Privacy and Data Retention Policy

1. Who We Are

Dialytic Flow (Pty) Ltd (“DialyticFlow”, “we”, “us”, “our”) is a South African company that operates a digital healthcare management platform designed for dialysis providers and their patients.

Registration Number: 2026/362831/07

We have registered our Information Officer with the Information Regulator of South Africa as required by POPIA.

2. Scope of This Policy

This Privacy and Data Retention Policy (“Policy”) applies to all Personal Information collected through:

• The DialyticFlow web application (browser-based);
• The DialyticFlow mobile application (iOS and Android);
• Our backend API services;
• Any communications between you and DialyticFlow (email, in-app chat, notifications).

It applies to all User types: Patients, Nurses, Unit Managers, Organisation Supervisors, and Global Administrators.

3. Information We Collect

Patient Users

Healthcare Professional Users (Nurses, Managers, Supervisors)

Organisation Accounts

Automatically Collected

• Device push token: used solely for push notification delivery (FCM/APNs); stored securely; not used for advertising.
• IP address: captured in server logs for security monitoring and rate limiting; not linked to patient records.
• Session timestamps and activity logs: for audit, compliance, and fraud detection.
• QR scan logs: timestamp, nurse ID, and patient ID, for session arrival verification.

Location Information

GPS coordinates are collected from your device in two limited circumstances, both requiring your explicit prior consent:

• Session check-in (I've Arrived): GPS coordinates are used transiently to verify proximity to your dialysis unit and are discarded from server memory once the check-in is complete. They are not stored in our database.
• Live distance sharing (I'm on my way): When you tap “I'm on my way” and have given GPS consent, the app sends your GPS coordinates to our servers periodically while your session status is En Route. Your coordinates are used solely to compute your straight-line distance from the dialysis unit. The coordinates themselves are never stored, logged, or visible to any party. Only the derived distance in metres and an estimated arrival time are stored on your session record and shared with your assigned nurse and unit manager so they can prepare for your arrival. This sharing stops automatically when your session progresses to Arrived or beyond. If you have not given GPS consent, tapping “I'm on my way” notifies your nurse and manager that you are en route without any location data.

The GPS coordinates of dialysis units (captured once from verified street addresses) are stored as operational data.

What We Do Not Collect

• Biometric data (the Android app may use device biometrics for local unlock, but this is processed entirely on-device by the OS, so we do not receive or store biometric data)
• Financial or payment card information
• Advertising identifiers (GAID/IDFA)
• Audio or video recordings
• Your contacts, photos, or files (camera is used only for QR scanning)

4. How We Use Your Information

We do not use your data for targeted advertising, sale to third parties, profiling for non-healthcare commercial purposes, or automated decision-making that produces legal or similarly significant effects without human oversight.

“Platform improvement and analytics” refers solely to internal operational analytics on aggregated, de-identified usage data (for example, measuring feature adoption or session-flow efficiency). DialyticFlow does not currently conduct formal health-related human subject research using patient data. If this changes in the future, this Policy will be updated in advance to describe the research, its legal basis, and the consent and ethics-review process that will apply.

5. How We Share Your Information

We do not sell your Personal Information.

5.1 Within Your Healthcare Organisation

Patients' session and booking data is accessible to authorised Healthcare Professionals (Nurses, Unit Managers, Supervisors) within the patient's registered Organisation. Access is enforced by role-based controls and row-level database security.

5.2 Technology Sub-Processors

We use the following sub-processors to operate the Platform. Each is bound by a Data Processing Agreement and processes data only on our documented instructions. Each sub-processor is contractually required to provide the same or equal level of protection for your Personal Information as is described in this Policy and required under POPIA.

Where sub-processors are located outside South Africa, we rely on Standard Contractual Clauses or equivalent adequacy safeguards under POPIA Section 72 to authorise cross-border transfers.

5.3 Third-Party AI Services

DialyticFlow does not currently use any third-party artificial intelligence (AI) service to process Personal Information. We are evaluating AI-assisted features (such as clinical note summarisation) for potential future development. Before any such feature is introduced, we will update this Policy to clearly disclose which third-party AI provider is used, what data is shared with it, and for what purpose, and we will obtain your explicit, informed consent before any of your Personal Information is shared with or processed by that AI service.

5.4 Legal Requirements

We may disclose Personal Information if required by law, court order, or regulatory authority (including the Information Regulator), or where we believe in good faith that disclosure is necessary to prevent imminent harm.

