Privacy Policy

Last updated: July 2026

Welcome Desk (“we”, “our”, “us”) is operated by WelcomeDesk (Pty) Ltd, a company registered in South Africa. We are committed to protecting the privacy of both the healthcare practices that use our platform (“Practices”) and the patients who submit information through it (“Patients”).

This Privacy Policy explains what information we collect, why we collect it, how we use it, and your rights in relation to it. By using Welcome Desk, you agree to the terms of this Policy.

1. Who this policy applies to

• Practice users (owners, administrators, receptionists, practitioners) who create and manage accounts on Welcome Desk.
• Patients who submit personal and medical information through a Practice’s intake form or booking page.

2. Information we collect

From Practices: practice name, contact details, billing information, and staff account information (names, email addresses, roles).

From Patients: full name, date of birth, South African ID number or passport number, contact details, home address, medical aid information, emergency contact details, account-responsible person details, uploaded documents (such as ID and medical aid card), and digital consent and signature.

3. How we use your information

• To provide and operate the Welcome Desk intake and booking platform to Practices.
• To store and display patient records to authorised Practice staff.
• To generate exports of patient records on request.
• To manage subscription administration, invoicing, and billing communications with Practices.
• To send service notifications and booking-related emails.
• To comply with our legal obligations under the Protection of Personal Information Act (POPIA) and other applicable South African law.

We do not sell patient data. We do not use patient data for advertising, profiling, or any purpose other than providing the service to the Practice.

4. Legal basis for processing (POPIA)

• Contract performance: processing necessary to provide the service to Practices under our subscription agreement.
• Consent: Patients provide explicit digital consent before submitting their information.
• Legitimate interest: for billing, support, and service improvement purposes.
• Legal obligation: where required by applicable law.

5. Data storage and security

Patient data is stored on secure infrastructure provided by Supabase and is encrypted at rest and in transit (HTTPS). Access to patient records is restricted to authorised staff of the relevant Practice through role-based access controls enforced at the database level. Uploaded documents are stored privately and accessed only through short-lived signed links.

6. Data retention

Patient records are retained while the Practice’s account is active, in line with South African medical record retention guidance. Practices may request deletion of patient records at any time by contacting us. Patients have the right to request deletion of their records from the Practice (as the Responsible Party under POPIA).

7. Sharing of information

• Service providers: we use Supabase (database and storage), Resend (email delivery), and Vercel (hosting). These providers are contractually bound to protect your data.
• Legal requirements: where required by law, court order, or lawful authority.
• Business transfer: in the event of a merger, acquisition, or sale of assets, personal information may be transferred to the successor entity, subject to the same privacy protections.

8. Your rights under POPIA

• Access the personal information we hold about you.
• Request correction of inaccurate information.
• Request deletion of your information (subject to legal retention requirements).
• Object to processing in certain circumstances.
• Lodge a complaint with the Information Regulator of South Africa.

To exercise any of these rights, contact us at checkin@welcomedesk.co.za.

9. Cookies

This site uses only essential session cookies required for authentication. We do not use tracking cookies, advertising cookies, or third-party analytics cookies.

10. Changes to this policy

We may update this Privacy Policy from time to time. We will notify Practice users of material changes by email. Continued use of Welcome Desk after changes are published constitutes acceptance of the updated Policy.