Privacy Policy

(Version 2.1 — 28 July 2026)

Who We Are

This Privacy Policy explains how Medscape (Pty) Ltd t/a HealthAccess ("HealthAccess", "we", "our") collects, uses, shares, and protects personal information.

• Company Registration: 2019/391460/07 (South Africa)
• Contact: via the Contact Us page on our website.

HealthAccess provides cloud-based software and digital tools for practices across healthcare, allied health, aesthetics, wellness, and related industries, including client management, bookings, billing, communication, reporting, client/patient portals, and artificial intelligence capabilities and related services ("AI Features").

Key Terms

• Personal Information: Any information that can identify a person (e.g. name, ID number, contact details, records, communications, usage logs).
• Special Personal Information: A special category of Personal Information under POPIA that includes health information. It receives extra protection and generally requires a specific lawful basis to process.
• Data Subject: The person the Personal Information is about.
• Responsible Party: The entity that decides why and how Personal Information is processed. In this policy, either HealthAccess (for our own leads/ops data) or the Practice (for practice/patient data in the platform) can be the Responsible Party.
• Operator: A service provider that processes Personal Information on behalf of a Responsible Party and only on their instructions. In this policy, HealthAccess is the Operator for data stored/managed by Practices inside the HealthAccess platform.
• Sub-Processor: A third-party service provider engaged by HealthAccess to help deliver the platform (for example secure hosting, messaging/email gateways, backup/storage, and AI providers), acting under contract and only for the purposes of providing the service.
• AI Features: The artificial intelligence capabilities and related services offered by or through HealthAccess. "AI Features" is the term used in this policy; the current marketing brand is "HANA", and any reference to HANA means the AI Features under their current branding. Branding may change over time without affecting this policy. Operational detail is maintained in the AI Trust Centre, and contractual terms are set out in the HealthAccess AI Addendum.
• AI Trust Centre: The HealthAccess public information resource that describes our current AI Features, foundation models and AI providers, AI governance, security, processing locations, and usage limits. It is version controlled, carries a "Last Updated" date, and maintains release notes and a version history.
• Applicable Data Protection Laws: POPIA and any other applicable data protection, privacy, or healthcare information laws in jurisdictions where HealthAccess or its customers operate.
• Practice / Customer: A business using HealthAccess (e.g. clinic, spa, aesthetic or wellness practice).
• Portal: The client/patient-facing components of HealthAccess (e.g. secure messaging, results/documents, appointments).

Our Roles & Applicable Laws

We process Personal Information in two distinct roles:

1. HealthAccess as Responsible Party (our own business data)

When individuals interact directly with HealthAccess — for example, submitting a demo request, contacting support, subscribing to marketing, or browsing our website — we act as the Responsible Party.

2. HealthAccess as Operator (customer/practice data in the platform)

When a Practice uses HealthAccess to store or manage client/patient information, the Practice is the Responsible Party and HealthAccess acts only as an Operator, following the Practice's documented instructions.

Applicable Laws

This Privacy Policy is based on the requirements of South Africa's Protection of Personal Information Act, 2013 ("POPIA"), and we will also comply with other Applicable Data Protection Laws in the regions where we operate. In the event of a conflict between POPIA and another applicable law, HealthAccess will apply the stricter standard of protection.

Related Documents

This Privacy Policy explains our privacy obligations and works alongside the following, each with a distinct purpose:

• SaaS Agreement — the master agreement governing use of the platform;
• HealthAccess AI Addendum — contractual terms for AI Features, where used;
• Support & Security Policy; and
• AI Trust Centre — operational and technical information about our AI Features.

If this policy conflicts with the SaaS Agreement or HealthAccess AI Addendum on contractual matters, that agreement prevails; this policy governs our privacy practices.

Business Data (We Are the Responsible Party)

Categories

• Business & Marketing Information: Name, contact details, enquiry/demo forms, marketing opt-ins, survey responses.
• Support Information: Information you give us in tickets, emails, calls, chat.
• Website & Technical Data: Browser/device type, IP address, usage logs, analytics and error reports.

Why We Use It

• Respond to enquiries and provide demos.
• Manage sales, onboarding, and business communications (including marketing, if opted-in).
• Operate our support desk and respond to service requests.
• Improve services, security, and performance, including through de-identified and aggregated analysis.
• Our lawful basis: We process this data on the bases permitted by POPIA, including your consent (e.g. marketing), the performance of a contract or steps taken at your request, compliance with legal obligations, and our legitimate interests in operating and improving our business.

Practice & Patient Data (We Are the Operator)

Categories (as instructed by the Practice)

• Client/Patient Information: Name, contact details, ID/passport number, appointment history, uploaded documents (e.g. consents, notes, invoices, results), and — where the Practice enables AI Features — recordings and transcriptions of consultations or interactions. Some of this is Special Personal Information (health information).
• Portal Information: Login details, verification identifiers, secure messages, shared results/documents, activity logs.
• User Information (practice staff): Staff logins, role-based permissions, activity logs.
• Technical Data: Device/browser type, IP address, error reports.

Responsible Party & Legal Basis

• The Practice is the Responsible Party and determines the lawful basis for processing, including any specific authorisation required to process Special Personal Information (health information) and to record consultations or interactions.
• HealthAccess acts strictly as an Operator, processing only on the Practice's documented instructions and solely to provide the platform.

Artificial Intelligence (AI Features)

HealthAccess offers optional AI Features. They are not enabled by default, and not every customer uses them — a Practice chooses to switch AI Features on. These AI Features are currently marketed under the "HANA" brand; branding may change over time, and the privacy obligations in this policy apply regardless of branding.