5.5 Business Transfers

In the event of a merger, acquisition, or sale of substantially all of our assets, Personal Information may be transferred as part of that transaction, subject to the acquirer assuming equivalent privacy obligations.

6. Data Security

6.1 Data Classification & Encryption Requirements

We classify all data we hold into one of four tiers and apply a matching set of security controls. This classification-based approach ensures that our most sensitive data always receives the highest level of protection, regardless of the specific field it appears in.

Email addresses are treated as Confidential PII Direct Identifiers. Uniqueness checks and database lookups are performed against a deterministic HMAC-SHA256 hash of the normalised address so the plaintext email is never written to disk.

6.2 Additional Security Controls

While we apply industry-standard security measures, no system is completely impenetrable. You are responsible for maintaining the security of your account credentials.

7. Data Retention

We retain data only for as long as is necessary for the purpose for which it was collected, or as required by applicable law.

When a Patient requests account deletion (directly within the app via Settings → Delete Account, without needing to email or contact support), an automated process pseudonymises all directly identifying fields (name, email, phone, ID number, address) by replacing them with cryptographic hashes. Clinical session records are retained in pseudonymised form for the legally required period.

Organisations may not be permanently deleted while they have active clinical records in the retention window; their accounts are suspended instead. Scheduled database jobs enforce the retention periods above and are audited on a quarterly basis.

8. Your Rights Under POPIA

We will respond to all POPIA requests within 30 calendar days. If a request is complex or voluminous, we may extend this period by a further 30 days and will notify you accordingly. We may request proof of identity before processing a request to protect against unauthorised access.

9. Children's Privacy

DialyticFlow is designed for use by individuals 18 years of age and older. If a minor (under 18) requires access to the Platform for their healthcare management, they must be registered by a parent, legal guardian, or authorised healthcare representative who accepts responsibility for the minor's data. The registering adult's contact details are captured as part of that minor's patient record, and all communications and consent obligations relating to the minor's data are directed to that registered parent, guardian, or representative.

We do not knowingly collect Personal Information from children under 13 without verifiable parental consent. If you believe we have inadvertently collected information from a child under 13, please contact privacy@dialyticflow.com immediately.

10. Push Notifications

We send push notifications via Firebase Cloud Messaging (FCM) for Android and Apple Push Notification Service (APNs) for iOS to deliver:

• Appointment reminders;
• Session status updates;
• Emergency alerts;
• Off-hours query responses;
• Platform announcements.

You may opt out of non-critical push notifications in your device operating system settings. Emergency alerts related to your active dialysis session cannot be disabled while you have an active booking, as they are a patient safety feature.

11. Cameras and Sensors

All permissions are requested at the point of use. You may revoke any permission at any time in your device operating system settings. Revoking camera or location permission will affect QR check-in functionality.

12. Data Breach Notification

In the event of a security compromise that involves Personal Information, we will:

• Contain and investigate the breach immediately;
• Notify the Information Regulator of South Africa within 72 hours of becoming aware of the breach, in accordance with POPIA Section 22;
• Notify affected data subjects as soon as reasonably possible, describing the nature of the breach and the steps taken or recommended to mitigate harm;
• Maintain an internal breach register.

13. Cookies (Web App Only)

We do not use advertising cookies or third-party tracking pixels. The mobile application does not use browser cookies; it uses secure encrypted storage (expo-secure-store) for session tokens.

14. Changes to This Policy

We may update this Policy from time to time. We will notify you of material changes by:

• Displaying a prominent notice within the Platform;
• Sending a notification to your registered email address at least 14 days before the changes take effect.

Continued use of the Platform after the effective date constitutes acceptance of the updated Policy. The “Last Updated” date at the top of this document will always reflect the most recent revision.

15. Google Play Data Safety and Apple App Store Privacy Labels

The following disclosures are made to comply with Google Play Store Data Safety requirements and Apple App Store privacy nutrition label requirements.

15.1 Data Collected and Its Use

15.2 Data Sharing

• Data is not sold to third parties.
• Data is not shared for advertising or marketing profiling.
• Data is not used for cross-app tracking.

15.3 Security Practices

• Data is encrypted in transit (TLS) and at rest (AES-256).
• Users can request deletion of their data, including directly within the app.
• A privacy policy is available at the public URL linked in the app store listing.

16. Contact Us