Privacy Policy

Who We Are

Med Report Solutions (Pty) Ltd (registration number 2026/424068/07) is the responsible party for personal information processed through the MedReport platform, which is developed and operated by Smart Station (Pty) Ltd (registration number 2021/750734/07).

Information Officer:Devereaux Joubert
Deputy Information Officer:Angela Grant
Email:legal@medreport.co.za

Website visitors (medreport.co.za)

• Your name and email address if you submit an enquiry or book a demonstration.
• Anonymised or aggregated usage data through cookies — see our Cookie Policy.
• We do not collect patient health information, payment card details, or special personal information from ordinary website visitors.
• Contact details from enquiries are used only to respond to your request or schedule a walkthrough.

MedReport platform (app.medreport.co.za and related services)

For subscribed practices, the practice is typically theResponsible Party under POPIA for patient information. Med Report Solutions (Pty) Ltd (with Smart Station (Pty) Ltd as technology operator) processes that information as anOperator on the practice's instructions, under the subscriber agreement and a data processing arrangement.

Categories processed on the platform may include (depending on features enabled for the practice):

• Patient demographics and clinical content in reports, notes, and uploaded source documents
• Voice/consult recordings and transcripts where recording features are used
• Practitioner and staff account details, roles, and audit logs
• Report delivery history and, for medical certificates, limited public verification metadata (see below)
• Billing and subscription information for the practice account

Assisted drafting and extraction are used to produce drafts only. Clinicians remain responsible for review, accuracy, and final approval before clinical use.

Public medical certificate verification

Where a practice finalises a medical certificate with verification enabled, a QR code may link to a public MedReport page so a third party (for example an employer or school) can confirm legitimacy. That public page is designed to show limited identity and practice contact information only. It is not intended to publish fitness dates, diagnoses, ID numbers, or the full certificate body. Clinical detail remains on the signed certificate controlled by the practice.

How Long We Keep It

• Enquiry records are retained for 2 years, or for the duration of any resulting subscriber relationship, whichever is longer.
• Anonymised website usage data is kept for up to 12 months.
• Information no longer required is securely deleted.

Who We Share It With

• We do not sell or trade personal information.
• We use carefully selected processors (for example authentication, cloud hosting, email delivery, and AI/transcription services where enabled) under written arrangements that require appropriate security and confidentiality.
• For platform patients, we process on behalf of the subscribing practice and may disclose information only as instructed by that practice, as required by law, or as needed to provide the contracted service (including limited public certificate verification data described above).
• We will disclose information where required by law or a competent authority.

Where It Is Held

Personal information is protected with encryption and access controls. Hosting regions depend on deployment configuration and contract terms. Where processing outside South Africa is necessary, appropriate safeguards are applied as required by POPIA. Contact us for current residency options.

Your Rights

You may at any time request access to or correction of your personal information, object to its processing, or withdraw your consent. To do so, contact our Information Officer atlegal@medreport.co.za. We will respond within 30 days.

You may also lodge a complaint with theInformation Regulatorof South Africa.

Related documents

• Cookie Policy
• Acceptable Use Policy
• PAIA Section 51 Manual
• Subscriber Agreement and Data Processing Agreement — provided to practices on subscription (not all commercial terms are published on this website).

Updates

We may update this policy from time to time. The current version is always available at:medreport.co.za/privacy. Version note: July 2026 update clarifies website vs platform processing, Operator role, voice/document features, and medical certificate verification.