Reception app Privacy Policy

1. Who is responsible

Permason Technologies is responsible for the information in your staff account.

Your clinic is responsible for the patient information it captures, and we process it on the clinic’s behalf to run Licit Note.

2. Information about you

• Your name, work email address, the clinic you work at, and your role there.
• Your password, which our sign in provider stores only in scrambled (hashed) form. We can’t read it.
• Whether a clinic administrator has approved your account.
• A record of what you do in the app, such as registering a patient, with the time and a scrambled (hashed) form of your internet address. The address itself isn’t stored.
• Feedback and feature suggestions you send us, with the app version you sent them from.
• While the app is open: when it was opened and last used, the app version, and the kind of device, system, and browser it is running in. This shows Licit Note administrators who is using the platform. It doesn’t include your location or internet address.
• If you register a clinic: its name, practice number, addresses, and contact details, which we check before the clinic can use Licit Note.

3. Information about patients

When you register a patient, the app records their first name and surname, South African ID number, phone number, the reason for the visit, the doctor they will see, and when they arrived.

The ID number ties each doctor’s note to the right person and prevents duplicate records for the same patient at your clinic. It is included in the secure record our server creates when a doctor issues a note, and it is never shown on the public verification page.

4. How information is used

• To sign you in and keep your account secure.
• To run your clinic’s queue and show its attendance figures.
• To let doctors at your clinic see their patients and issue notes.
• To let anyone with a note’s QR code or link check that it is genuine.
• To reply to your messages and improve the app.

We don’t sell personal information, use it for advertising, or send usage analytics to anyone.

5. What a note check shows

Anyone with a note’s QR code or link can open its verification page on licitnote.com. It shows whether the note is valid, archived, or revoked; the patient’s initials and surname; any days off the doctor gave, with their dates and a statement that the patient is unfit to attend work or school; the doctor’s name; the clinic; the date issued; and, for a revoked note, when it was revoked. A revoked note doesn’t show its days off.

It never shows the patient’s ID number, phone number, or reason for the visit.

We count how many checks happen each day and what they found. Nothing about who made a check, or which note they checked, is kept.

6. Who can see information

• Patient information can be seen only by approved staff and verified doctors at the clinic that captured it. The database enforces this, not only the app.
• People at your clinic can see your name and profile photo.
• Licit Note platform administrators at Permason Technologies can see your account, your clinic’s registration details, and when you use the app, to approve registrations and keep the platform secure. They see only totals of patients, visits, and notes, never patient details.
• Service providers that run Licit Note for us: Supabase (database, sign in, file storage, and server functions), Cloudflare (website and network), and Google Firebase (notifications in the doctor app, where set up). They may process information only to provide their service to us.
• Anyone else only where the law requires it.

7. Cookies

The reception app uses cookies only to keep you signed in and to remember whether you collapsed the sidebar. It uses no advertising or tracking cookies.

While a tab is open, it also keeps a random session number in the browser’s session storage, so a reloaded page counts as the same visit. The browser clears it when you close the tab.

8. Where information is stored

Our service providers may store and process information outside South Africa. We use only providers that are bound to protect it to a standard comparable to POPIA.

9. How long it is kept

• Patient records are kept for as long as your clinic needs them to meet its own record keeping obligations.
• Issued notes, and the record of who issued, reissued, or revoked them and when, are kept permanently so notes stay verifiable. They can’t be edited or deleted.
• Your staff account is kept while it is active. When you or your clinic ask us to close it, we stop it signing in and remove personal information that isn’t part of the clinic’s records.
• Feedback is kept for as long as we need it to help you.

10. Security

Information travels over encrypted connections. Access rules in the database keep each clinic’s information to that clinic, and the activity record can’t be edited. Note links are stored only in scrambled (hashed) form.

No system is perfectly secure. If a breach affects your information, we will tell you, your clinic, and the Information Regulator as POPIA requires.

11. Your rights

You can ask to see the personal information we hold about you, ask us to correct or delete it, or object to how it is used, by emailing support@licitnote.com.

Patients who want to see or correct their information should ask the clinic that registered them. We will help the clinic respond.

If you are unhappy with how we handle your information, you can complain to the Information Regulator (South Africa) at inforegulator.org.za.

12. Changes to this policy

When the app changes how it handles personal information, we will update this policy and the date at the top, and mention it in What’s new.

13. Contact us

Permason Technologies
Email: support@licitnote.com
Website: licitnote.com