Privacy Policy

Protection of Personal Information Act (POPIA) · Last updated: 25 August 2026

1. Who we are

Medi Diary is operated by Medi Diary (Pty) Ltd (registration number 2025/983392/07), a South African company. For this website and the Medi Diary platform, Medi Diary (Pty) Ltd is the "responsible party" under POPIA.

Our Information Officer is Janice Naidoo, registered with the Information Regulator of South Africa. You can reach her at privacy@medidiary.tech or on 060 919 3626.

2. What this policy covers

This policy covers this website: the waiting list, partner and practice forms, and how the site itself works. The Medi Diary platform (the patient portal and doctor portal) has its own in-app privacy centre, where you control sharing and can see a log of every access to your record. Where this policy describes the platform, it says so.

3. What we collect on this website

• Waiting-list sign-ups: name, email, optional mobile number, date of birth, country, province (South Africa), how you are joining, what matters most to you, where you heard about us, whether you are managing an ongoing or chronic condition (a Yes/No/Prefer-not-to-say indicator, never a diagnosis), and whether you opt in to onboarding help or the once-off records-gathering service.
• Partner applications: company, contact name, email, phone, region, partner type and the experience you describe.
• Practice interest and demo requests: name, email and the details you choose to give.
• Website usage: we use Google Analytics to understand how the site is used (pages viewed, approximate location, device type). See section 7 on cookies.

4. Why we collect it

We use this information to contact you about the pilot and the September 2026 launch, to plan invitations and onboarding capacity, to suggest the right plan when plans launch, to apply the free-for-pensioners benefit, to understand where people hear about us, and, for partners, to run the partner programme. Every form asks for your explicit consent, and you may withdraw it at any time by emailing privacy@medidiary.tech. We do not send marketing you have not agreed to, and we never sell personal information.

5. Special personal information

Your date of birth and the chronic-condition indicator are special personal information under POPIA, so we treat them with extra care. We collect your date of birth only to apply the free-for-pensioners benefit to you as the account holder (verified with your ID at onboarding), and the chronic-condition indicator only to gauge demand for chronic-care features. We do not ask for a diagnosis on this website, and we process both only with your explicit consent, which you may withdraw at any time.

If you opt in to the records-gathering service, ticking the box is an expression of interest only. We contact you at onboarding to arrange payment (R114.99 incl. VAT, once-off) and to obtain a separate signed authorisation before we request any records from your doctors or laboratories. No payment is taken and no records are requested until you have signed that authorisation.

6. Where your information lives, and who helps us process it

We do not sell personal information, and we share it only with the service providers ("operators" under POPIA) we need to run this website and reach you:

• Form storage: sign-ups are recorded in our Google Workspace account and emailed to our team addresses, so we can respond to you. Google may store this on servers outside South Africa under its security and data-processing terms.
• Email: confirmation and launch emails are sent through Brevo, our email service provider, which processes your name and email on servers in the European Union under its data-processing agreement.
• Analytics and translation: Google provides our website analytics and the automatic translation feature (section 7).
• Payments: if you use a paid service, payment is processed by PayFast (Pty) Ltd in South Africa. We never see or store your card details.

Where information is processed outside South Africa, it is limited to the contact and sign-up details above and is protected by the provider's contractual safeguards, as POPIA requires. Patient health-record data on the Medi Diary platform is different: it is encrypted and hosted in the AWS Cape Town region (af-south-1) and does not leave South Africa.

7. Cookies, analytics and translation

• Consent banner: our cookie-consent tool records your cookie choices.
• Google Analytics: measures visits so we can improve the site. You can decline analytics cookies in the consent banner.
• Language choice: if you use the language menu, a cookie called googtrans remembers your chosen language, and Google provides the automatic translation. Translations are automatic; the English version of every page, including this policy, is the official version.
• Preferences: small settings, such as dismissing the announcement bar, are stored in your browser.

8. How long we keep it

Waiting-list and partner information is kept for the launch and programme it was collected for. If you never become a Medi Diary user, we delete it within a reasonable period after launch activities end, and immediately on request at any time.

Once you hold a Medi Diary health record, records on the platform are retained in line with South African medical record-keeping standards, including the HPCSA guidelines: clinical records are kept for at least six years after they were last used, records of children are kept until their 21st birthday, and longer periods apply where the law requires them. Your in-app privacy centre will show you what is held and your options.

9. How we protect it

Website sign-up data is held in access-controlled accounts limited to the Medi Diary team. The platform goes further: encryption in transit and at rest, South African hosting, PIN-protected sharing, and a tamper-evident log of every access to a record, which you can inspect yourself.

10. Your rights under POPIA

• Ask what personal information we hold about you, and receive a copy
• Ask us to correct or delete it
• Withdraw any consent you have given, at any time
• Object to processing
• Complain to the Information Regulator (South Africa): inforegulator.org.za or enquiries@inforegulator.org.za

To exercise any of these rights, email privacy@medidiary.tech. We respond within a reasonable time and never charge for a first request. Our PAIA manual is available on request from the same address.

11. Children

This website and the waiting list are intended for adults (18 and older). Children and other dependants are added to Medi Diary by their parent or guardian at onboarding, with the protections described in the platform's own privacy centre.

12. Changes to this policy

If we change this policy, we update it here with a new date. If a change meaningfully affects how we use your information, we tell you by email before it takes effect.

13. Contact

Privacy questions or data-subject requests: privacy@medidiary.tech · 060 919 3626 (Information Officer: Janice Naidoo). General enquiries: hello@medidiary.tech. Registered office: 83 Millbrook Complex, 2 Segal Road, Halfway Gardens, Gauteng, 1686.