Project status
Who processes your information
POPIA distinguishes the responsible party (who decides why and how personal information is processed) from the operator, who processes it on the responsible party's behalf. BK ClinicQ is both, in different places:
- The clinic is the responsible party for everything about your visit: that you joined its queue, the room you were sent to, the ticket you were given, and anything a staff member records about it. BK ClinicQ processes that as the clinic's operator, under a written agreement that binds us to the clinic's instructions and to POPIA's security requirements (sections 20 and 21).
- BK ClinicQ is the responsible party for the account itself: the details you give when you register, your channel and notification preferences, your sign-in sessions, and the technical logs that keep the platform secure and available.
If you are not sure which applies to a question you have, ask us and we will route it, or ask the clinic directly.
- Responsible party (platform)
- BK ClinicQ, Richfield Graduate Institute of Technology, BSc IT capstone project, South Africa
- Information Officer
- To be appointed and registered with the Information Regulator before the first clinic goes live, as sections 55 and 56 require.
- Contact for privacy questions
- The operator of this deployment. Deployment-specific contact details are published here before go-live.
What we process
Only what a queue actually needs. The design rule throughout is minimisation: if a field is not required to get you seen, it is either optional or absent.
- Who you are. Your name and the mobile number or email address you register with. A date of birth only where a clinic needs it to distinguish two people with the same name.
- How you reached us. The channel you used and its identifier: your MSISDN for USSD and SMS, your WhatsApp number, a push token for the app.
- Your place in the queue. Your ticket number, the clinic, the room or service, the times you joined, were called and were seen, and the outcome (seen, transferred, no-show).
- Why you are here, if you choose to say. A free-text reason or a visit note recorded by staff. This is optional, and it is deleted automatically on a short retention window. A visit note is never shown on the waiting-room screen. A reason is shown there only in one case: the clinic has chosen to show full names with reasons, you have agreed to both, and you agree again for that visit.
- Where you are, if you allow it. Your device's approximate location, used at the moment you search for a nearby clinic. We do not track your location in the background, and we never store a position. To let you choose an area again, we keep the names of the last few suburbs you searched from, and delete them with your record.
- Consent records. What you agreed to, when, through which channel, and when you withdrew it, including consent given by a parent or guardian on a dependant's behalf.
- Technical records. Your IP address, device and browser details, sign-in times, and application logs. These keep the service secure and let us investigate faults and abuse.
- Staff account information. For clinic staff and administrators: name, work email address, role and permission assignments, and an audit record of the administrative changes they make.
Health information
Information about your health is special personal information under section 26 of POPIA, and processing it is prohibited unless one of the grounds in section 27 or section 32 applies. Two things follow from that, and both shape the product:
- We keep as little of it as possible. A ticket number in a queue is not in itself health information. A reason for the visit, a triage priority or a visit note is. So those fields are optional, restricted to the staff who need them, kept off the public display unless you agree for that visit, and purged automatically.
- Where we do process it, we rely on your consent (section 27(1)(a)) and, for the clinic, on section 32, which permits processing by or on behalf of a healthcare institution where it is necessary for your proper treatment and care. Everyone with access is under a duty of confidentiality.
You can withdraw consent at any time. Withdrawing consent for your name to appear on the waiting-room screen takes effect immediately and does not affect your place in the queue.
Children and dependants
Section 34 of POPIA prohibits processing the personal information of a child except on one of the grounds in section 35, including the prior consent of a competent person. BK ClinicQ supports booking on someone else's behalf (a parent for a child, an adult child for an elderly parent) and treats that as a consent event in its own right: who gave it, for whom, when, and through which channel. A proxy booking can be revoked, and the dependant's information is visible only to the person who holds that consent and to the treating clinic.
Why, and on what justification
Section 11 of POPIA requires a justification for each purpose. Ours are:
| Purpose | Justification under POPIA |
|---|---|
| Placing you in a queue and telling you when it is your turn | Performance of the service you asked for (s11(1)(b)) |
| Showing a ticket number, or a consented name, on the waiting-room screen | Consent: s11(1)(a), and s27(1)(a) where it is health information |
| Finding clinics near you | Consent to use your device location (s11(1)(a)) |
| Sending you queue notifications and appointment reminders | Performance of the service (s11(1)(b)) |
| Recording who changed what, in an audit trail | Legal obligation and our legitimate interest in an accountable system (s11(1)(c) and s11(1)(f)) |
| Keeping the service secure, available and free of abuse | Legitimate interests (s11(1)(f)) |
| Anonymised wait-time statistics for clinic and district planning | Once aggregated and de-identified, it is no longer personal information (s6(1)(b)) |
We do not use your information for a new, incompatible purpose without telling you first (section 15), and we do not sell it.
Sending it outside South Africa
Section 72 restricts transferring personal information out of the Republic. Our preference is to host and process in South Africa. Where a provider (a messaging or cloud service) necessarily processes information abroad, we rely on one of the section 72 grounds: a law or binding agreement in the destination country that provides an adequate, comparable level of protection, or your consent, or that the transfer is necessary to perform the service you asked for. We will tell you which, on request.
