privacy Policy or our processing of your personal information, please contact our Information Officer:
Information Officer: Dr Rephaim Mpofu Email: queries@medicaputare.co.za Telephone: +27 72 797 3361 Postal Address: 1 Sinatra Close, Shere, 0084, Pretoria, South Africa
Medicaputare (Pty) Ltd Registration No: K2022801892 1 Sinatra Close, Shere, 0084, Pretoria, South Africa https://www.medicaputare.co.za