Terms & Conditions, Privacy Policy & Compliance Framework

01Definitions

• Applicable Law means all laws, regulations, directives, professional rules, and regulatory requirements applicable to the processing of personal information and the delivery of healthcare-related services in South Africa, including POPIA, the National Health Act 61 of 2003, ECTA 25 of 2002, PAIA 2 of 2000, and relevant HPCSA rules and guidelines.
• Special Personal Information has the meaning assigned in POPIA and includes health information, biometric information, identity numbers, and medical aid information.
• Controller / Responsible Party means the healthcare practice, clinician, or institution that determines the purpose and means of processing Patient Data.
• Operator means Africa Care when processing Patient Data on behalf of the Controller.
• Patient Data means any personal information, health records, referrals, scans, prescriptions, clinical notes, medical aid information, identity documents, and related information processed through the Platform.

02Nature of the Platform

The Platform is a clinical workflow, communication, documentation, referral, scheduling, and practice-management system. Unless expressly stated otherwise in writing, the Platform is not intended to diagnose, treat, cure, prevent, or independently make clinical decisions, and no functionality should be interpreted as a substitute for professional medical judgment.

Any artificial intelligence or automated assistance features provided through the Platform generate draft outputs only. All AI-generated notes, summaries, referrals, coding suggestions, prescriptions, or recommendations must be independently reviewed, verified, amended where necessary, and formally approved by a duly qualified healthcare practitioner before use.

03Eligibility and Authority

1. You warrant that you are at least 18 years old and legally competent to enter into this agreement.
2. If you accept these Terms on behalf of a practice, hospital, or other entity, you warrant that you have authority to bind that entity.
3. Clinicians warrant that they hold all licences, registrations, and professional authorisations required by Applicable Law and the HPCSA (or other relevant professional body).

04User Accounts and Security

1. You must provide accurate and complete registration information and keep it updated.
2. Accounts are personal and may not be shared.
3. You are responsible for all activity occurring under your credentials.
4. You must immediately notify Africa Care of any suspected unauthorised access, credential compromise, or security incident.
5. Africa Care may enforce password complexity requirements, multi-factor authentication, session controls, device restrictions, and other security measures.

05Permitted Use

You may use the Platform solely for lawful healthcare, administrative, operational, and related professional purposes authorised by your organisation and Applicable Law. You may not:

• Use the Platform for unlawful, fraudulent, deceptive, or unauthorised purposes.
• Upload malicious code, interfere with security controls, or attempt unauthorised access.
• Copy, reverse engineer, scrape, or exploit the Platform except as permitted by law.
• Use AI outputs without professional review and approval.
• Disclose Patient Data to unauthorised persons.

06Patient Consent and Clinical Responsibility

1. The Controller is responsible for obtaining all patient consents required by Applicable Law for the collection, use, disclosure, referral, storage, AI-assisted processing, and cross-border transfer (if applicable) of Patient Data.
2. The referring clinician and receiving clinician are responsible for ensuring that information sharing is lawful, clinically justified, and properly authorised.
3. Africa Care does not create the clinician-patient relationship and does not assume responsibility for diagnosis, treatment decisions, prescriptions, referrals, or clinical outcomes.

07Data Protection and POPIA Compliance

Africa Care processes Patient Data in accordance with POPIA and acts as an Operator where processing is performed on behalf of a healthcare practice, clinician, or institution acting as the Responsible Party.

7.1 Lawful Processing

Special Personal Information is processed only for lawful healthcare purposes, with appropriate safeguards and authority under POPIA and other Applicable Law.

7.2 Security Safeguards

Africa Care will implement and maintain reasonable technical and organisational measures including, where appropriate, encryption, access controls, role-based permissions, audit logging, vulnerability management, backup procedures, and incident response processes.

7.3 Data Subject Rights

Patients may request access, correction, deletion (where legally permissible), restriction, objection, or portability of their personal information through the relevant healthcare practice or institution acting as Responsible Party.

7.4 Cross-Border Transfers

Where data is processed outside South Africa, Africa Care will ensure compliance with POPIA requirements for transborder information flows and implement appropriate contractual and technical safeguards.

08Privacy Policy

8.1 Information Collected

Africa Care may collect and process:

• Identity and contact information;
• Professional registration and credential information;
• Patient health records, referrals, scans, laboratory results, prescriptions, and medical aid information;
• Device, log, audit, and usage information;
• Communications and support records.

8.2 Purposes of Processing

Information is processed to provide the Platform, facilitate clinical workflows and referrals, maintain security, comply with legal obligations, support authorised integrations, improve services, and provide technical support.

8.3 Legal Basis

Processing is based on consent where required, healthcare and public-interest grounds recognised by POPIA, performance of contractual obligations, compliance with legal duties, and legitimate operational interests compatible with Applicable Law.

8.4 Retention

Patient Data will be retained in accordance with statutory healthcare record retention requirements and the instructions of the Responsible Party. Africa Care may retain limited audit, security, and legal-compliance records for longer periods where required by law or reasonably necessary to establish, exercise, or defend legal rights.

8.5 Sharing of Information

Information may be shared with authorised healthcare providers, hospitals, laboratories, medical schemes, cloud and infrastructure providers, AI service providers approved by Africa Care, and regulators or law-enforcement authorities where legally required, subject to appropriate confidentiality and data-processing obligations.

