Privacy Policy

Last updated: July 13, 2026

1. Introduction

MedHQ is a medical practice management platform ("MedHQ", "we", "our", or "us"). MedHQ is committed to protecting your privacy. This Privacy Policy explains how we collect, use, disclose, and safeguard your information when you use our medical practice management platform, and how we comply with the Protection of Personal Information Act, 2013 (POPIA).

For information about medical practices and their staff who register on the platform, MedHQ is the responsible party. For patient information entered into the platform, the treating practice is the responsible party and MedHQ acts as an operator, processing that information on the practice's instructions to deliver the service.

2. Information We Collect

We may collect information in a variety of ways, including:

  • Personal Data: Name, email address, phone number, and professional credentials of practitioners and practice staff
  • Practice Information: Practice name, address, registration numbers, and billing details
  • Patient Data: Information practices enter about their patients for practice management purposes, including identity and contact details, medical aid membership details, clinical notes and documents, and billing and claims information
  • Communications Data: Records of messages sent to patients on a practice's behalf (such as appointment reminders), their delivery status, and replies received
  • Usage Data: Information about how you use our platform

3. How We Use Your Information

We use the information we collect to:

  • Provide, operate, and maintain our platform
  • Improve, personalise, and expand our services
  • Process transactions, medical aid claims, and payments, and send related information
  • Send patient communications on a practice's instructions (see section 4)
  • Send administrative information and updates
  • Respond to enquiries and offer support
  • Monitor and analyse usage patterns

4. Patient Communications

On a practice's instructions, the platform sends messages to patients by WhatsApp, SMS, and email. These include service messages related to the patient's care and account — such as appointment reminders and confirmations, recall notices, pre-authorisation updates, statements, and payment links — and, where a patient has consented, occasional practice communications of a marketing nature.

Practices are responsible for obtaining patient consent to be contacted through these channels. Patients can opt out of WhatsApp messages at any time by replying "STOP" to any message, and can opt out of marketing communications while still receiving care-related service messages. Opt-out requests can also be made directly to the treating practice or to us using the contact details in section 10.

5. Third-Party Service Providers

We share personal information with service providers (operators) only to the extent needed to deliver the platform, under contracts that restrict how they may use it. These include:

  • Messaging: Meta Platforms (WhatsApp Business Platform) and BulkSMS deliver messages to patients; recipient phone numbers and message content are processed by these providers to deliver each message
  • Email: Transactional email providers deliver documents and notifications sent from the platform
  • Hosting: Amazon Web Services hosts the platform and stores its data
  • Claims and benefits: MediKredit switches medical aid claims and benefit checks to schemes, which involves membership, diagnosis, and treatment information; Medprax provides medical aid, tariff, and medicine reference data
  • Payments and banking: Peach Payments processes card payments and securely stores card tokens; Investec provides bank statement data used to reconcile practice payments
  • Clinical AI services: Where a practice uses the AI scribe, consultation audio and clinical text are processed by transcription and AI providers (such as Soniox, Anthropic, and Heidi Health) to produce clinical notes at the practice's direction
  • Authentication: Google, where a user chooses to sign in with a Google account

Our platform may also contain links to third-party websites or services. We are not responsible for the privacy practices of these third parties and encourage you to read their privacy policies.

6. Data Security

We implement appropriate technical and organisational security measures to protect your personal information. However, no method of transmission over the Internet or electronic storage is 100% secure, and we cannot guarantee absolute security.

7. Data Retention

We retain your information for as long as your account is active or as needed to provide you services. We will retain and use your information as necessary to comply with legal obligations, resolve disputes, and enforce our agreements. Patient health records are retained for the minimum periods required of practices by applicable health-records law and professional guidelines, which may extend beyond the closure of an account.

8. Your Rights

Under POPIA and other applicable law, you have the right to:

  • Access the personal information we hold about you
  • Request correction of inaccurate data
  • Request deletion of your data
  • Object to processing of your data
  • Request restriction of processing
  • Data portability
  • Lodge a complaint with the South African Information Regulator (inforeg.org.za)

To request deletion of your personal information, or to exercise any of these rights, email us at [email protected]. Where the request concerns patient information held on behalf of a practice, we will coordinate with the treating practice as the responsible party, subject to the record-retention obligations described in section 7.

9. Changes to This Policy

We may update this Privacy Policy from time to time. We will notify you of any changes by posting the new Privacy Policy on this page and updating the "Last updated" date.

10. Contact Us

If you have questions about this Privacy Policy, or wish to contact our Information Officer, please reach us at:

MedHQ
Email: [email protected]