Privacy Notice

Under the Protection of Personal Information Act 4 of 2013 (POPIA) there are two distinct roles, and which one applies decides who you go to.

• Your practice is the responsible party. The dental or GP practice you are a patient of decides why your information is collected and what happens to it. It holds the clinical relationship and it answers for the record.
• CareSavi is an operator. We process information on the practice's documented instructions — which modules it has enabled, which automations it has switched on, which consent wording it uses. We do not decide the purposes of processing, we do not use patient information for our own ends, and we do not decide when a clinical record is destroyed.

Practically: if you are a patient, exercise your rights with your practice — it is the responsible party, and we act on its instruction. If you are a practice, CareSavi is the responsible party for your own account and billing information, and this notice applies to us directly.

CareSavi is operated by MemberSavi / Dinnative Technologies (Pty) Ltd, a company registered in South Africa under registration number [[COMPANY_REGISTRATION_NUMBER]], with its registered address at [[REGISTERED_ADDRESS]] and postal address [[POSTAL_ADDRESS]].

Our PAIA manual, which sets out the records we hold and how to request them, is at /paia.

We process only the categories below. We do not buy personal information, and we do not enrich a patient record from outside sources.

POPIA and the 2026 Regulations on the processing of health information require a separate, identifiable ground for each purpose — a single “I accept the terms” tick is not enough for health data. Each practice therefore keeps a processing register, and the rows below are the ones CareSavi ships with.

An honest note on two of these. Appointment reminders rest on the arrangement your booking creates rather than on consent, because nothing asks you for consent to a reminder and inferring it from the act of booking would be wrong. Strictly, that basis carries no statutory objection right — but we honour STOP for reminders anyway, and say so in the messages themselves.

Health information is special personal information. POPIA s26 prohibits processing it at all unless a s27 ground applies, and the Regulations relating to the Processing of Data Subjects' Health Information (Gazette 54268, in force 6 March 2026) add further requirements. The consequences you can see in the product:

• Health information is encrypted before it is stored, not merely stored on an encrypted disk.
• Every read and write is audited to an append-only log naming who did it and when. That log is what lets a practice tell you who has seen your record.
• Health information is never written to system logs, error reports or analytics. Only opaque identifiers are.
• Consent for health processing is explicit, purpose-specific and timestamped, and recorded with the exact wording version you were shown.

CareSavi's databases, caches, file storage and application servers run in Oracle Cloud Infrastructure's af-johannesburg-1 region — in South Africa. That is the residency anchor for the whole system: patient records, clinical notes, uploaded documents, message history and the search index that powers the AI assistant all sit there.

Practice knowledge used for AI search is, by default, converted into a numeric index by a model that runs inside our own South African infrastructure, so that step involves no third party and no transfer at all.

The exceptions are the transfers in §7 and §8, which are exactly the ones a WhatsApp, payment or AI feature cannot avoid.

These are the third parties that may process information on our behalf, what they touch, and where. We keep this list current; the register behind it is also stored in the system, per practice, so a subject-access request can name the recipients for your record specifically.

Not on this list, deliberately. CareSavi does not use a speech-to-text vendor: the clinical note assistant is text-only and no audio is recorded or transmitted. A practice may also supply its own AI provider key, which narrows that relationship to the practice and the provider directly.

POPIA s72 allows personal information to leave South Africa only where you have consented, or where a binding agreement gives protection substantially similar to POPIA, or where the recipient country's law is comparable. We rely on all three layers together:

1. A distinct consent for the transfer itself, recorded per purpose — AI, messaging, payments and the clinical note assistant are four separate consents, not one.
2. Contractual protection with each recipient, carrying the retention and no-secondary-use commitments in §7 down the chain.
3. Minimisation before egress— the primary control. We send the least data the function needs, never the record. The AI receptionist sees minimised conversation text, not your file; the note assistant sees one visit's draft and nothing else — no history, no prior notes, no documents, no identifiers, no medical-aid data, no messages.

• Encryption at the record level. Health and identifying fields are encrypted with AES-256-GCM under a per-record key, itself wrapped by a key held in a managed key vault — on top of transport and disk encryption.
• Hard separation between practices.Every record carries its practice, and the database itself enforces the boundary with row-level security, so a query that forgot to filter returns nothing rather than someone else's data.
• An append-only audit trail. Audit entries are chained and cannot be edited or deleted, including by us.
• No health data in logs. Enforced automatically in our build, not by policy alone. Error reports are scrubbed before they leave our servers.
• Access control. Role-based permissions, two-factor authentication, and a second authentication step before the most sensitive actions.
• Time-limited file access. Uploaded documents are served through short-lived signed links, never a public URL.

