Privacy Policy
1. Who we are
Practical Software (Pty) Ltd (registration number 2026/549124/07), a private company registered in South Africa, operates Practi-Cal — practice management software for healthcare practices — at practi-cal.co.za and app.practi-cal.co.za.
Information Officer: Keagan Meiring · info@practi-cal.co.za
2. The two kinds of information we handle
a) Information we are the responsible party for
Information about our own customers and website visitors: practice account details (practice name, owner and staff names, email addresses, roles), billing and payment records, support correspondence, and technical logs needed to run and secure the Service. We process this to provide and bill for the Service (performance of a contract), to meet legal obligations, and in our legitimate interest of securing and improving the Service.
b) Information we are the operator for
Patient information that practices store in Practi-Cal: demographics, contact details, identifiers such as SA ID or passport numbers, medical aid details, clinical notes, documents and communications. Each practice is the responsible party for its patients' information; we process it strictly on the practice's behalf and instructions, and never for our own purposes. We do not sell, rent or trade personal information — anyone's, ever.
3. How patient information is protected
- Hosted in South Africa — patient records live on servers located in South Africa.
- Encryption — traffic is encrypted (HTTPS); special identifiers (SA ID, passport, medical aid member numbers) are additionally encrypted at rest and shown masked in the interface.
- Access control — role-based permissions mean reception staff cannot read clinical notes; practitioners see only their own caseload unless the practice enables sharing.
- Audit trail — every view, edit, export or reveal of clinical or identifying information is logged.
- Backups — encrypted-at-source data is backed up at least daily.
- Breach response — if we believe personal information has been accessed by an unauthorised person, we notify the affected practice without undue delay so it can meet its duties under POPIA section 22, and we notify the Information Regulator where we are required to.
4. Service providers (sub-operators)
We use a small number of providers to run the Service, each under contractual confidentiality and security obligations, and each receiving only what its function requires:
- HostAfrica (South Africa) — application hosting. Patient records stay here.
- Cloudflare — website delivery, DNS and DDoS protection.
- Twilio (USA) — WhatsApp and SMS delivery: recipient phone number and message content only.
- Twilio SendGrid (USA) — email delivery (for example invoices): recipient address and email content only.
Where a provider processes limited information outside South Africa, the transfer is made under POPIA section 72 on the basis of contractual protections substantially similar to POPIA's conditions.
5. Cookies and analytics
The marketing website sets no advertising or analytics cookies. The application uses only strictly necessary cookies to keep you signed in securely. We do not track visitors across other websites.
6. Retention
Account information is kept for the life of the account and as required by law thereafter (for example tax records). Patient information is retained according to the controlling practice's settings and legal obligations — healthcare records are subject to statutory minimum retention periods that the practice manages. When a practice account is terminated, its data is deleted 60 days after termination, subject to law.
7. Your rights
Under POPIA (and, for records requests, the Promotion of Access to Information Act 2 of 2000) you may request access to, correction of, or deletion of your personal information, and object to processing:
- Patients: direct requests to your healthcare practice — it holds your records and can export or delete them using tools built into the Service. We assist practices with these requests.
- Practice owners, staff and website visitors: contact our Information Officer at info@practi-cal.co.za. We respond within a reasonable time and at most within the periods POPIA prescribes.
If you believe personal information is being processed unlawfully, you may lodge a complaint with the Information Regulator (South Africa): inforegulator.org.za · complaints.IR@inforegulator.org.za · JD House, 27 Stiemens Street, Braamfontein, Johannesburg.
8. Children
Practices may lawfully hold records of minor patients under the care of a competent person. The marketing website and account registration are not directed at children.
9. Changes
We may update this policy from time to time. Material changes are notified to practice account owners by email and the effective date above is updated. The current version is always at practi-cal.co.za/privacy.
10. Contact
Practical Software (Pty) Ltd · Information Officer: Keagan Meiring · info@practi-cal.co.za