1. Purpose
This policy records how PediCheck Pty Ltd (“PediCheck”, “we”) meets POPIA when we collect, store, use, share, or destroy personal information in connection with pedicheck.co.za, the waitlist, emails and WhatsApp we send, our staff CRM, and the PediCheck app when it launches.
PediCheck is a parent-facing digital product. It is not a medical device, is not registered with SAHPRA as a medical device, and is not used to diagnose, treat, or monitor a medical condition. We do not, on the waitlist, keep a medical record.
2. Responsible party and Information Officer
| Responsible party | PediCheck Pty Ltd |
|---|---|
| Registration number | [to be inserted] |
| Registered address | Granger Bay Court, 49 Beach Road, Mouille Point, Cape Town, South Africa |
| Information Officer | [Name to be inserted] · Head of PediCheck Pty Ltd |
| Deputy Information Officer | [Name to be inserted] |
| Contact | doctors@pedicheck.co.za |
The Information Officer is responsible for POPIA and PAIA compliance, including operator contracts, security measures, and data-subject requests. PediCheck will register its Information Officer with the Information Regulator as required.
3. Personal information we process
Waitlist and website
- identity: first name, last name;
- contact: email, WhatsApp number;
- child-related: age range of a child in the parent’s or guardian’s care (not the child’s name);
- consent: that consent was given, the wording version, and the time;
- source and security: referrer, UTM tags if present, browser user agent, and network address used to limit abuse.
Correspondence
If you email or message us, we keep what you send so we can reply.
Staff CRM and operations
Staff accounts, waitlist administration, unsubscribe status, email delivery events we need to run the list, and (for authorised staff) internal finance records of PediCheck Pty Ltd. Those finance records are not parent waitlist data.
What we do not collect on the waitlist
We do not collect a child’s name, identity number, medical scheme details, diagnosis, symptoms, photographs of a child, or location beyond what a network address incidentally reveals. If the app later needs health information to run a check-in, we will tell you before you enter it, state the purpose, and take a fresh consent where POPIA requires it.
4. Children
PediCheck is for parents and legal guardians aged 18 or older. We do not knowingly open a waitlist record for a child acting alone.
An age range is personal information about a child. Under POPIA we process a child’s information only with a competent person’s consent — here, the parent or guardian who submits the form — and only for the waitlist and launch purposes described in this policy. We do not market to children.
5. Special personal information
POPIA treats health information as special personal information. PediCheck is not a medical device and the waitlist is not a health record. We do not collect special personal information on the waitlist as at the date of this policy. If that changes in the app, we will only process it on a ground in section 27 of POPIA (including consent, or another lawful ground that then applies) and with the extra care that information deserves.
6. Purpose and lawful grounds
We process personal information only for:
- placing you on the waitlist and addressing you by name;
- sending the SA Emergency Numbers card and welcome email;
- sending the Sunday notes and then monthly launch updates you agreed to, until you unsubscribe;
- internal operations, including telling authorised staff that a new parent joined;
- planning launch access (including 60 days free and early access as described on the site at the time you join);
- keeping the form and service safe (spam, bots, abuse);
- meeting the law, including POPIA, PAIA, tax, and a valid information request.
Lawful grounds we rely on:
- consent (section 11(1)(a)) for waitlist communications by email and WhatsApp;
- steps at your request to enter a contract (section 11(1)(b)) to save your spot and deliver the waitlist benefits we offered;
- legitimate interests (section 11(1)(f)) to run a lawful waitlist, stop abuse, and improve a non-medical parent product, where those interests are not overridden by your rights;
- legal obligation (section 11(1)(c)) where the law requires us to keep or disclose a record.
You may withdraw consent for marketing at any time. Unsubscribing stops launch emails. It does not always mean we must delete every record immediately if we still need it for a legal purpose.
We do not sell personal information. We do not use waitlist data for open advertising networks.
7. Conditions for lawful processing
In practice we apply POPIA’s eight conditions as follows.
