Privacy Policy

1. Who we are

Tru Medical Care is a telemedicine platform that connects patients with HPCSA-registered medical practitioners for virtual consultations. Tru Medical Care is the responsible party for the processing of your personal information under the Protection of Personal Information Act 4 of 2013 (POPIA).

How to exercise your rights, and how to contact the Information Regulator, is set out in our POPIA Notice.

2. What information we collect

We collect only the information needed to register you as a patient, provide your consultation, and meet our legal and professional obligations.

When you create a patient account

• Identity and contact details: full name, email address, cell phone number, WhatsApp number, date of birth and residential address.
• Identifier: South African ID number (or passport number). This is required to issue valid prescriptions, sick notes and referral letters, and for medical-aid claims where applicable.
• Next of kin: the name and contact number of a person we may contact if you become unwell during a consultation. By providing these details you confirm that this person knows you have shared them with us.
• Nearest emergency centre: the name and location of the hospital or emergency centre closest to you, so that we can direct you quickly if a consultation reveals an emergency.
• Account credentials: a password you choose. Your password is handled by our secure sign-in service and is never stored by us in readable form.

When you book and attend a consultation

• Health information: the reason for your visit, the type of consultation you select, and clinical information you share with your practitioner during the consultation.
• Booking details: the service, date, time, fee and your appointment reference.
• Billing and payment: your invoice and a record of when your payment was confirmed. Card payments are made on our payment processor’s secure checkout page; we do not receive or store your card details.

Records we create automatically

• Consent record: when you create an account, the date and time you accepted this policy, the version you accepted, your IP address and your browser information.
• Technical and security data: limited service logs (such as the time of a request and whether it succeeded) used to keep the platform secure and working.

3. Why we collect it

We process your personal information to:

• Provide your consultation and related care, including prescriptions, sick notes and referrals
• Verify your identity and keep your patient record accurate
• Send booking confirmations, invoices, your secure consultation link and other messages about your care
• Issue invoices and reconcile payments
• Contact your next of kin or direct you to emergency care where your safety requires it
• Keep clinical and financial records as required by the HPCSA, POPIA, tax law and other South African law
• Keep an audit trail of your consent
• Protect the security of the platform and prevent fraud or misuse

Providing the information marked as required is necessary for us to create your account and provide a consultation. Without it, we cannot deliver the service. We do not use your information for marketing, and we do not sell it.

4. Who we share it with

Access to your information is limited to people and service providers who need it for the purposes above. Our service providers act on our instructions and are bound to keep your information confidential and secure.

• Our practitioners and practice staff: the practitioner treating you, and staff who administer bookings and billing. Access is role-based, so each person sees only what their role requires.
• Cloud hosting and email delivery provider: stores your account, patient profile, appointments and invoices, and delivers the emails we send you. Located in the United Kingdom.
• Calendar and video-conferencing provider: schedules your appointment in the practitioner’s calendar and hosts your video consultation. It receives your name, the type of consultation and the appointment time.
• Payment processor and bank: if you pay by card, our payment processor handles the transaction on its own secure page. If you pay by EFT, your payment passes through our bank. We receive only confirmation of the payment.
• Other healthcare providers: where your practitioner refers you to another doctor, specialist, pharmacy or facility, we share the information reasonably needed for your continued care, as permitted by sections 11 and 32 of POPIA.
• Authorities and others where the law requires: we may disclose information where we are legally obliged to (for example a court order or a statutory reporting duty), or where it is necessary to protect your life or health or the rights of the practice.

We do not sell, rent or share your personal information with anyone for marketing or advertising.

5. Cross-border transfers

Your account, patient profile, appointment records and invoices are stored on secure servers in the United Kingdom. The United Kingdom has data protection law (the UK GDPR and Data Protection Act 2018) that provides protection substantially similar to POPIA.

Our calendar and video-conferencing provider may process appointment information in other countries, under its own data protection commitments and contractual safeguards.

Card payments are processed in South Africa.

By creating an account, you consent to your personal information being transferred outside South Africa for these purposes, as permitted by section 72 of POPIA.

6. How long we keep it

We keep records for as long as the law and the HPCSA’s guidelines on the keeping of patient records require:

• Clinical records: at least six years after your last consultation
• Records of patients under 18: at least until the patient’s 21st birthday
• Records of patients who are mentally incapacitated: for the patient’s lifetime
• Invoices and financial records: at least five years, as required by tax law

We may keep records for longer where a complaint, claim or legal proceeding is pending or reasonably expected, or where the law otherwise requires it. When a retention period ends, records are securely destroyed or de-identified.

7. How we protect it

We take appropriate, reasonable technical and organisational measures to prevent loss of, damage to, and unauthorised access to your personal information. We review these controls as the platform develops.

• All connections to our website and services are encrypted in transit (HTTPS)
• Stored information is encrypted at rest
• Passwords are handled by a dedicated secure sign-in service and are never stored in readable form
• Every request for patient information is authenticated and checked against the requester’s role
• Your secure consultation link is sent only after your payment is confirmed
• We collect only the information we need

No system is completely secure. If a security compromise affects your personal information, we will notify you and the Information Regulator as POPIA requires. See our POPIA Notice.

8. Cookies & browser storage

We do not use analytics, advertising or tracking cookies, and we do not track you across other websites.

When you sign in, your browser’s local storage keeps your sign-in session and basic account details (your name, email address and role) so that you stay signed in between pages. This information stays on your device and is removed when you sign out.

Our pages load typefaces from a third-party font service. As with any web request, that service receives your IP address and browser information.

9. Children

If a patient is under 18, a parent or legal guardian must create the account and give consent on the child’s behalf, except where South African law allows the child to consent to the treatment themselves. We process children’s personal information only as section 35 of POPIA permits.

10. Your rights

Under POPIA you have the right to:

• Ask whether we hold your personal information, and request access to it
• Ask us to correct information that is inaccurate, incomplete or out of date
• Ask us to delete information, subject to the record-keeping periods above
• Object to the processing of your personal information
• Withdraw your consent, without affecting processing that has already taken place
• Lodge a complaint with the Information Regulator

You can view the details on your patient profile at any time. Our POPIA Notice explains how to make a request and how to contact the Information Regulator.

11. Changes to this policy

We may update this policy as our services or the law change. The version number and “last updated” date at the top of this page will change when we do. If we make a material change, we will notify account holders by email before it takes effect.