Privacy · POPIA
MidClinic Privacy Policy
This notice explains how MidClinic handles personal information under South Africa’s Protection of Personal Information Act, 2013 (POPIA). It is written for patients and partners who use the MidClinic app with a participating clinic.
1. Who is responsible
| Role | Party | What they do |
|---|---|---|
| Responsible party (clinic) | Your participating clinic (for example Essence Mother & Baby Clinic or Nurturers Nest) | Holds your care record, decides why and how clinic care data is processed, and answers requests to access, correct or delete clinic-held information |
| Operator | SafeTrak (Pty) Ltd | Runs the MidClinic app and the technical systems that carry your clinic’s patient portal, under instruction from the clinic |
SafeTrak does not sell MidClinic as a consumer health product independent of a clinic relationship. You join through your clinic’s invite or clinic code.
2. What the app collects
MidClinic collects only what is needed to sign you in, show the programmes your clinic has opened for you, and keep the app working safely. Based on the current MidClinic patient app and live clinic bridges:
2.1 Account and contact
- Clinic code you enter to choose your clinic
- Email address used to receive a one-time sign-in code (live sign-in is email-only; SMS is not used)
- One-time code and short-lived session token (stored securely on the device)
- Display first name and opaque subject identifier from your clinic account
- Partner invite destination (email or phone) if you invite a partner — stored masked; the raw destination is not echoed back in the app
2.2 Health and care information
Only programmes you are enrolled in are shown. An FP-only account never sees pregnancy or immunisation screens. Depending on enrolment, the app may process:
- Pregnancy journey data (week, BANC antenatal plan, visits, maternal vitals and care flags the clinic shares)
- Kick counts, hospital bag checklist, birth plan notes you enter
- Family planning method, pill log and side-effect notes you enter
- Postnatal and feeding notes
- Child immunisation (EPI) schedule status and growth measurements (WHO charts), including a child’s details held under a parent’s account
- Clinic-released results and documents
- Appointment and visit-request details
- POPIA consent version and acceptance timestamp
2.3 Messages and preferences
- Message threads with your clinic (text you send; clinic replies)
- Notification preference toggles (which reminder categories you allow)
2.4 Device and technical
- Secure session token on the device
- Limited offline cache of non-sensitive reads (health and money details are not written to durable offline storage)
- When push notifications are enabled and the native module is available: Expo push token, platform (iOS/Android), and an opaque device id registered with the clinic portal
- App version (optional on device registration)
- Standard server logs needed to run the service (for example rate-limit and error correlation ids that do not include diagnoses or raw identifiers in client error reports)
2.5 Money (clinic billing view)
- Account balance, open invoices, paid ledger and package/deposit status as recorded by your clinic
Not collected by the current app build: advertising ID; analytics or crash-reporting SDK identifiers; payment-card numbers; camera, microphone, precise location or contacts (those Android permissions are blocked in the app config). In-app card checkout is not enabled; there is no payment SDK in the patient app.
3. Purposes
- Authenticate you and keep your session secure
- Show your clinic’s care programmes, visits, messages, results and documents
- Let you add patient-reported notes the clinic needs (for example kicks, pill log, visit requests)
- Support partner sharing only for scopes you allow
- Send care reminders you opt into (when push is configured)
- Show clinic billing status so you can arrange payment with the clinic
- Meet POPIA and security obligations (audit, rate limits, fraud/abuse prevention)
4. Sharing
- With your clinic — your care record is shared with the clinic that invited you; they are the responsible party
- With a partner — only if you invite them, and only for the scopes you allow; you can revoke access
- With SafeTrak staff — only as needed to operate and support the service, under clinic instruction
- Service providers — infrastructure used to host portals and send email one-time codes, under contracts that require POPIA-appropriate protection
We do not sell personal information. We do not use Advertising ID. We do not put diagnoses, results or method names on the lock screen.
5. Security
- Data in transit uses HTTPS / TLS
- Session tokens are stored in platform secure storage on the device
- OTP request and verify endpoints are rate-limited
- Programme gating prevents cross-programme screens for accounts that are not enrolled
- Client error reporting is designed to avoid patient identifiers
No method of transmission or storage is perfectly secure; we work to protect information with appropriate technical and organisational measures.
6. Retention
- Clinic care records are retained by the responsible clinic under its clinical and legal retention rules
- Session tokens and one-time codes expire (codes typically within about 10 minutes; sessions are time-limited)
- Push device registrations remain until you sign out, revoke notification permission, or ask for removal
- Operator logs are kept only as long as needed for security and operations
7. Your rights (POPIA)
You may request access to, correction of, or deletion of personal information, or object to certain processing, subject to law and clinical retention duties.
How to ask
- In the app — open You → Privacy & consent for the current notice; use clinic contact details in the app for care-record requests
- By email — write to info@safetrak.co.za (SafeTrak operator) and, for care-record changes, your clinic as responsible party
- Deletion of clinic-held records is fulfilled through the clinic; SafeTrak assists as operator
You may also contact the Information Regulator (South Africa) if you have an unresolved complaint.
8. Children
MidClinic is aimed at adults (18+) who are patients or partners of a clinic. Children’s information appears only as part of a parent or guardian’s immunisation and growth records managed with the clinic. The app is not directed at children and is not designed for unsupervised use by children.
9. International transfers
Care data for participating South African clinics is intended to stay in South Africa. If a sub-processor outside South Africa is ever required, SafeTrak will ensure an appropriate POPIA transfer mechanism and update this notice.
10. Changes
We may update this notice. The effective date at the top will change, and material updates will be reflected at https://midclinic.co.za/privacy and in the in-app consent copy when a new consent version is required.
11. Contact
Operator
SafeTrak (Pty) Ltd
Registration: 2026/259268/07
Privacy email: info@safetrak.co.za
Listing / support phone: +27 76 674 6483
Your clinic (responsible party)
Use the clinic name, email and phone shown in MidClinic after you sign in (for example Nurturers Nest inquiries: admin@nurturersclinic.co.za).