How we protect it
Section 19 requires appropriate, reasonable technical and organisational measures. Ours are built into the platform rather than bolted on:
- Encryption in transit, and encryption at rest for your phone number, WhatsApp id and email address, the messages we send you and a clinician's notes. Backups are encrypted as a whole; the keys are held apart from the data.
- Role-based access control with scope tiers: staff see their own clinic's records and no other clinic's. A request for another clinic's data is answered as if the record does not exist.
- A hash-chained, append-only audit log, so a retrospective edit is detectable rather than merely discouraged.
- Two-factor authentication for staff accounts, rate limiting on sign-in and on the messaging channels, and regular dependency and vulnerability scanning.
- Independent penetration testing before go-live, with the findings remediated and re-tested.
If a security compromise affects your personal information, section 22 requires us to notify the Information Regulator and you, as soon as reasonably possible after discovering it. We will tell you what happened, what it means for you and what to do.
How long we keep it
Section 14 says records must not be kept longer than necessary. Where a period below has a ceiling, a clinic can shorten it for its own site; it cannot extend it beyond the ceiling.
| Record | Retained |
|---|---|
| Account profile and contact details | While the account exists, then erased when you ask (Your data) |
| Staff sign-in sessions (device and address) | 30 days after the session expires, then deleted (at most 90 days) |
| Queue tickets and visit timestamps | As the clinic's queue record. When you ask for erasure, the reason and the ticket's link are deleted and the ticket stays only as a count, with nothing that identifies you, so the clinic's statistics stay correct |
| Reason for visit, a walk-in's name and staff notes beside a ticket | 30 days after the visit by default, as the clinic sets it and never more than 90 days, then irreversibly deleted |
| Visit notes written by a nurse or doctor | 30 days by default and never more than 90 days, then irreversibly deleted |
| Your comments in answer to the question after a visit | The clinic's same window, counted from your answer, then deleted; your score is kept |
| One-time sign-in codes | Stored only as a scrambled check value, and forgotten within a day |
| Consent records | For as long as needed to prove the consent that was relied on; after an erasure, with nothing that identifies you |
| Messages we sent you (the number or address and the words) | 30 days, long enough to investigate a failed delivery, then deleted (at most 90 days). A record that a message was sent, when and at what cost is kept, without them |
| Audit events | Append-only; retained as the accountability record and not deleted by ordinary use |
| Application and access logs | Per the retention configured on the log store |
| Anonymised, aggregated statistics | Indefinitely: they are no longer personal information |
Deletion is automatic, runs every night and is covered by tests: the purge job is verified to leave the reason text, visit notes, comments and message contents unrecoverable, not merely hidden. Our encrypted backups keep a copy for 14 days more, then expire.
Your rights
Chapter 3 of POPIA gives you the right to:
- Be told that we hold information about you, and what it is (sections 23 and 24).
- Ask for a copy of it, in a usable form. We export what we hold about you.
- Have it corrected if it is inaccurate, irrelevant, excessive, out of date, incomplete, misleading, or obtained unlawfully.
- Have it deleted or destroyed where we no longer have a lawful reason to keep it. A few records are kept after an erasure, with nothing left in them that identifies you: the audit trail of who changed what, the record of what you consented to, and the count of your visits. BK ClinicQ does not hold the clinic's own medical file about you; ask the clinic about that.
- Object to processing we base on legitimate interests, on reasonable grounds (section 11(3)).
- Withdraw consent at any time, without affecting what was lawfully done before you withdrew it.
- Not be subject to a decision with legal consequences based solely on automated processing (section 71).
- Complain to the Information Regulator, and to institute civil proceedings (sections 74 and 99).
Asking for a copy, or for erasure. On Your data, give your mobile number and we send a code to it: nothing is shown or changed until the code is right, so nobody else can use these rights to reach your records. A copy of everything we hold is then yours at once, as one file. An erasure is carried out by our staff within 30 days, and we tell you the date when you ask. Neither costs anything.
For anything else on this list, or if you signed up with an email address rather than a number, contact the Information Officer. A request for access or correction may also be made on the form prescribed under the POPIA regulations, and we verify your identity first.
Direct marketing
Section 69 restricts unsolicited electronic direct marketing. We do not send it. The messages you receive from BK ClinicQ are the operational ones you asked for: your place in the queue, your call-forward, your appointment reminder, your chronic-medication collection nudge. Every one of them can be turned off in your notification preferences or by replying with the opt-out keyword, and quiet hours are respected.
Automated decisions
Wait-time estimates and queue order are calculated automatically, and a priority override is always a decision a named staff member makes and records with a reason. No decision with legal consequences for you is made solely by automated processing (section 71), and you can ask a staff member to review any queue decision that affects you.
Complaints
Please raise a concern with us first; most are a misunderstanding we can fix quickly. If you are not satisfied, you may complain to the Information Regulator:
- Information Regulator (South Africa)
- JD House, 27 Stiemens Street, Braamfontein, Johannesburg, 2001
- Complaints
- complaints.IR@justice.gov.za
- General enquiries
- inforeg@justice.gov.za
Please confirm the Regulator's current contact details on inforegulator.org.za before submitting a complaint.
Changes to this notice
When this notice changes we update the date at the top of the page, and we tell you in the application before a change that materially affects how your information is used takes effect. See also our terms of service.