Privacy Policy | Medora OS

Protection of Personal Information Act 4 of 2013

1. Introduction

Medora OS Inc is committed to protecting your privacy and ensuring that your personal information is processed lawfully, transparently, and securely in accordance with the Protection of Personal Information Act 4 of 2013 (POPIA), the National Health Act, and other applicable South African laws.

This Privacy Policy explains how Medora collects, uses, stores, discloses, and safeguards personal information when you access or use the Medora digital health platform, mobile application, website, AI-enabled tools, and related services (collectively, the "Services").

By using the Services, you acknowledge that your personal information will be processed as described in this Privacy Policy.

2. Responsible Party

Responsible Party: Medora OS Inc, Republic of South Africa. Medora OS Inc acts as the responsible party for the processing of personal information under POPIA.

3. Information We Collect

We may collect the following categories of personal information:

Identity information: full name, identity number, date of birth, gender
Contact information: email address, phone number, physical address
Health information: medical history, symptoms, diagnoses, prescriptions, lab results, clinical notes
Payment information: billing details processed securely through Stripe
Technical information: device data, IP address, usage logs
Communications: messages exchanged through the platform

4. Purpose of Processing

Your personal information is processed for the following purposes:

Facilitating telehealth consultations with registered healthcare practitioners
Operating and improving the platform and AI tools
Processing payments and managing subscriptions
Complying with legal and regulatory obligations
Communicating with you about your account and services
Clinical record-keeping as required by law

5. Legal Basis for Processing

Processing of your personal information is lawful where it is: necessary for the performance of a service you have requested; required by law (including the National Health Act and POPIA); based on your consent; or necessary to protect your vital interests or those of another person.

6. Special Personal Information — Health Data

Health information constitutes special personal information under POPIA.

Medora processes health data only with your explicit consent or as required or permitted by applicable law, including for purposes of providing healthcare services and maintaining clinical records.

7. Sharing of Information

Your personal information may be shared with:

Independent registered healthcare practitioners involved in your care
Payment processors (Stripe) for billing purposes
Technical service providers under data processing agreements
Regulatory and law enforcement authorities as required by law

8. Data Retention

Personal information and health records are retained in accordance with applicable South African law, including the National Health Act, POPIA, and professional regulatory requirements.

You may request deletion of non-clinical personal information subject to applicable legal obligations.

9. Security

Medora implements administrative, technical, and organisational safeguards to protect your personal information.

No electronic system can guarantee absolute security. You acknowledge the inherent risks of electronic communication.

10. Your Rights Under POPIA

You have the right to:

Request access to your personal information
Request correction of inaccurate information
Object to processing in certain circumstances
Request deletion of personal information (subject to legal retention obligations)
Lodge a complaint with the Information Regulator of South Africa

11. Cross-Border Processing and Transfers

Medora may store, process, transmit, or permit access to personal information, including health information, through service providers, cloud infrastructure providers, and technology partners located outside the Republic of South Africa.

As a result, personal information may be transferred to and processed in jurisdictions that may have data protection laws that differ from those of South Africa, including the United States.

Medora will take reasonable steps to ensure that any cross-border transfer of personal information is subject to appropriate safeguards and is carried out in accordance with applicable data protection laws, including the Protection of Personal Information Act 4 of 2013 (POPIA).

12. Contact

For privacy-related queries or to exercise your rights, contact: support@medora-os.co.za

Information Regulator (South Africa): inforeg@justice.gov.za