POPIA operator agreement

Working draft pending legal review (WP0.9). Not for real patients.

This agreement is between the practice (the responsible party) and the platform operator (the operator), under sections 20 and 21 of the Protection of Personal Information Act.

1. Instructions. The operator processes personal information of the practice's patients only with the knowledge or authorisation of the practice, and only to provide the service.

2. Confidentiality. The operator treats that information as confidential and does not disclose it, unless the law requires it.

3. Security. The operator keeps appropriate, reasonable technical and organisational measures in place: separation of every practice's data, encryption of sensitive fields with a key per practice, access control by role, and an append-only audit log.

4. Break-glass. Platform staff have no standing access to patient identity or clinical content and no "log in as" feature. Access happens only for a permitted purpose (a security incident, a legal order, or support the practice owner has asked for), scoped to named records, with a written reason, a second approver, a time limit of two hours by default, full logging, and immediate notice to the practice owner.

5. Breaches. The operator notifies the practice within 4 hours of reasonable belief that personal information was compromised, and never later than 24 hours, and supports the practice's notices to the Information Regulator and to patients.

6. Sub-processors. The operator lists its sub-processors publicly and gives at least 30 days notice before adding one.

7. End of the agreement. The practice can export all its records. After the agreed retention period, the operator deletes or destroys the practice's data, including by destroying the practice's encryption key.