Privacy policy

Everything clinical lives on your device, held in the operating system’s secure store (iOS Keychain / Android Keystore) and encrypted. Lab results you viewed with the former NHLS lab-results feature, and any NHLS login you saved for it, stay on your device, encrypted, until you remove them (section 3). The records you create — your patient list, consultation notes, prescriptions, sick notes, referrals, invoices, letters and handovers, and the proof log behind each issued document — are kept on your device, under your control, until you delete them, because you are the clinician responsible for that record. We do not keep a copy: if you back up, the backup file is encrypted with a passphrase only you know. None of this is transmitted to, or stored on, our servers — unless you choose to share specific records with your own practice team, in which case they are end-to-end encrypted first (section 5). Your HPCSA number is stored on your device the same way, and is additionally linked to your account on our servers solely so we can confirm your registration against the public HPCSA register (section 2).

Our servers hold what is needed to run your account and subscription: your account identifier (the email you sign up with), your subscription status, and — for doctors — the HPCSA number you enter at setup, used only to confirm your registration against the public HPCSA register. If you use practice teams, they also relay and store the end-to-end encrypted practice records described in section 5, which we cannot decrypt. No patient names, ID numbers, MRN/episode numbers, lab results, prescriptions or sick notes are ever stored on our servers in readable form.

PracProof previously offered an optional feature that let a doctor view NHLS lab results on their phone, using their own NHLS login. At the request of the NHLS, this feature is being withdrawn: from 9 October 2026 the app no longer connects to any NHLS system. While the feature was available, your device connected to the NHLS portal directly, using your own credentials, and read the results on the device; the results and your NHLS login never passed through, or were stored on, our servers. Any results and NHLS login saved on your phone stay there, encrypted, until you remove them — from Account (“Remove my saved NHLS login”) or by erasing everything on this phone.

PracProof includes optional AI features: drafting a document from your typed notes, recording a consultation to draft a note, and photographing a sticker or a medical report to read its details. These are the only features that send information off the device, and each one is optional with a manual alternative, requires the patient’s consent before you use it, and produces a draft that you review, correct and sign. What is sent differs by feature: when drafting from typed notes, the patient’s direct identifiers (name, ID number, contact details, dates) are removed on this device first, so the AI sees only the clinical text; recording a consultation, and photographing a sticker or report, send the audio or photo as-is, because they cannot be de-identified. The information is processed by a third-party AI provider via our secure gateway — currently Google, with Anthropic as an automatic backup for text drafting if Google is unavailable — to produce the draft; it may be processed outside South Africa, on paid tiers that are not used to train AI models, and it is not stored after the draft is produced. Our gateway keeps no copy of the audio, image, text or result — only an anonymous count of requests for usage limits. Standard calculators and the document verifier remain fully on-device and send nothing.

If you create or join a practice and choose to share records with it — a patient, consult handovers, the day’s outpatient flow, appointments and, where the practice owner switches it on, the day’s prescriptions and documents for dispensary printing — those records are synchronised between your practice’s phones through our servers. They are end-to-end encrypted on your phone before they are sent: the encryption keys exist only on your practice’s devices, so our servers relay and store data we cannot decrypt. Nobody outside the practice, including PracProof, can read what is shared. Removing a member re-secures the practice with a fresh key for everything shared afterwards; copies a colleague’s phone has already synchronised remain on that phone under their professional control, as with any clinical record. A doctor’s drawn signature never syncs — a colleague’s phone prints documents without it.

The PracProof app is free. The optional AI Scribe add-on is a paid monthly subscription, and any future add-on would work the same way. Payment is taken on our website, never inside the app, by our payment provider, Paystack: your card details are entered with Paystack and processed under its own security and privacy terms. We never see or store your card number. Our servers receive only what is needed to run your plan — your subscription status, a subscription reference from Paystack, and the date your current month ends. A free trial takes no card and never becomes a paid plan by itself; cancelling stops the next month’s billing. Refund and billing questions go to the contact in section 15.

We keep simple, anonymous counters of how often app features are used — for example, the total number of times the app was opened, a medicine reference page was viewed, or, while that feature was available, a lab-results search succeeded or failed (and why, such as a timeout), on a given day. These counts contain no name, email, account or device identifier, no location, and no patient data: a request only increments a number. We use them to understand which content matters and, in future, to report aggregate interest levels (never individual behaviour) to content partners. The document verifier is deliberately excluded — verification runs entirely on your device and sends nothing.

Account and subscription data is processed by our authentication and database provider (Supabase) in a European (London) data centre, chosen because it offers the lowest latency to South Africa in a jurisdiction with data-protection laws recognised as providing adequate protection. Any such cross-border processing is done in line with POPIA.

From Account you can remove issued documents from this phone (“Delete saved documents”), wipe every patient, note and document stored on this phone (“Erase everything on this phone”), or close your account entirely (“Delete account”, which also removes your account and subscription records from our servers). You can toggle history caching and AI on or off at any time. Under POPIA you may ask us to confirm, access, correct or delete the personal information we hold about you (your account and subscription details), and you may object to processing or lodge a complaint with the Information Regulator of South Africa. To exercise any of these, contact us using the details below.

On-device data is encrypted in the OS secure store. Connections to our services use encrypted (HTTPS) transport. Practice sharing adds end-to-end encryption on top: the keys live only on your practice’s devices. Because patient-identifiable data stays on your device (or reaches our servers only as ciphertext we cannot decrypt), the risk from a server-side breach is minimised by design. You are responsible for the security of the device itself (screen lock, OS updates).

We do not sell or rent your data. We do not share your personal information with third parties for their own marketing. We do not store patient-identifiable information on our servers in readable form — what your practice shares is end-to-end encrypted with keys we never hold. And if sponsored material ever appears in the app, it will be clearly labelled as such.

PracProof is intended for use by registered clinicians and is not directed at children. We do not knowingly collect personal information from children through the app. Patient information you view remains on your device and under your professional control as the treating clinician.

Lab results viewed with the former NHLS lab-results feature stay on your device, encrypted, until you remove them; they were never stored on our servers. The clinical records you create in the app stay on your device until you delete them — they are your professional records, and the law expects you to keep them for a set period. Audio recorded for the AI Scribe is used to produce the draft and then deleted from our gateway (within 24 hours at most, even if drafting is abandoned). End-to-end encrypted practice records are retained while your practice uses the sharing features, so its phones can stay in sync. Account and subscription data is retained while your account is active and for a reasonable period afterward to meet legal, tax and audit obligations, then deleted or anonymised.

We may update this policy as the app evolves or the law changes. We will revise the version date below and, for material changes, tell you in the app. Continued use after an update means you accept the revised policy.

For any privacy question or to exercise your rights, contact the PracProof Information Officer at admin@pracproof.co.za. Responsible party: PRACPROOF (PTY) LTD (registration 2026/509315/07).