Doctor app Privacy Policy

1. Who is responsible

Permason Technologies is responsible for the information in your doctor account.

Patient information is captured by your clinic's reception staff. Your clinic is responsible for it, and we process it on the clinic's behalf to run Licit Note.

2. Information about you

• Your name, work email address, mobile number, and alternative number if you give one.
• How you are registered to practise: your professional designation, HPCSA registration number, and qualifications.
• Your practice: its name, type, BHF practice number if it has one, phone number, email address, website, physical address, and postal address; and the clinic you see patients at through Licit Note.
• Your password, which our sign in provider stores only in scrambled (hashed) form. We can't read it.
• Your profile photo, if you add one.
• Whether your HPCSA registration has been verified and whether your clinic has approved your membership.
• When you start each consultation.
• A record of each note you issue, reissue, or revoke: the time, and a scrambled (hashed) form of your internet address. The address itself isn't stored.
• Messages you send us, such as feedback, feature suggestions, support messages, and account deletion requests, with the app version you sent them from.
• On phones where push notifications are set up, a notification token so we can tell you when your HPCSA verification is approved.
• While the app is open: when it was opened and last used, the app version, and your device type, model, and system version (on a computer, also the name the computer reports). This shows Licit Note administrators who is using the platform. It doesn't include your location or internet address.

3. Information about patients

When a patient arrives, reception records their name, South African ID number, phone number, and the reason for the visit.

This app shows you the patient's name, phone number, reason for the visit, and place in your queue. It never shows or downloads a patient's ID number. The ID number is included only in the secure record our server creates when you issue a note, so the note is tied to the right person.

4. How information is used

• To sign you in and keep your account secure.
• To confirm you are a registered practitioner, and that you work at your clinic, before you can see any patient information.
• To show your queue and let you issue, reissue, and revoke notes.
• To let anyone with a note's QR code or link check that it is genuine.
• To reply to your messages and improve the app.

We don't sell personal information, use it for advertising, or send usage analytics to anyone.

5. What a note check shows

Anyone with a note's QR code or link can open its verification page on licitnote.com. It shows whether the note is valid, archived, or revoked; the patient's initials and surname; any days off you gave, with their dates and a statement that the patient is unfit to attend work or school; the doctor's name; the clinic; the date issued; and, for a revoked note, when it was revoked. A revoked note doesn't show its days off.

It never shows the patient's ID number, phone number, or reason for the visit.

6. Who can see information

• People at your clinic can see your name, qualifications, and profile photo. Administrators of the clinics you join can also see your contact and practice details, so they can approve your membership.
• Patient information can be seen only by approved staff and verified doctors at the clinic that captured it. The database enforces this, not only the app.
• Licit Note platform administrators at Permason Technologies can see your account, registration, and practice details and when you use the app, to verify registrations and keep the platform secure. They see only totals of patients, visits, and notes, never patient details.
• Service providers that run Licit Note for us: Supabase (database, sign in, file storage, and server functions), Cloudflare (website and network), and Google Firebase (push notifications, where set up). They may process information only to provide their service to us.
• Anyone else only where the law requires it.

7. Sharing a note by WhatsApp

When you share a note, the app opens WhatsApp with a message for the patient that contains the note's link. Nothing is sent until you tap send in WhatsApp, and WhatsApp's own terms apply to the message.

8. What stays on your phone

• Your sign in session, kept in your phone's secure storage.
• The QR codes of notes you issue on this phone, kept in secure storage so you can show them again. Anyone who can unlock your phone and open the app could see them. You can remove them in Settings, Password & security, Clear saved QR codes.
• Your appearance and notification choices.

The app's data is left out of cloud backups and phone transfers.

New patient notifications don't name patients unless you turn on Show patient names in Settings, Notifications. With it on, names and visit reasons can appear on your lock screen.

9. Diagnostics

The diagnostics report in Settings describes the app, your phone model and system version, and your connection. It doesn't include your password, sign in tokens, email address, or any patient information, and it is only sent if you choose to send it.

10. Where information is stored

Our service providers may store and process information outside South Africa. We use only providers that are bound to protect it to a standard comparable to POPIA.

11. How long it is kept

• Issued notes, and the record of who issued, reissued, or revoked them and when, are kept permanently so notes stay verifiable. They can't be edited or deleted, including when an account is closed.
• Your account information is kept while your account is open. When you ask us to delete your account, we stop you signing in and remove personal information that isn't part of an issued note or its record.
• Support messages and feedback are kept for as long as we need them to help you.

12. Security

Information travels over encrypted connections. Notes are created only on our servers, and note links are stored only in scrambled (hashed) form. Access rules in the database keep each clinic's information to that clinic.

No system is perfectly secure. If a breach affects your information, we will tell you and the Information Regulator as POPIA requires.

13. Your rights

You can ask to see the personal information we hold about you, ask us to correct or delete it, or object to how it is used. You can change your profile photo in the app, request account deletion in Settings, Delete account, or email support@licitnote.com.

Patients who want to see or correct their information should contact the clinic that captured it. We will help the clinic respond.

If you are unhappy with how we handle your information, you can complain to the Information Regulator (South Africa) at inforegulator.org.za.

14. Changes to this policy

When the app changes how it handles personal information, we will update this policy and the date at the top, and mention it in What's new.

15. Contact us

Permason Technologies
Email: support@licitnote.com
Website: licitnote.com