Privacy Policy
Your information. Handled with care.
How Maatla Healthcare and Maatla Care collect, use, protect and share personal and health information, and how you can use your rights.
Last updated: October 2026
On this page
1.About this policy
This Privacy Policy explains how Maatla Healthcare (“we”, “us”) collects, uses, shares and protects personal information when you use Maatla Care: our website, patient and practice accounts, WhatsApp and SMS services, automated callbacks and voice services, and AI features.
Maatla Care handles health information, which the law treats as especially sensitive. We have tried to write this policy in plain language. Where we use a legal term, we explain it. If anything is unclear, contact our Information Officer at privacy@maatlahealthcare.com.
The platform is designed around the principles of the Protection of Personal Information Act, 2013 (POPIA): accountability, processing only for clear purposes, collecting no more than we need, keeping information accurate, being open about what we do, keeping information secure, and respecting your rights.
2.Who we are and our roles
Maatla Care is a product of Maatla Healthcare (maatlahealthcare.com). Our registered company details and physical address will be added here before launch. POPIA describes two roles, and we play each in different situations.
When we are the responsible party
A responsible party decides why and how personal information is processed. Maatla Healthcare is the responsible party for platform account information: your account and sign-in details, contact details, communication preferences, consent records, support requests, website and security logs, and the business relationship with practices that subscribe to Maatla Care.
When practices are the responsible party
Each practice is the responsible party for the clinical records it creates, such as consultation notes, prescriptions, results, referrals and documents. For that information, Maatla Care acts as an operator: we process it on the practice’s behalf, only on its instructions, under a written agreement that requires us to keep it confidential and secure, as POPIA requires.
If you have a question about a clinical record, the practice that created it is usually best placed to answer. We will help route your request to the right place.
3.Information we collect
Depending on how you use Maatla Care, we collect:
- Account and identity information: your name, mobile number, email address, date of birth, preferred language, and an identity number where a practice needs it to provide care or submit a medical aid claim.
- Family and dependant information: details of children and other people whose care you manage, and your relationship to them.
- Medical aid information: scheme, plan, membership number, main member and dependant code.
- Health information: appointment reasons, answers to pre-visit questions, and the records practices create, such as clinical notes, vital signs, allergies, medicines, prescriptions, results, referrals and documents.
- Communications: WhatsApp, SMS and email messages with us or with a practice through Maatla Care, call records for missed calls and callbacks, and voice notes you choose to send.
- AI feature information: conversations with the AI assistant, and consultation audio and transcripts where you have consented to AI documentation.
- Payment information: invoices, amounts and payment status. Card details are entered on our payment provider’s checkout and are not stored by us.
- Professional and practice information: for clinicians and practice staff, professional registration details, practice details, roles and work contact details.
- Technical and security information: IP address, device and browser type, sign-in times, and logs of who accessed which records and when.
We also receive information from others: from practices that register you or record your care, from a parent, guardian or family member who manages your care, from our payment provider about whether a payment succeeded, and from messaging providers about whether a message was delivered.
4.Health information and the basis for processing it
POPIA classes health information as special personal information. It may only be processed in limited circumstances. On Maatla Care, health information is processed on these bases:
- Your consent. We ask for your explicit consent to the processing of health information when you create an account, and separately for optional features such as the AI assistant, AI documentation during consultations, telehealth and record sharing.
- Healthcare by professionals. Practices and clinicians may process health information where it is necessary for your proper treatment and care, subject to their duty of confidentiality, as POPIA permits for healthcare providers.
- Legal obligations and claims. Where the law requires information to be kept or disclosed, or where it is needed to establish, exercise or defend a legal right.
For other personal information, we rely on the grounds POPIA allows: your consent, the need to perform our agreement with you, compliance with the law, protecting your legitimate interests, or our legitimate interests (such as keeping the platform secure), balanced against your rights.
You can withdraw consent at any time. Withdrawal does not affect processing that already took place lawfully, and some information must still be kept where the law requires it. See Consent and Data Management.
5.How we use information
We use personal information to:
- Create and secure your account, and verify your phone number and identity where needed.
- Let you find practices, book, reschedule and cancel appointments, join waiting lists and check in.
- Let practices and clinicians provide, record and coordinate your care.
- Send confirmations, reminders and messages on the channels you choose.
- Return missed calls when you have asked for a callback, within the limits described in our Help Center.
- Provide AI features you have consented to, with the safeguards described below.
- Issue invoices, process payments and refunds, and help practices prepare medical aid claims.
- Verify the professional registration of clinicians before they can be booked.
- Detect, prevent and investigate fraud, abuse, security incidents and misuse of the platform.
- Respond to support requests, complaints and requests to exercise your rights.
- Comply with our legal obligations.
- Understand how the service is used so we can improve it, using information that does not include health information.
We do not sell personal information. We do not use health information for advertising, and we do not share health information with advertisers or send it to analytics tools.
6.AI features and how they process information
Maatla Care uses AI to make some tasks easier. AI never replaces a clinician’s judgement.
The AI assistant
Where you have consented, the assistant helps with practical tasks such as finding and booking appointments. Before any AI model sees a message, a fixed set of rules checks it for emergency warning signs. The assistant does not diagnose, prescribe or give dosing advice. Only the information needed for the task is sent to the AI model provider.
AI documentation during consultations
With your consent, your clinician can have a consultation transcribed. The audio is sent to a speech-to-text provider, and the transcript to an AI model provider, to draft a note for your clinician to review. Audio is not retained after transcription. Nothing reaches your record until your clinician approves it.