Where a Practice enables AI Features, Personal Information entered into or generated within the platform may be processed by AI — for example to generate, summarise, transcribe, or respond to information, and in some cases to interact with patients or clients.

To deliver these AI Features we may use one or more foundation models, AI providers, and orchestration layers (together, "AI Sub-Processors"), which may change as technology evolves. A current list of approved Sub-Processors is available upon request. Operational and governance detail is maintained in the AI Trust Centre, and contractual terms are set out in the HealthAccess AI Addendum.

• Human oversight. AI Features assist Practices and produce drafts for review; they do not replace professional judgement and are not a medical device. We do not make decisions about a Data Subject based solely on automated processing with legal or similarly significant effects, except as permitted by law.
• Recording and consent. Where a Practice enables features that record or transcribe consultations or interactions, the Practice must obtain and record any consent required beforehand. We process this data only as Operator, on the Practice's instructions.
• Training. We do not use identifiable patient or client Personal Information to train AI or foundation models unless the Practice has provided a lawful basis and any required consent. We may use de-identified and aggregated data to improve our services and AI Features.

Cookies

HealthAccess may use cookies and similar technologies on our website for purposes such as enabling core website functionality, remembering your preferences, measuring performance, and understanding how our website is used. Where the law requires consent for certain cookies, we will obtain it. You can manage or disable cookies through your browser settings, although some parts of the website may not function correctly if you do.

How We Share Information

We do not sell Personal Information. Sharing depends on the processing context:

A) When HealthAccess is Responsible Party (our business data)

We may share with:

• Business service providers supporting our operations (e.g. CRM, support desk, task management, email services).
• Regulators/authorities where legally required.
• Third parties with your consent, where you explicitly authorise sharing (e.g. a partner referral).

B) When HealthAccess is Operator (practice/patient data)

We may share only with:

• Sub-Processors (e.g. secure hosting, messaging/email gateways, backup/storage vendors, and AI providers) strictly as needed to provide the platform. A current list of approved Sub-Processors is available upon request.
• Regulators/authorities only on the documented instruction of the Responsible Party (the Practice), unless we are independently required by law.

All Sub-Processors and third-party providers are bound by confidentiality and data protection obligations.

International Transfers

• Our business data (Responsible Party): If transferred outside South Africa, we apply appropriate safeguards (contractual commitments for data protection).
• Practice/patient/client data (Operator): Data may be hosted, routed, or processed via secure infrastructure outside South Africa under the Practice's control/instructions, with equivalent safeguards in line with Applicable Data Protection Laws.

Data Retention

• Our business data (Responsible Party): Retained only as long as reasonably necessary to manage our relationship, meet legal/regulatory requirements, or fulfil the purposes described in this policy; then securely deleted, anonymised, or archived.
• Practice/patient/client data (Operator): Retention is determined by the Responsible Party (the Practice). HealthAccess will delete or return such data on the Practice's documented instruction or upon service termination, subject to applicable law and contractual obligations.

Security

We apply reasonable technical and organisational safeguards to all data, including:

• Role-based access controls;
• Encryption in transit and at rest (where applicable);
• Logging and monitoring of system activity;
• Access limited to authorised personnel.

Further detail is set out in our Support & Security Policy and the AI Trust Centre.

Data Breaches

• Our business data (Responsible Party): If a security compromise affecting Personal Information occurs, we will notify affected individuals and, if required, the Information Regulator as soon as reasonably possible.
• Practice/patient/client data (Operator): We will notify the Responsible Party (the Practice) as soon as reasonably possible. The Practice is responsible for notifying the Information Regulator and affected individuals, unless otherwise agreed in writing.

Your Rights

Under POPIA and other Applicable Data Protection Laws, Data Subjects have the right to: access their Personal Information; request correction or deletion; object to processing in certain cases; opt out of direct marketing at any time; where applicable, not be subject to a decision based solely on automated processing that has legal or similarly significant effects; and lodge a complaint with the relevant data protection authority.

• If your request concerns data where HealthAccess is the Responsible Party: please contact us via the Contact Us page.
• If your request concerns data held by a Practice in the HealthAccess platform: please contact the Practice directly, as it is the Responsible Party.

You may also lodge a complaint with the Information Regulator (South Africa).

Practice Responsibilities

When using HealthAccess, Practices are the Responsible Party for their client/patient data. This means Practices must:

• Ensure their use of HealthAccess (including AI Features) complies with data protection laws and professional standards;
• Obtain and record any consent required from patients/clients, including consent to the recording of consultations or interactions where AI Features are used, and provide appropriate notice that AI may be in use;
• Where they process children's information, apply the additional protections that POPIA and applicable law require;
• Ensure their staff and contractors handle data responsibly;
• Provide lawful and documented instructions to HealthAccess for processing;
• Manage Data Subject requests and regulatory notifications related to their data.

Contact & Complaints

HealthAccess has appointed an Information Officer, registered with the Information Regulator as required by POPIA. For any privacy question, to make a data subject request, or to raise a concern, please contact us via the Contact Us page on our website.

Updates

We may update this Privacy Policy from time to time. Updates will be posted on this page with a new version number and date. We will notify customers of material changes. The current version is Version 2.1, dated 28 July 2026.

Version History

• Version 2.1: Introduced "AI Features" as the brand-neutral legal term (HANA is the current brand); added the Artificial Intelligence (AI Features) section, AI Trust Centre and HealthAccess AI Addendum references, Sub-Processor disclosure, updated Responsible Party/Operator wording, Special Personal Information handling, cookies, and automated decision-making wording. (28 July 2026)
• Version 2.0: Previous published version. (23 September 2025)