If information under our control is compromised, we notify the affected practice immediately so it can meet its own POPIA s22 obligations to you and to the Information Regulator.

Health records are the one place where “keep as little as possible” loses. South African law sets minimum retention periods that override minimisation:

Because CareSavi is an operator, we do not choose a destruction date. The practice sets one; our system validates it against the statutory floor above and refuses a date that would destroy a record too early. Where the practice has set no date, nothing is destroyed. A daily job carries out only the destructions the practice has actually instructed, and records each one in the audit trail.

Ask your practice — it is the responsible party. The practice exercises each of these through CareSavi, and every request is itself audited.

Two limits we will not pretend away. First, deletion cannot override the statutory minimums in §10 — a request against a record still under a retention obligation is deferred, not refused, and the response says so rather than reporting a deletion that did not happen. Second, WhatsApp offers no message-deletion facility: once a message has been delivered through Meta's platform, an erasure on our side cannot reach the copy Meta holds. We can guarantee the destruction of our own copy, and we do; we cannot promise more than that.

CareSavi is WhatsApp-first. Messages fall into two kinds and the distinction is enforced in code, not left to judgement:

• Clinical and transactional — appointment confirmations, reminders, aftercare nudges. These do not depend on a marketing opt-in, because gating a clinical follow-up on a marketing consent would silence it for every patient who declined marketing.
• Marketing and engagement — recalls, review requests, satisfaction surveys, practice news. These require a separate opt-in under POPIA s69, checked again at the moment of sending rather than only when the message was scheduled.

Where a WhatsApp message cannot be delivered, a practice may enable a narrow SMS fallback for that message. It is a fallback for one undeliverable leg, never a second channel, and it is never sent past a recorded objection.

Aftercare instructions, visit summaries and clinical notes are not sent as WhatsApp messages. What you receive is a content-free knock— the practice name and a single-use link. The summary itself is served by the practice's patient portal, hosted in South Africa, behind a one-time PIN sent to you and then a PIN you choose. The “aftercare” option in the WhatsApp menu re-sends that link and nothing else.

This is why the sub-processors carrying WhatsApp messages in §7 are described as receiving message content but never clinical detail — there is none in the message to receive.

CareSavi uses a large language model for an AI receptionist on WhatsApp, for classifying and summarising conversations, and for a clinical note assistant. Four rules govern all of it:

1. The model proposes; code decides. Bookings, payments, sends and record writes are performed by ordinary application code with its own checks. The model can only ask for one of a fixed set of actions.
2. Never diagnostic. The assistant does not diagnose, does not give clinical advice, and escalates urgent presentations to a person instead of handling them.
3. Clinician in the loop. The note assistant produces a draft that a clinician edits and explicitly approves. Until that approval, no clinical note exists. A clinician can decline it entirely.
4. Off unless switched on, and consented. Each AI feature is enabled per practice and checked against a live consent for the cross-border transfer at the moment of use.

The AI providers we use commit to not retaining API inputs and not training on them. We record that an AI interaction happened and what it cost, never the content of the prompt or the reply outside the encrypted store.

This marketing site is a brochure. It holds no patient information, has no login, talks to no backend, and sets no analytics or advertising cookies. Fonts are served from Google Fonts, which means your browser makes a request to Google when the page loads.

The practice application, the patient portal and the API are separate systems with their own authentication; they use strictly-necessary cookies to keep you signed in.

Where the patient is a child or cannot consent for themselves, consent must be given by a competent person — a parent, guardian or someone lawfully authorised. Records of minors are kept until the patient turns 21, per §10, which means a deletion request made before then is deferred rather than carried out.

We update this notice when what the system does changes — including whenever a sub-processor is added or removed. The version and effective date are at the top. Practices are notified of material changes per their agreement with us.

Raise it with your practice first, or with our Information Officer at [[INFORMATION_OFFICER_EMAIL]]. If you are not satisfied, you may complain to the Information Regulator (South Africa) — inforegulator.org.za, contact details [[INFORMATION_REGULATOR_COMPLAINTS_CONTACT]]. You may also apply to a court.

See also our Terms of Service and PAIA manual.