The sealed record

Two years later, you can prove what you signed and what you checked.

A complaint, an audit or a medical-aid dispute arrives long after the consult, when nobody remembers the room. The doctor who signed is the person who has to answer. MedReport builds that answer at the moment of signature, so it does not have to be reconstructed later.

Book a 20-minute demo How the checks work

Sealed record

DS-2026-0841

Verified

Content fingerprint: SHA-256 2f9c8b41…74de2a41d
Signed by: Dr A. Pillay · HPCSA MP0451209
Independent timestamp: 12 Aug 2026 · 14:22:07 SAST
Checks reviewed at signature: MedicationICD-10Allergy reviewed

What the seal contains

Four things, recorded once,by the doctor who signed.

Content fingerprint

A cryptographic hash of the exact bytes that were signed. If a single character of the document changes afterwards, the hash no longer matches, and the alteration is detectable by anyone holding the seal.

Verified signer

The signing clinician's HPCSA registration, checked against the register at the moment of signature. Not a name typed into a box at sign-up and never looked at again.

Independent timestamp

A trusted third-party timestamp. The date on the record does not rest on MedReport's word, or the practice's, or a server clock either party controls.

Checks reviewed

Which flags the system raised and which the clinician reviewed before signing. Evidence of the care taken, captured as a by-product of the work rather than as a file somebody had to remember to keep.

Whose record it is

This is the doctor's evidence,held by the practice.

The seal exists so that a clinician who did the work carefully can show it. It is produced for the person who signed, it belongs to the practice as responsible party, and it exports whole whenever you ask for it.

MedReport does not report on clinicians, score them, or send anything to a regulator, a scheme or an employer. There is no dashboard anywhere that ranks your doctors. The record moves when the practice moves it, and only then.

Yours to take

Exportable

Every signed document with its seal and audit record, in bulk, at any time, including on the day you decide to leave.

Yours to prove

Verifiable by a third party

A recipient can confirm a document is the one that was signed without needing an account with us, and without us being in the room.

Yours to set

Retained on your terms

Retention periods are set by the practice against its own obligations, not by us against ours.

Security overview

Where the data sitsand who can reach it.

Where the data lives

Consult audio is processed and discarded once the note is accepted. Data residency is set per deployment and stated in your contract, so ask for the current position before you sign.

POPIA, with the practice as responsible party

MedReport is the operator. The data processing agreement sets the roles out and forms part of the subscriber agreement, and a PAIA Section 51 manual is published naming the Information Officer.

Role-based access

Doctors, practice staff and locums see what their role allows. Locum access is time-boxed and ends on a date. Signing is never delegable.

Encryption

In transit and at rest. Seals are held separately from document storage, so a document cannot be altered and re-sealed from one place.

Access logging

Who opened which patient record, and when, available to the practice. This one exists for your POPIA obligations, and the practice reads it, not us.

ISO 27001

Certification is under way. We will name the certifying body and the date when it is issued, and not before.

Objections

Questions this sectionusually raises.

Is a sealed PDF legally recognised in South Africa?

The Electronic Communications and Transactions Act recognises electronic signatures and data messages. Have your own attorneys review the seal against your indemnity requirements. We will send the technical description to them directly.

Can a document be edited after signing?

Not in place. An amendment creates a new version with its own signature and seal, and the original stays intact and retrievable. That is how an amendment should read to anyone examining it later.

Who can see which flags I reviewed?

The practice, as the holder of the record, and you. It is not shared with a scheme, a regulator or an employer by us.

What if MedReport is not around in five years?

Exports are self-contained. The document, the seal and the verification method go with you, and can be checked without our servers being involved.

Ask us to seal one of your own signed reports on the call.

Bring a document you have already signed by hand, and we will show you what the sealed version of it would look like if it were queried in 2029.

Book a 20-minute demoOr email hello@medreport.co.za