Sep 28, 2026 · @Someone
Administer Privacy Policy (POPIA)
1. Who we are
This policy explains how your personal information, including your health information, is collected and protected when you use Administer, in line with the Protection of Personal Information Act 4 of 2013 (POPIA).
Administer is an online platform for booking appointments, managing patient records and handling billing at private medical practices in South Africa. It is owned and operated by DSK Technologies (Pty) Ltd, registration number 2020/535967/07 (“DSK Tech”, “we”, “us”).
Two parties look after your information, and POPIA gives each a different role:
| Party | POPIA role | What they are responsible for |
|---|---|---|
| Your medical practice (for example, your doctor's rooms) | Responsible party | Your medical records, clinical notes, appointments and invoices at that practice. The practice decides why and how this information is used. |
| DSK Tech (Administer) | Operator for the practice | Storing and processing the practice's records on the practice's behalf, under a written agreement with the practice. |
| DSK Tech (Administer) | Responsible party | Your Administer login account, website visits, and messages you send directly to us. |
This policy applies to everyone who uses Administer: patients, doctors, practice staff and website visitors. Your practice may also have its own privacy notice, which you can ask them for.
2. Information we collect
We only collect information that is needed to book, deliver and bill for your medical care.
| Type | Examples | Where it comes from |
|---|---|---|
| Identity and contact details | Name, surname, date of birth, SA ID or passport number, email, phone number, address | You, or practice staff who register you |
| Medical aid details | Scheme name, plan, membership number, main member details, dependant code | You or the practice |
| Health information | Reason for visit, symptoms, clinical notes, diagnoses (ICD-10 codes), procedures, tests, follow-ups, referrals | Your doctor and practice staff |
| Appointment and billing records | Bookings, cancellations, invoices, tariff codes, payments | Created as you use the service |
| Account and security data | Login email, encrypted password, one-time PINs, login times, device and IP address | Created when you sign in |
| Consent records | When you accepted this policy, and any withdrawal of consent | Created when you register or change consent |
Special personal information. Health information is “special personal information” under POPIA. It receives extra protection: it is only processed with your consent, or where POPIA specifically allows it for medical care, and only authorised practice staff can see it.
3. Why we use your information
Your information is used to provide you with medical services, manage your appointments, handle billing, and communicate with you about your care.
| Purpose | Lawful reason under POPIA |
|---|---|
| Booking, rescheduling and cancelling appointments | Needed to provide the service you asked for (section 11(1)(b)) |
| Recording clinical notes and your medical history | Your consent, and processing by healthcare providers for your care (sections 27 and 32) |
| Billing you or your medical aid | Needed to provide the service, and legal obligations (sections 11(1)(b) and (c)) |
| Sending booking confirmations, reminders and “doctor running late” messages by SMS, WhatsApp or email | Needed to provide the service (section 11(1)(b)) |
| Keeping your account secure (passwords, one-time PINs, login logs) | Legitimate interest in protecting your records (section 11(1)(f)) |
| Keeping records as required by law and the HPCSA | Legal obligation (section 11(1)(c)) |
We do not sell your personal information. We do not use your health information for advertising.
4. Who we share your information with
Your information is only shared where it is needed for your care, your billing, or to run the platform securely.
| Recipient | What is shared | Why |
|---|---|---|
| Your medical aid scheme | Identity, membership details, ICD-10 and tariff codes, invoice amounts | To submit and process your claims |
| Other healthcare providers involved in your care (for example, specialists, labs, radiologists) | Relevant clinical information and referral details | To continue or support your treatment |
| Service providers who help run Administer (hosting, email, SMS and WhatsApp delivery) | Only what each needs to do its job | To store data and send your messages. Each is bound by a written agreement to keep your information confidential and secure. |
| Authorities, courts or regulators | Only what the law requires | Where we or your practice are legally required to disclose it |
Practice staff can only see what their role needs. For example, reception staff see appointments but not full clinical notes, and billing staff see codes needed for invoicing.
5. Where your information is stored and how it is protected
Storage outside South Africa. Administer’s database is hosted by Supabase in [data centre region, e.g. EU (Frankfurt)], and the website is hosted by Vercel. Messages may be sent through Twilio in the United States. We only use providers in countries with adequate data protection laws, or who are bound by written agreements that give protection equal to POPIA (section 72).
Security measures. We protect your information with:
- Encryption of data while it is sent and while it is stored
- Two-step login (one-time PIN) for practice staff
- Role-based access, so staff only see what their job requires
- Separation between practices, so one practice cannot see another’s patients
- Audit logs recording who viewed or changed records, and when
- Regular security reviews and updates
If a breach happens. If we believe your information has been accessed by someone unauthorised, we will notify the Information Regulator and your practice as soon as reasonably possible. You will be notified directly, unless the law or a law-enforcement request delays this (section 22).
6. How long we keep your information
Medical records are kept for as long as the HPCSA guidelines and other laws require, and then securely deleted or anonymised.
| Record | Kept for |
|---|---|
| Adult medical records | At least 6 years after your last visit |
| Records of children (under 18) | Until the patient's 21st birthday, or 6 years after the last visit, whichever is longer |
| Invoices and payment records | 5 years, as required by tax law |
| Account and login logs | [12 months] after the account is closed |
7. Children
A child under 18 can only be registered by a parent or legal guardian, who gives consent on the child’s behalf (section 35). The parent or guardian manages the child’s bookings and can exercise the child’s privacy rights.
8. Marketing
We will never send you marketing messages unless you have opted in. You can opt out at any time using the link in the message or by contacting us. Appointment reminders and billing messages are part of the service and are not marketing.
9. Your rights
You can ask us or your practice at any time to do any of the following, free of charge:
- See your information — ask what information is held about you and who it was shared with (section 23)
- Correct it — ask for wrong or outdated information to be fixed (section 24)
- Delete it — ask for information to be deleted, where the law does not require us to keep it (section 24)
- Object — object to your information being used for a particular purpose (section 11(3))
- Withdraw consent — withdraw your consent at any time from Settings → Privacy in your patient portal, or by contacting us. This does not affect processing that already happened, and medical records the law requires to be kept will still be kept.
- Complain — lodge a complaint with the Information Regulator
We will respond to your request within 30 days. We may ask you to prove your identity first, to protect your records.
Information Regulator (South Africa)
- Address: Woodmead North Office Park, 54 Maxwell Drive, Woodmead, Johannesburg, 2191
- Phone: 010 023 5200 · Toll-free: 0800 017 160
- General enquiries: enquiries@inforegulator.org.za
- POPIA complaints: POPIAComplaints@inforegulator.org.za
- Website: inforegulator.org.za
Source for contact details: Information Regulator website and Standard Bank complaints page (complaints email). Check these again before publishing.
10. Contact us
For questions about your medical records, contact your practice first. For anything about Administer itself, contact our Information Officer.
- Information Officer: Vishan Naidoo
- Company: DSK Technologies (Pty) Ltd, registration number 2020/535967/07
- Email: privacy@administer.health
- Phone: +27 43 748 0111
- Address: 13D Shamrock Sands, Avalon Road, East London, Eastern Cape, 5241
11. Changes to this policy
We may update this policy when the law or our services change. The latest version will always be at administer.health/privacy, with the date it was last updated. If a change affects how your health information is used, we will notify you and ask for your consent again where required.
Last updated: [date of publishing]