Healthcare App portal / Privacy Notice
Version 2026-10-28.1 · fingerprint 5b00565001a7e224
Version: 2026-10-28.1 Effective date: 28 October 2026 Applies to: portal.healthcareapp.co.za (the "portal"), including the patient and employee portal, the staff and doctor portal, the employer view and the public verification pages.
This notice explains what personal information the portal uses, why, who can see it, how long it is kept and what your rights are. It is written to meet section 18 of the Protection of Personal Information Act 4 of 2013 ("POPIA"). Please read it before you sign in. You can read it again at any time from the link at the bottom of every portal page.
Two companies are involved. Each has a different role.
Therapy On The Go (Pty) Ltd (registration number 2022/668078/07), 293 Summit Road, Knoppieslaagte, Centurion, 0026. Therapy On The Go provides the clinical services: health screening, medical surveillance, fitness assessments, vaccinations, counselling and the related reports and certificates. It is the responsible party for your health records. This means it decides why and how your health information is used.
Healthcare App (Pty) Ltd (registration number 2019/612883/07), 293 Summit Road, Knoppieslaagte, Centurion, 0026. Healthcare App builds and runs the portal software. For your health records it is an operator (POPIA sections 20 and 21). This means it handles them only on Therapy On The Go's written instructions, under a written agreement, and never for its own purposes. Healthcare App is the responsible party only for your portal account and security information: your sign-in details, one-time codes, device and session records, and security logs.
If your record was created by another clinic or practice that uses the portal, that clinic is the responsible party for that record. Its name is shown on the record in your portal.
How to contact us: e-mail info@therapyonthego.co.za with the subject "POPIA request". Telephone: 066 248 6595 (office hours). Post or hand delivery: 293 Summit Road, Knoppieslaagte, Centurion, 0026. Address your letter to the Information Officer of the company you want to reach (see section 15).
Identity and contact details. Your name and surname, South African ID number or passport number, date of birth, sex, mobile number, e-mail address and employee number.
Work details. Your employer, site, department and job, where this is needed for occupational health.
Health information (special personal information). Screening results (for example blood pressure, glucose, cholesterol, vision, hearing and lung function), medical surveillance results, fitness outcomes and certificates, vaccination records (for example Hepatitis B doses, batch numbers and due dates), referrals, and clinician notes. Psychological and stress-screening answers are visible only to clinicians and are never shown in the employee or employer view.
Consent records. What you agreed to, when, and which version of this notice and the Terms of Use you saw.
Portal account and security information. Your sign-in e-mail, the time and result of each sign-in, one-time codes (stored only in scrambled, "hashed" form), session and device details (such as browser type and IP address), the claim codes you used, the share links you made, and a log of who opened your record.
Staff information. For clinicians, doctors, administrators and employer HR users: name, work e-mail, role, professional registration number (for example HPCSA or SANC) and security logs.
Most information comes from you, from the clinician who sees you, or from your employer (for example a staff list for a wellness or medical surveillance day).
Some records were moved into the portal from two earlier systems: the Healthcare On The Go system run for Therapy On The Go, and the earlier healthcareapp.co.za wellness-day system. About 1,423 people's records were moved in this way. We moved only what is needed. Some legacy results are marked "preliminary" until a doctor reviews them, and a few records with missing details are kept aside until a clinic confirms them with you.
HIV test results are never stored on the portal. This is our standing policy. HIV counselling and referral for care (linkage) may be recorded by the nurse or doctor, but the result itself is not stored. HIV results from the earlier systems were not moved into the portal.
We do not collect your bank card details, and we do not sell personal information.
| Purpose | Legal basis (POPIA) |
|---|---|
| Providing health screening, medical surveillance, fitness assessments, vaccinations and counselling, and keeping the clinical record | Your consent (s11(1)(a), s27(1)(a)); health care by health professionals under a duty of confidentiality (s32(1)(a)); a legal duty under occupational health and safety law (s11(1)(c), s27(1)(b)) |
| Issuing fitness certificates and vaccination certificates, and telling your employer the fitness outcome where the law requires it | A legal duty (s11(1)(c)); employer occupational health duties (s32(1)(f)) |
| Letting you sign in, claim your records, download reports and share them | Your request and your consent (s11(1)(a) and (b)) |
| Keeping the portal secure, preventing fraud and keeping audit logs | Legal duty to secure information (s19); legitimate interest (s11(1)(f)) |
| Giving your employer group (aggregate) health statistics | Only de-identified group figures for groups of at least 10 people; no one can be identified |
| Answering complaints and requests, and defending legal claims | Legal duty and legitimate interest (s11(1)(c) and (f); s27(1)(b)) |
We use your information only for these purposes, or for a purpose that is compatible with them (s13 and s15).