8.6 Contact for Privacy Requests

Privacy requests may be directed to the Information Officer at info@africa-care.com.

09AI Use Policy and Disclaimer

Mandatory clinician review

AI-generated outputs are drafts only and have no independent clinical authority. A qualified clinician must review, verify, and approve every AI-assisted note, summary, referral, coding suggestion, prescription, or recommendation before it is used, communicated, signed, or relied upon.

1. AI-generated outputs are probabilistic and may contain errors, omissions, outdated information, or inappropriate recommendations.
2. Users must exercise independent professional judgment and verify all outputs against the patient record and accepted clinical standards.
3. No AI output may be issued to a patient, used for prescribing, submitted to a medical scheme, or relied upon for clinical decision-making without clinician review and approval.
4. Africa Care disclaims all liability arising from reliance on unreviewed AI-generated content.

10Confidentiality

1. Users must keep all Patient Data and confidential information strictly confidential.
2. Access is limited to the minimum necessary for authorised duties.
3. Administrative staff may access only the information necessary for their assigned functions and remain bound by written confidentiality obligations.
4. Confidentiality obligations survive termination of access or employment.

11Intellectual Property

All rights, title, and interest in the Platform, software, interfaces, documentation, trademarks, and related intellectual property remain vested in Africa Care and its licensors.

Patient Data and clinical records remain the property and responsibility of the relevant Responsible Party, subject to patient rights under Applicable Law.

12Integrations and Third-Party Services

The Platform may integrate with third-party services including cloud hosting providers, communication services, laboratories, medical schemes, and AI providers. Africa Care may process data through such providers under appropriate data-processing agreements and security safeguards. Africa Care is not responsible for the independent acts or omissions of third-party providers outside its reasonable control.

13Availability and Support

Africa Care will use commercially reasonable efforts to provide the Platform but does not guarantee uninterrupted, error-free, or continuous availability. Maintenance, updates, security measures, network failures, and events beyond reasonable control may affect availability.

14Regulatory and App-Store Compliance

Users acknowledge that Africa Care may implement additional notices, disclosures, declarations, or workflow restrictions required by regulators, app stores, healthcare authorities, or professional bodies, including health-app declarations, data-safety disclosures, and medical-app compliance requirements.

15Suspension and Termination

Africa Care may suspend or terminate access immediately where necessary to protect patient safety, comply with law, investigate suspected misconduct, address security risks, or enforce these Terms.

Upon termination, access rights cease immediately. Data export and deletion will be handled in accordance with Applicable Law, retention obligations, and the instructions of the Responsible Party.

16Warranties and Disclaimers

Except to the extent prohibited by law, the Platform is provided “as is” and “as available”. Africa Care disclaims all implied warranties, including warranties of merchantability, fitness for a particular purpose, accuracy, non-infringement, and uninterrupted availability.

Africa Care does not warrant that the Platform will prevent all errors, adverse events, cyber incidents, or data loss, and Users remain responsible for appropriate clinical, operational, and backup procedures.

17Limitation of Liability

To the maximum extent permitted by law:

1. Africa Care shall not be liable for any indirect, consequential, special, punitive, or exemplary damages, including loss of profits, revenue, goodwill, data, or business opportunity.
2. Africa Care shall not be liable for clinical decisions, diagnoses, treatments, prescriptions, referrals, patient outcomes, or reliance on unreviewed AI-generated content.
3. Africa Care's aggregate liability arising out of or relating to the Platform shall not exceed the total fees paid by the relevant customer to Africa Care for the six (6) months preceding the event giving rise to the claim, or R50,000 if no fees were paid, whichever is greater.

Nothing in these Terms excludes liability that cannot lawfully be excluded under South African law.

18Indemnity

You indemnify and hold harmless Africa Care, its directors, employees, contractors, and affiliates from all claims, losses, damages, penalties, costs, and expenses arising from:

• Your breach of these Terms or Applicable Law;
• Failure to obtain required patient consent;
• Unauthorised disclosure of Patient Data;
• Clinical decisions, prescriptions, referrals, or treatment provided by you or your organisation;
• Reliance on AI outputs without required professional review.

19Security Incident and Breach Notification

Users must report suspected security incidents immediately through the designated security channel. Africa Care will investigate and, where required by POPIA or other Applicable Law, support the Responsible Party in meeting notification obligations to the Information Regulator and affected data subjects.

20Audit, Logging, and Monitoring

Africa Care may maintain audit logs of access, actions, and system events for security, compliance, patient-safety, and operational purposes. Users consent to such monitoring to the extent permitted by law.

21Amendments

Africa Care may amend these Terms from time to time. Material changes will be notified through the Platform or by email. Continued use after the effective date of the amended Terms constitutes acceptance of the changes.

22Governing Law and Dispute Resolution

These Terms are governed by the laws of the Republic of South Africa.

The parties submit to the exclusive jurisdiction of the High Court of South Africa, KwaZulu-Natal Division, provided that Africa Care may seek urgent interim or injunctive relief in any court of competent jurisdiction.

23Electronic Acceptance and Records

Acceptance of these Terms by electronic means constitutes a valid electronic agreement under ECTA. Electronic records, audit logs, and acceptance records maintained by Africa Care shall be prima facie proof of the agreement and actions recorded therein.