- Accountability. PediCheck Pty Ltd is the responsible party. The Information Officer oversees this policy.
- Processing limitation. We collect what the waitlist needs, from you, for the purposes above. We do not scrape third-party lists to fill the waitlist.
- Purpose specification. The waitlist purpose is stated on the form and in this policy. We will not silently reuse waitlist data for a new, incompatible purpose.
- Further processing. Further use is limited to launch operations, security, and the law.
- Information quality. You can ask us to correct a name, email, or number. We rely on what you submit.
- Openness. This policy, the Privacy Policy, and the PAIA Manual are on pedicheck.co.za.
- Security safeguards. See section 9.
- Data-subject participation. See section 11.
8. Operators and sharing
We share personal information only with people who need it for the purposes above:
- staff of PediCheck Pty Ltd who work the waitlist and product;
- operators who host the application and database (currently Fly.io, with the service in Johannesburg) and who send email (Google Workspace, from doctors@pedicheck.co.za);
- Google Fonts, which may see a network request when you load the public pages;
- professional advisers, or a public body, if the law requires it;
- Atlantic Children’s Practice only if you are also their patient under a separate relationship, or if you later buy ACP Priority and that service needs the information — not merely because you joined the PediCheck waitlist.
Operators process information under our authority. We remain responsible. We will put written operator terms in place that meet section 21 of POPIA.
9. Security
We take reasonable technical and organisational steps to protect personal information against loss, misuse, and unauthorised access. The public waitlist form does not expose other parents’ details. Staff CRM access is limited to authenticated accounts. Passwords are stored hashed. The public site and CRM are served over HTTPS.
No internet service is perfectly secure. If we become aware of a security compromise that is reasonably likely to affect you, we will notify you and the Information Regulator as soon as reasonably possible after we discover it, as section 22 of POPIA requires.
10. Retention and destruction
We keep waitlist records until you ask us to delete them (and we no longer have a legal reason to keep them), or until we no longer need them for launch, a reasonable period of support after launch, and any complaint or tax record that the law requires us to hold.
Security logs are kept only as long as they are useful for that purpose. When we no longer need a record we delete or de-identify it in a way that is reasonable for the systems we use.
11. Your rights
Subject to POPIA, you may:
- ask whether we hold personal information about you, and request a description or copy;
- ask us to correct or delete information that is inaccurate, irrelevant, excessive, out of date, incomplete, misleading, or obtained unlawfully;
- withdraw consent for marketing, or object to processing on legitimate-interest grounds;
- lodge a complaint with the Information Regulator.
Email doctors@pedicheck.co.za. Unsubscribe links are in our emails. We may need to verify that we are speaking to you. Formal access to records follows the PAIA Manual and Form 2.
We will handle a request within a reasonable time, and within the periods POPIA and PAIA set where those Acts apply.
12. Direct marketing
Launch updates by email and WhatsApp are sent only after you join the waitlist and agree on the form. You can stop them at any time. We do not buy lists or send unsolicited commercial electronic communications of the kind section 69 of POPIA forbids.
13. Cross-border transfers
Some operators (including email and parts of application infrastructure) may process information outside South Africa. We only transfer personal information from South Africa where section 72 of POPIA allows it — typically because the operator is subject to a law, binding corporate rules, or a written agreement that provides an adequate level of protection, or because you consent, or another ground in section 72 applies.
14. Automated decision-making
The waitlist does not make a legal or similarly significant automated decision about you. PediCheck, when it launches, is a structured information tool. It is not a medical device and does not issue a diagnosis. It does not, by itself, decide whether you receive emergency care.
15. Complaints
Please write to us first so we can try to put it right. You may also complain to the Information Regulator of South Africa:
JD House, 27 Stiemens Street, Braamfontein, Johannesburg, 2001
PO Box 31533, Braamfontein, Johannesburg, 2017
Tel: 010 023 5200
inforegulator.org.za
POPIAComplaints@inforegulator.org.za
16. Changes
We will post updates on this page with a new date. If we start collecting health information in the app, we will say so before you enter it.