Legal
Privacy Notice
This notice explains how VirtualDoc ("we", "us") processes personal information as a responsible party under the Protection of Personal Information Act, 2013 (POPIA): the information of practice owners, practitioners and staff, of people who sign up or ask for a demo, and of visitors to our website.
It does not cover patient information. For patient information we act only as each practice's operator, on its instructions, and each practice publishes its own privacy notice. We never use patient information for our own purposes, including analytics, marketing or product training.
1What we collect.
Names, e-mail addresses and phone numbers of practice owners and staff; HPCSA registration details and the evidence used to verify them; practice details such as legal entity, practice number, VAT number and addresses; subscription and billing records, including a card token from our payment provider (never the full card number); sign-in, security and audit records; support conversations; and, for website visitors and demo requests, the details you give us and basic technical information such as your browser and IP address.
2Why we use it.
To create and verify practice accounts, provide and secure the platform, bill the subscription, give support, send service notices, meet our legal and regulatory duties, and, where you have agreed to it, tell you about VirtualDoc.
3Lawful basis.
We process this information to conclude and perform our contract with the practice, to comply with the law, to protect our legitimate interest in running a secure service, and, for direct marketing, with your consent or as an existing customer under section 69 of POPIA.
4Payments.
Subscription payments are processed by PayFast, which handles card details under its own security standards (PCI DSS). We receive a token and the result of each payment, not the card number.
5Who we share it with.
Only our sub-processors, who host and run the service for us under written agreements (listed with their location at virtualdoc.co.za/legal/sub-processors), our payment provider, our professional advisers, and authorities where the law requires it. We do not sell personal information.
6Where it is kept.
With our sub-processors, currently in the United Kingdom (London). The United Kingdom has data protection law that gives a level of protection comparable to POPIA, and the transfer basis is stated on the sub-processor page.
7How long we keep it.
For as long as the practice account exists, and afterwards for as long as the law requires, for example five years for financial records. Information from a demo request we no longer need is deleted.
8Security.
We protect information with encryption in transit and at rest, a separate encryption key for each practice's sensitive information, access by role, two-step sign-in for practice users and an audit trail of access.
9Cookies.
Our website and platform use cookies that are needed to sign in, stay secure and remember your choices. Any analytics or marketing cookies are used only if you agree to them.
10Direct marketing.
You can unsubscribe from marketing messages at any time with the link in each message or by e-mail to support@virtualdoc.co.za. Service messages about your account continue while the account exists.
11Your rights.
You may ask what information we hold about you and for a copy of it, ask us to correct or delete it, and object to its processing, including for direct marketing. Send requests to our Information Officer at support@virtualdoc.co.za. You may also complain to the Information Regulator (South Africa) at complaints.IR@inforegulator.org.za or through inforegulator.org.za.
12Changes.
We publish every new version of this notice here, with the date it takes effect, and tell practice owners by e-mail of any material change.
Fingerprint (SHA-256) eb47e6a64ea25b06510f76d38b95f223ba031af5c2c6b2c3ff1b16f99a340494