Privacy policy

Last updated 23 October 2026

Draft. This hasn’t been checked by a lawyer yet, and the parts marked “to be confirmed” still need filling in. It will be finished before PracticeVitals takes its first payment.

This explains what information PracticeVitals keeps, why, who else handles it, and your rights under the Protection of Personal Information Act (POPIA).

Who we are

PracticeVitals is run by to be confirmed (registration number to be confirmed), to be confirmed. You can reach us at to be confirmed. Our Information Officer, the person responsible for privacy here, is to be confirmed.

Two kinds of information, two kinds of responsibility

For your own account and for billing, we decide how your information is used. The law calls us the responsible party for that.

For the records a practice keeps in PracticeVitals, such as its staff list, checks, registers and leave, the practice decides what goes in and why. We look after those records for the practice and use them only to provide PracticeVitals. The law calls the practice the responsible party and us its operator. A practice should tell its staff that it keeps these records in PracticeVitals.

What we collect

• To sign you in: your name and email address. We don’t use passwords. You sign in with a code we email to you.
• The practice’s records: the practice’s details; staff names, roles, council registration numbers and, if the practice adds them, phone numbers and email addresses; check results, photos, documents and registers; repairs; renewals; tasks; and leave dates and the kind of leave.
• Patients: as little as possible. File audits use file numbers, and ID numbers are refused. The complaints register keeps the complainant’s name, because inspectors check that each complainant was told the outcome.
• Check-in: when someone checks in or out on their phone and allows location, we work out how far they are from the practice and keep only that distance, never where they were.
• Repair links: the name a technician types and the photos they add to that one repair.
• Feature ideas: whatever you write when you suggest a feature.
• Billing, once payments start: the practice’s billing details and invoices. Card details go straight to our payment provider, Paystack, and never reach us. We keep only the card type and its last four digits.

Sick leave and other health information

Sick leave dates can say something about someone’s health. We never ask for a diagnosis, and we ask practices not to put medical details in leave notes. Colleagues can see who is off and when, but not what kind of leave it is.

What we use it for

We use the information to run PracticeVitals: to sign people in, show each person what they’re allowed to see, work out readiness and balances, send sign-in codes, and bill the practice. We use feature ideas to decide what to build next. We don’t sell information, and we don’t use it for advertising.

The website

This website has no analytics and no advertising trackers. The app uses cookies only to keep you signed in. To show its typeface and animations, the website loads files from Google Fonts and cdnjs, so your browser asks their servers for those files.

Who else handles it

We use a few service providers, each bound to keep the information safe and use it only for us:

• Supabase stores the database and files, and sends sign-in emails. Its servers for PracticeVitals are in Ireland.
• Vercel runs the website and the app. Its servers for PracticeVitals are in Dublin, Ireland.
• Paystack handles card payments, once payments start.

Information stored outside South Africa

Our servers are in Ireland, in the European Union, where the General Data Protection Regulation protects personal information at least as well as the Protection of Personal Information Act (POPIA) does here. POPIA allows this because of that protection and our agreements with these providers.

How long we keep it

We keep a practice’s records while its account is open. If a practice closes its account, we delete its records within to be confirmed days, except invoices, which tax law requires us to keep for five years.

How we keep it safe

• Rules in the database itself make sure each practice sees only its own records, and staff see only their own leave.
• Everything travels over encrypted connections.
• There are no passwords to steal. Sign-in codes work once and expire.
• A technician’s repair link opens one repair and nothing else.

Your rights

You can ask to see the information held about you, have it corrected or deleted, or object to how it’s used. If you work at a practice, start with the practice, because it decides what it keeps about its staff. You can also contact us. If you’re not happy with how we deal with it, you can complain to the Information Regulator at inforegulator.org.za.

Changes

If we change this policy, we’ll update the date at the top, and we’ll email practice owners before any big change.