No decisions made by AI alone
No decision about your care, or any decision with legal or similarly significant effects for you, is made solely by automated means.
Training
We do not use your health information to train AI models. Our policy is to use AI and speech-to-text providers only under business terms that do not allow them to use the data we send to train their own models.
Read more in Healthcare AI Safety.
8.Transfers outside South Africa
Some of our service providers may store or process information outside South Africa. POPIA only allows this in certain circumstances. We transfer personal information across borders only where the recipient is bound by law, binding corporate rules or a binding agreement that provides an adequate level of protection, where you have consented, or where the transfer is necessary to provide the service you asked for.
We limit what is sent. For example, AI requests contain only what is needed for the task, and payment card details go directly to the payment provider.
9.How we protect information
We use technical and organisational measures appropriate to the sensitivity of health information, including:
- Encryption in transit (HTTPS) and encryption at rest for databases and stored files.
- Additional field-level encryption for especially sensitive values, such as medical aid membership numbers and consultation transcripts.
- Access controls based on role and on a care relationship: practices only see patients they have a relationship with, and staff only see what their role needs.
- Audit logs of access to health records, which patients can see in their account.
- Multi-factor authentication for privileged users, such as clinicians, practice owners and managers, billing staff and platform administrators.
- Rate limits and monitoring to detect misuse, and secure document links that expire.
- Confidentiality obligations for our staff, and access to production systems limited to people who need it.
No system is perfectly secure. You can help by using a strong, unique password, keeping your phone locked, and never sharing one-time codes.
10.How long we keep information
We keep personal information only for as long as it is needed for the purpose it was collected for, or as the law requires. Our current retention defaults are:
| Information | How long we keep it |
|---|---|
| Content of AI assistant conversations | Deleted after 180 days by default. Request logs keep counts and timings only, not content. |
| Consultation audio (AI scribe) | Not retained after transcription. |
| Consultation transcripts (AI scribe) | Deleted 30 days after the note is approved or discarded. The approved note is the clinical record. |
| Clinical records created by practices | Retained by the practice in line with HPCSA guidance on keeping patient records. Never deleted automatically by the platform. |
| One-time codes and rate-limit records | Deleted within 24 hours of expiry or use. |
| Expired or revoked sign-in sessions | Deleted after 30 days. |
| Account and contact details | For as long as your account is open, then deleted or anonymised within a reasonable period unless the law requires us to keep them longer. |
| Invoices, payments and tax records | For the period required by South African tax and financial laws. |
| Consent records and security audit logs | For as long as needed to show that consent was given or withdrawn, and to investigate security incidents and meet legal obligations. |
These defaults are reviewed with our Information Officer. Clinical records are kept by practices for the periods set by HPCSA guidance, which are longer for children and some other categories of record.
11.Your rights
Under POPIA you have the right to:
- ask whether we hold personal information about you, and request a copy of it;
- ask us to correct information that is inaccurate, irrelevant, excessive, out of date, incomplete or misleading;
- ask us to delete information we are no longer authorised to keep;
- object to processing on reasonable grounds, and object to direct marketing at any time;
- withdraw consent you have given;
- not be subject to a decision based solely on automated processing that has legal or similarly significant effects for you;
- complain to the Information Regulator of South Africa.
You can make a request in the privacy section of your account (Privacy settings) or by emailing privacy@maatlahealthcare.com. We may ask you to confirm your identity first. We aim to respond within 30 days, and will tell you if we need longer and why. Requests about clinical records are passed to the practice responsible for them.
If you are not satisfied with our response, you can complain to the Information Regulator of South Africa. Its contact details are on its website, inforegulator.org.za.
12.Children's information
Information about children under 18 is processed with the consent of a parent or legal guardian (a “competent person” under POPIA), or where the law otherwise allows it. Children’s accounts are managed by a guardian through the dependants feature.
South African law allows children from the age of 12 to consent to certain health services themselves, depending on their maturity. In those situations, clinicians may keep some information confidential from a parent or guardian, as the law requires.
When a dependant turns 18, they are entitled to manage their own information, including deciding who else can see it.
14.Marketing messages
We only send news and offers about Maatla Care if you have opted in. You can opt out at any time in your account or by using the unsubscribe option in any marketing message. We never use health information to decide what marketing to send you, and service messages such as appointment reminders are never used for marketing.
15.If there is a security compromise
If we have reasonable grounds to believe that personal information has been accessed or acquired by an unauthorised person, we will notify the Information Regulator and affected people as soon as reasonably possible, as POPIA requires. We will explain what happened, the possible consequences, what we are doing about it, and what you can do to protect yourself.
Where we hold information as an operator for a practice, we will notify that practice immediately so that it can meet its own obligations.
16.Information Officer and contact
Our Information Officer is responsible for how Maatla Healthcare handles personal information, and for responding to requests and complaints. Contact the Information Officer at privacy@maatlahealthcare.com.
For general support, email support@maatlahealthcare.com.
17.Changes to this policy
We will update this policy when our practices or the law change. If we make a material change, we will tell you in advance by email or in your account, and ask for your consent again where the law requires it. Each version is dated, and your consent records show which version you agreed to.
Questions about your privacy?
Email our Information Officer at privacy@maatlahealthcare.com, or manage your consents in your privacy settings. See also Consent and Data Management and our Terms of Service.