NotaPrax — Privacy Policy

At NotaPrax, we take privacy seriously.

We understand that therapists work with sensitive and confidential patient information. This policy explains what information we collect, how we use it, and how we protect it.

1. Information We Collect

We may collect and process the following information.

Account and practice information

• Names and contact details.
• Practice information.
• Account login details.
• Subscription and billing information.
• Authorized staff information.

Patient information

• Patient names and contact details.
• Appointment information.
• Invoices and statements.
• Payment records.
• ICD-10 codes and other health-related information entered into the platform.

Technical information

• Login activity.
• Device and browser information.
• Information needed to maintain security and platform performance.

2. How We Use Information

We process information to:

• Create and manage accounts.
• Provide practice management services.
• Manage appointments and patient administration.
• Generate invoices, statements, and financial reports.
• Process and track subscription payments.
• Deliver emails and documents requested by users.
• Provide technical support.
• Maintain platform security and reliability.
• Comply with legal obligations.

We do not sell personal information or identifiable patient information.

We do not use identifiable patient records for advertising or unrelated marketing.

3. Responsibility for Patient Information

Therapists and practices are generally responsible for determining why and how their patient information is processed.

Under South Africa's Protection of Personal Information Act (POPIA), the practice generally acts as the Responsible Party.

NotaPrax generally acts as an Operator when processing patient information on behalf of a practice.

NotaPrax may act as a Responsible Party for information relating to its own customers, subscriptions, and business operations.

Practices remain responsible for providing appropriate privacy notices, establishing lawful grounds for processing, and meeting their professional obligations.

4. How We Protect Information

We use reasonable technical and organizational security measures designed to protect personal information against unauthorized access, misuse, loss, and disclosure.

Access to information is limited to authorized users and service providers who require it for legitimate purposes.

No internet-based service can guarantee absolute security.

If a security incident affects personal information, we will investigate and take appropriate action, including providing notifications required by applicable law.

5. Third-Party Service Providers

NotaPrax uses trusted third-party providers to support essential services, including:

• Secure payment processing.
• Website and application hosting.
• Email delivery.
• Authentication and account management.
• Technical infrastructure and support.

These providers may process information only for authorized purposes and subject to applicable legal and contractual safeguards.

6. International Data Processing

Some service providers may process or store information outside South Africa.

Where personal information is transferred internationally, we apply safeguards required by POPIA and other applicable laws.

7. Data Retention

We retain personal information only for as long as reasonably necessary to provide our services, meet legal obligations, resolve disputes, or protect legitimate interests.

Patient records may be subject to professional and legal retention requirements.

Canceling a subscription does not automatically delete information that must be retained.

Information that no longer needs to be retained will be deleted or de-identified in accordance with applicable law and our retention procedures.

8. Your Privacy Rights

Subject to applicable law, you may request to:

• Access personal information held about you.
• Correct inaccurate information.
• Request deletion where legally permitted.
• Object to certain processing activities.
• Raise a complaint about how information is handled.

Patients should generally contact their therapist or practice regarding records controlled by that practice.

You may also lodge a complaint with the Information Regulator of South Africa.

9. Cookies

NotaPrax may use essential cookies and similar technologies to maintain login sessions, protect accounts, and operate the platform.

Where non-essential analytics or marketing cookies are used, we will provide appropriate notices and choices as required by law.

10. Changes to This Policy

We may update this policy as our services, technology, or legal requirements change.

Material changes will be communicated where required.

11. Contact Us

NotaPrax
Operated by: NOTAPRAX
Privacy email: admin@notaprax.com
Information Officer: admin@notaprax.com
Business address: 170 President Brand Road, Rynfield, Benoni