Privacy Policy

MedVerify is a South African medical certificate issuance and verification platform. This policy explains what personal information we collect, why we collect it, and how we handle it in accordance with the Protection of Personal Information Act, 2013 (POPIA).

1. Information we collect

We collect the following categories of personal information:

• Practitioner data: full name, email address, professional registration number, password (stored as a one-way hash), verification evidence, and audit events related to account activity.
• Certificate data: patient name, optional patient identifier, certificate dates, and optional stated reason, as entered by the issuing practitioner.
• Technical data: IP address and timestamp for each verification attempt and audit event, collected to prevent abuse and for security.

2. Why we collect it

We process personal information to issue, store, verify and, where necessary, revoke medical certificates; to authenticate practitioners; to prevent fraudulent certificate creation; to comply with audit and record-keeping obligations; and to secure the platform against abuse.

3. Public verification and data minimisation

Anyone who presents a valid certificate reference and PIN can confirm that a certificate was issued by a registered practitioner and check its current status. Public verification responses contain only the reference, status, dates, practitioner name, and practitioner registration number. They do not expose patient name, patient identifier, or stated reason.

4. Lawful basis

Processing is based on the legitimate interests of the platform and its users in issuing and verifying certificates, on the consent of the practitioner at registration, and on compliance with applicable South African law. Where a patient's information is recorded on a certificate, the issuing practitioner is responsible for obtaining any necessary consent.

5. Retention

Certificate records are retained for a minimum period consistent with applicable South African record-keeping requirements for medical documentation and may be retained longer for audit or legal purposes. Personal information that is no longer required is deleted or anonymised.

6. Sharing

We do not sell personal information. We share information only where required to operate the platform (for example, with our hosting provider Railway, which operates under contractual data protection obligations), or where required by law.

7. Cross-border transfers

Our hosting infrastructure is provided by Railway and may involve processing outside South Africa. Transfers are made only where the receiving jurisdiction offers an adequate level of protection, or where contractual safeguards are in place as required by POPIA section 72.

8. Your rights

Under POPIA, you have the right to be notified when your personal information is collected, to request access to it, to request correction or deletion where applicable, to object to processing, and to lodge a complaint with the Information Regulator of South Africa.

9. Security

We use industry-standard safeguards including password hashing, hashed verification PINs, rate limiting on public verification attempts, audit logging, and encrypted connections (HTTPS). No system is entirely secure; in the event of a data breach affecting personal information, we will notify affected parties and the Information Regulator as required by POPIA.

10. Contact

For privacy requests or questions, please contact us via the details published on medverify.online.

This policy is provided for transparency and does not create any rights beyond those provided by applicable law.