Using the portal is voluntary. You can still receive your services and ask for paper copies of your reports and certificates from the clinic.
Some information is mandatory if your job requires medical surveillance or a certificate of fitness under the laws in section 5. If you do not provide it, the clinician may not be able to issue a certificate, and your employer may not be able to let you do that work until you are assessed.
To use the portal you must give a working e-mail address (and, when SMS sign-in is switched on, a mobile number) so that we can send you one-time sign-in codes. To claim older records you must give identity details that match the record (see section 7). If you do not, we cannot safely show you the record.
Consent. At your first sign-in you will be asked to confirm your consent. We do not assume that you agreed in the past. You may withdraw consent at any time (see section 13). Withdrawing does not undo lawful processing that already happened, and it does not stop processing that a law requires.
Signing in. You sign in with a secure link and a 6-digit one-time code that we e-mail to you. Codes expire after a short time and can be used only once. Later we may also send codes by SMS; we will update this notice before we do.
Claiming older records. To link records from the earlier systems to your account, you need one of these:
If an older record has no date of birth, the clinic must check your identity with you (for example by phone or in person) before the record is linked.
You may claim only your own records. We limit the number of attempts, and every attempt is logged.
| Who | What they can see |
|---|---|
| You | Your own records, reports, certificates and the "who viewed my record" page |
| Nurses, clinicians and doctors treating you | The clinical record they need for your care, under professional confidentiality |
| Doctors signing certificates | The results needed to make and sign a fitness or vaccination decision |
| Your employer's HR users | Only your fitness outcome (for example "fit", "fit with restrictions" or "not fit") where the law requires it for your job or you agreed, and de-identified group figures. Never your clinical results, notes, counselling records or anything about HIV |
| Portal administrators | Account and technical information. They open a clinical record only through an emergency "break-glass" process, which is logged and reviewed |
| Auditors | Logs and records needed for a compliance check, under confidentiality |
| Anyone you send a share link to | Only the document you chose, until the link expires or you cancel it |
| Anyone who scans a certificate's QR code | Only the certificate type, your initials, the status (valid, expired or revoked) and the date. No results |
Service providers (operators) that process information for us:
We may also have to share information when a law, a court order or a regulator requires it, for example a labour inspector or the Department of Employment and Labour under OHSA.
Your health records are stored in South Africa. The e-mail service (SendGrid) is in the United States, so your e-mail address, the one-time code and the sign-in link pass through the United States to reach you. When SMS is switched on, your mobile number and the code may also pass through the SMS provider's country.
We allow this only under POPIA section 72: the provider is bound by a written agreement that gives protection substantially similar to POPIA (s72(1)(a)), and the transfer is needed to deliver the service you asked for (s72(1)(c)).
| Information | How long |
|---|---|
| Clinical health records | At least 6 years after the last entry, in line with HPCSA guidance on keeping patient records and the National Health Act. For a child, until the child turns 21 at least. |
| Occupational medical surveillance and vaccination records | 40 years after the last entry, as required for records of workers exposed to hazardous biological agents and hazardous chemical agents |
| Consent records | As long as the record they relate to |
| Portal account details | While your account is open, and up to 12 months after it is closed |
| Audit and security logs (including "who viewed my record") | 6 years |
| One-time sign-in codes | Deleted within 24 hours (codes expire long before that) |
| Share links | Until they expire or you cancel them; a record that the link existed stays in the audit log |
When the period ends, we delete the information or make it impossible to identify you (s14). We may keep it longer only if a law, a court order or an open legal claim requires it.
No system can be made perfectly secure. If we have reasonable grounds to believe that your information was accessed by someone without permission, we will tell the Information Regulator and you as soon as reasonably possible (s22), unless the law or the police tell us to wait.
The portal uses fixed rules to sort results (for example, to group straightforward legacy fitness results for a doctor's review and to list exceptions). These rules only recommend. A registered doctor or clinician reviews and makes every decision about your fitness, certificate or care. The portal does not make any decision about you that has legal or similar effects using automated processing alone (s71). You may ask how a decision was made and give your side.
You have the right to:
To use a right, use the portal settings or e-mail info@therapyonthego.co.za with the subject "POPIA request". We may ask you to prove your identity first. We reply within 30 days. Requests for records under the Promotion of Access to Information Act 2 of 2000 follow the PAIA manual of the company concerned.
Please contact the Information Officer first, so that we can put things right. You may also complain to the Information Regulator (South Africa):
Portal accounts are for people aged 18 and older. A parent or legal guardian may ask the clinic for access to a child's record (s35).
We will publish any change here with a new version number and effective date. If a change materially affects how we use your health information, we will tell you and ask you to confirm before it takes effect.
Version 2026-10-28.1. Effective 28 October 2026.