Privacy Policy

My Doctors Room is owned and operated by Bluebase Dev Agency. We play two different roles under POPIA:

• Responsible party for information about the practices that use My Doctors Room, their staff accounts and visitors to our website.
• Operator for information about patients. Each medical practice is the responsible party for its own patients' information; we process it only on the practice's behalf and instructions, to provide My Doctors Room.

• Practice and staff accounts: names, email addresses, roles, practice name, practice number, address, phone, logo, working hours and settings.
• Patient information captured by practices: identity and contact details, ID or passport number, date of birth, emergency contacts, medical aid details, appointments, consent records, invoices, uploaded documents and — for clinical staff only — allergies, conditions, medication and consultation notes. Health information is special personal information under POPIA and receives the strictest access controls in My Doctors Room.
• Online bookings: details a patient enters on a practice's booking page (name, phone, email, optional ID number and reason for visit), passed to that practice.
• Technical information: server logs such as IP address, browser type and time of request, used for security and troubleshooting. Your sign-in session is kept in your browser's local storage. We do not use advertising or tracking cookies.
• Audit records: which staff member viewed or changed patient records and when, kept so practices can account for access.

• to provide, secure, maintain and support My Doctors Room;
• to authenticate users and enforce each role's access;
• to communicate with practices about their accounts and the service;
• to meet legal obligations and respond to lawful requests.

We do not sell personal information, and we do not use patient information for marketing, advertising or to train artificial-intelligence models.

Your doctor's practice decides what information about you is captured in My Doctors Room and is responsible for it. To see, correct or ask questions about your records, or to withdraw consent, contact your practice directly. If you contact us, we will refer your request to the practice and assist it as its operator.

We use a small number of service providers to run My Doctors Room:

• Database, authentication and file storage — Supabase, with My Doctors Room's data stored on servers in London, United Kingdom.
• Application hosting — Vercel, which runs My Doctors Room's servers in London and delivers pages through its global network.
• Fonts — the website loads typefaces from Google Fonts, which receives your IP address and browser information when a page loads.
• Email delivery — when email notifications are enabled, an email provider sends messages on our behalf.

These providers process information only to deliver their services to us. We may also disclose information where the law requires it, for example under a court order.

Because My Doctors Room's servers are in the United Kingdom, personal information is transferred outside South Africa. Section 72 of POPIA allows this where the recipient is bound by law, binding corporate rules or a binding agreement that provides an adequate level of protection. We use providers that are subject to comprehensive data-protection law and contractual data-processing terms, and we will tell practices before moving their data to a different region.

• All connections to My Doctors Room are encrypted (HTTPS).
• Each practice's data is separated by rules enforced in the database itself, and clinical information is restricted to clinical roles.
• Documents are stored privately and opened only through short-lived links.
• Every staff member has their own login, and access is recorded in an audit log.
• If we believe personal information has been compromised, we will notify the affected practices without undue delay so that they and we can meet POPIA's notification duties.

Account information is kept while the practice uses My Doctors Room and for as long afterwards as South African law requires. Patient information is kept on the practice's instructions; when a practice cancels, we provide an export on request within 30 days and then delete its data, except where we are legally required to keep it. Practices remain responsible for retaining health records for the periods the HPCSA requires — currently at least six years after a record becomes dormant, and longer for minors and mentally incompetent patients.

Under POPIA you have the right to:

• ask whether we hold personal information about you and request access to it;
• ask for it to be corrected or deleted;
• object to processing on reasonable grounds; and
• complain to the Information Regulator (South Africa) at inforegulator.org.za.

Patients should first contact their practice, as explained in section 4.

Practices may capture information about patients under 18. Under POPIA, a child's personal information may only be processed with the consent of a competent person (usually a parent or guardian) or on another ground allowed by section 35 of POPIA. Separately, section 129 of the Children's Act allows a child over 12 of sufficient maturity to consent to their own medical treatment. Practices are responsible for applying these rules to their patients.

As a private body, Bluebase Dev Agency keeps a manual under section 51 of the Promotion of Access to Information Act, 2000 (PAIA), describing the records we hold and how to request access to them. You can obtain a copy from our information officer at the contact details below. Requests for patient records should be made to the patient's practice.

We may update this policy as My Doctors Room changes. The effective date at the top shows the latest version; material changes will be communicated to practice owners.

Information officer: [information officer name — to be confirmed]
Email: [privacy / information officer email — to be confirmed]
Address: [physical address for service of legal documents — to be confirmed]

See also our Terms of Use.