Privacy Policy — RapidCare SA

1. Introduction

RapidCare SA ("we", "us", "our") is committed to protecting your personal information in accordance with the Protection of Personal Information Act, 2013 (POPIA) of South Africa. This Privacy Policy explains how we collect, use, store, and protect your data.

2. Information We Collect

• Account Information: Email address, name, and hashed password when you register.
• Subscription Data: Payment transaction records processed securely through Payfast. We do not store credit card numbers.
• Usage Data: Pages visited, protocols viewed, and features accessed to improve the platform.
• Reference History: We keep a log of which protocols, drugs, calculators, and ICD-10 codes you view so that we can show your recent items and favorites. This does not include any patient-identifiable information.

3. Information We Do Not Collect

• Patient Data: RapidCare SA does not store identifiable patient data. Users should not enter patient-identifiable information into any feature of the platform.
• Biometric Data: Biometric authentication (fingerprint/face) is processed locally on your device and never transmitted to our servers.

4. How We Use Your Information

• To provide and maintain the RapidCare SA service.
• To process subscriptions and payments via Payfast.
• To improve platform content, features, and user experience.
• To send essential service notifications (e.g., subscription status, guideline updates).

5. Data Storage and Security

• Data is stored on secure, encrypted servers.
• Passwords are hashed using bcrypt and never stored in plain text.
• Payment processing is handled by Payfast, a PCI-DSS compliant payment provider.
• Access to personal data is restricted to authorised personnel only.

6. Third-Party Services

• Payfast: Processes payments. Subject to Payfast's own privacy policy.
• Emergent (Google OAuth): If you sign in with Google, the Emergent OAuth proxy verifies your Google identity. We receive only your verified email, name, and avatar.
• Google OAuth: Optional sign-in method. Subject to Google's privacy policy.

7. Your Rights Under POPIA

You have the right to:

• Access your personal information held by us.
• Request correction of inaccurate personal information.
• Request deletion of your personal information.
• Object to the processing of your personal information.
• Lodge a complaint with the Information Regulator of South Africa.

To exercise any of these rights, contact us at support@rapidcare.co.za.

8. Data Retention

• Account data is retained for the duration of your account.
• Upon account deletion, personal data is removed within 30 days.
• Anonymous, aggregated usage data may be retained for platform improvement.

9. Cookies, Local Storage & Analytics

RapidCare SA uses local storage (not cookies) to save your preferences, authentication tokens, and theme settings. We do not use third-party advertising or behavioural-tracking cookies.

We use PostHog, a product-analytics and session-recording service, to understand how the platform is used and to improve it. This may include session replay (a reconstruction of page interactions such as clicks and navigation). We configure PostHog to mask text inputs so that sensitive information you type — including email addresses and any free-text you enter into forms such as the feedback form — is not captured in recordings. We never intentionally record patient-identifiable information, and you should never enter such information into the platform. PostHog processes this data as our processor; see the PostHog privacy policy for details.

10. Children

RapidCare SA is intended for qualified healthcare professionals and is not directed at individuals under the age of 18.

11. Changes to This Policy

We may update this Privacy Policy from time to time. Changes will be posted on this page with an updated revision date.

12. Contact

For privacy-related queries:

Email: rapidcaresasupport@gmail.com
Website: rapidcare.co.za

Information Regulator (South Africa):
Website: https://inforegulator.org.za