Privacy Policy

Last updated: July 2026

Welcome Desk (“we”, “our”, “us”) is a software service for South African healthcare practices, operated by the registered company named at the end of this Policy. We are committed to protecting the privacy of both the healthcare practices that use our platform (“Practices”) and the patients who submit information through it (“Patients”).

This Privacy Policy explains what information we collect, why we collect it, how we use it, and your rights in relation to it. By using Welcome Desk, you agree to the terms of this Policy.

1. Who this policy applies to

• Practice users (owners, administrators, receptionists, practitioners) who create and manage accounts on Welcome Desk.
• Patients who submit personal and medical information through a Practice’s intake form or booking page.

2. Information we collect

From Practices: practice name, contact details, billing information, and staff account information (names, email addresses, roles).

From Patients: full name, date of birth, South African ID number or passport number, contact details, home address, medical aid information, emergency contact details, account-responsible person details, uploaded documents (such as ID and medical aid card), and digital consent and signature.

3. How we use your information

• To provide and operate the Welcome Desk intake and booking platform to Practices.
• To store and display patient records to authorised Practice staff.
• To generate exports of patient records on request.
• To manage subscription administration, invoicing, and billing communications with Practices.
• To send appointment reminders, booking confirmations, recall reminders and similar messages to patients by email and, where the practice has enabled it and the patient has given a number, by WhatsApp.
• To send service notifications to practice staff.
• To comply with our legal obligations under the Protection of Personal Information Act (POPIA) and other applicable South African law.

We do not sell patient data. We do not use patient data for advertising, profiling, or any purpose other than providing the service to the Practice.

4. Legal basis for processing (POPIA)

• Contract performance: processing necessary to provide the service to Practices under our subscription agreement.
• Consent: Patients provide explicit digital consent before submitting their information.
• Legitimate interest: for billing, support, and service improvement purposes.
• Legal obligation: where required by applicable law.

5. Data storage and security

Patient data is stored on secure infrastructure provided by Supabase and is encrypted at rest and in transit (HTTPS). Access to patient records is restricted to authorised staff of the relevant Practice through role-based access controls enforced at the database level. Uploaded documents are stored privately and accessed only through short-lived signed links.

Practice logins can be protected with two-step login (a code from an authenticator app in addition to a password). Every time a member of practice staff opens a patient profile or record, or downloads a copy, it is recorded with their name and the time, so the practice can see who has accessed a patient’s information.

6. Data retention

Patient records are retained while the Practice’s account is active, and are also retained rather than deleted if the Practice cancels its subscription, so that the Practice can export them and meet its own record-keeping duties under HPCSA guidance. Records of who accessed a patient record are kept for 24 months. Error and system logs are kept for 90 days.

A Practice or a Patient may ask for records to be deleted. Because the Practice is the Responsible Party for its patient records under POPIA, such a request is assessed against the retention periods the Practice is required to observe, and we will confirm what can be deleted and what must be kept.

7. Sharing of information

• Service providers. Supabase (database and file storage), Vercel (application hosting), Resend (email delivery), Meta Platforms (the WhatsApp Business API, used to send appointment and recall messages where a practice has enabled it), and PayFast (payment processing for practice subscriptions, which involves practice billing details and not patient information). These providers process information on our instructions and are bound to protect it.
• Processing outside South Africa. Some of these providers operate infrastructure outside South Africa, so personal information may be processed in other countries. Where that happens, POPIA requires that the information receives a comparable level of protection, and our agreements with those providers are intended to secure that.
• Legal requirements: where required by law, court order, or lawful authority.
• Business transfer: in the event of a merger, acquisition, or sale of assets, personal information may be transferred to the successor entity, subject to the same privacy protections.

8. Your rights under POPIA

• Access the personal information we hold about you.
• Request correction of inaccurate information.
• Request deletion of your information (subject to legal retention requirements).
• Object to processing in certain circumstances.
• Lodge a complaint with the Information Regulator of South Africa.

To exercise any of these rights, contact us at checkin@welcomedesk.co.za.

9. Cookies

This site uses only essential session cookies required for authentication. We do not use tracking cookies, advertising cookies, or third-party analytics cookies.

10. Changes to this policy

We may update this Privacy Policy from time to time. We will notify Practice users of material changes by email. Continued use of Welcome Desk after changes are published constitutes acceptance of the updated Policy.