UPDATED 22 OCTOBER 2026
Privacy & POPIA
Medistat operates exclusively in South Africa, providing practice-management software, hosting, information storage and administrative services to healthcare practices. In delivering these services, Medistat receives, stores and processes practice and patient information. This notice explains the respective responsibilities of Medistat and participating practices under the Protection of Personal Information Act, 2013 (POPIA).
Our role and the practice’s responsibilities
Where a healthcare practice determines the purposes and means of processing patient information, that practice is the responsible party under POPIA. Medistat acts as an operator when processing information on the practice’s authorised instructions. Medistat is a responsible party for activities whose purposes and means it determines independently, including its own customer administration, service billing and business enquiries.
The practice remains responsible for clinical care, professional decisions, the accuracy of information it supplies, lawful processing instructions, staff permissions and patient notices. Medistat remains accountable for the legal obligations applicable to its services. A written operator agreement must address authorised processing, confidentiality, security safeguards and incident management.
Information we receive and store
Depending on the services used and the information supplied, records may include practice and staff particulars; user and access details; patient identity and contact information; dependant and representative details; appointments; medical-scheme information; accounts and claims; clinical records; questionnaires; supporting documents; and correspondence. Technical logs, support records and backup copies may also contain personal information.
Information may be provided by patients, authorised representatives, healthcare practices and authorised connected services. Only information relevant to a specified, lawful purpose should be supplied.
Medistat stores practice and patient information on its servers as part of the services it provides to healthcare practices. These records are distinct from information held in a browser or downloaded to a device. Signing out, closing a browser tab or deleting a downloaded document does not delete records retained by Medistat or the practice.
Purposes and lawful grounds for processing
Information is processed to deliver and support the contracted services. On a practice’s authorised instructions, these services may support patient administration, appointment management, care-related records, billing, medical-scheme administration and requested forms. Technical processing supports account security, troubleshooting, backups and service operation.
Each processing activity requires an appropriate lawful basis. Where applicable, additional legal authorisation is required for health information and children’s information. Consent to information processing is separate from consent to treatment or anaesthesia. Visiting this website or selecting a consent checkbox does not authorise unrelated marketing, unrestricted disclosure or unrestricted use of information for AI training.
Confidentiality, access and security
Access to, and disclosure of, personal information must be limited to authorised persons who require it for the stated purpose or to fulfil a legal obligation. Depending on the service, these persons may include practice staff, Medistat personnel, hosting and support providers, medical schemes and messaging service providers. Appropriate safeguards, confidentiality obligations and written operator arrangements are required.
No online service can guarantee absolute security. Medistat must notify the responsible practice immediately where POPIA’s operator notification requirements apply to a security compromise. The responsible party must make the notifications required by law. Suspected unauthorised access should be reported promptly, without including passwords or complete medical records in the initial correspondence.
Record retention and backups
Personal information must be retained only for justified service, clinical, contractual or legal purposes, including applicable recordkeeping obligations. Instructions concerning retention and deletion remain subject to those obligations. Withdrawal of consent or termination of a service does not automatically require the deletion of every record.
Backup copies require appropriate protection and controlled expiry. Deletion requests must be assessed across the relevant systems and against applicable retention requirements. Contact Medistat or your practice for the retention arrangements applicable to your records.
Your choices and statutory rights
Subject to applicable legal requirements, you may request access to your information, seek correction or deletion, object to processing on lawful grounds and withdraw consent for future processing that relies on it. Withdrawal does not affect the lawfulness of earlier processing or processing permitted on another lawful basis.
Patient-record requests should be directed to the relevant practice. Contact Medistat regarding its own business records or for assistance in directing a request. Reasonable identity verification may be required.
Portal registration is optional. If you prefer another means of providing information or receiving service, contact your practice. A representative must possess the necessary authority; a parent, guardian or other competent person must act where the law requires this. No consent checkbox waives statutory rights, including the right to approach the Information Regulator.
Contact and responsible use
For Medistat privacy enquiries, email info@medistat.co.za with the subject “Privacy / POPIA”, or telephone 011 854 8012. Please request assistance from the Information Officer, together with any business identity or address details you require. Your practice must identify its own responsible party and Information Officer.
The browser portal retains the sign-in session in the current tab’s memory. Refreshing or closing the tab ends that session; records held on the server remain subject to the retention arrangements above. Protect downloaded documents, sign out on shared devices and use demonstration features only with fictional information.
Notice version: MS-POPIA-2026-10-22-v3. This notice supplements the relevant practice notice and should be read with the service responsibilities and legal notice. It does not replace the written operator agreement.