Notice of Privacy Practices for Medical Providers
Dr. Chomba & Associates, Inc (trading as iScript) · BHF Practice 0558419
Effective Date: 1 January 2026 · Version 2.0
Purpose of This Notice
This notice describes how iScript collects, uses, stores, and discloses the personal and practice information of healthcare providers (doctors, clinical associates, and other professionals) registered on the iScript platform. It is provided in accordance with POPIA, the Health Professions Act, and our duty of transparency to the medical professionals we work with.
1. Information Collected from Healthcare Providers
iScript collects the following information from registered healthcare providers: Identity & Professional Information: Full name, date of birth, SA ID number, HPCSA registration number, specialist category, qualifications, BHF practice number, professional indemnity details. Contact Information: Email address, mobile number (including WhatsApp), physical practice address. Financial Information: Bank account details for fee payments (EFT), VAT number (where applicable). Clinical Activity Data: Consultation records, prescriptions issued, diagnoses made, SOAP notes, patient ratings, and clinical outcomes data (anonymised for quality improvement purposes). Platform Usage Data: Login times, consultation durations, feature usage, and session logs for security and audit purposes. Identity Verification Documents: Copy of HPCSA registration certificate, certified ID document, and HPCSA certificate (required for onboarding verification).
2. How We Use Provider Information
We use healthcare provider information for the following purposes: Clinical Matching: Matching you with patients based on clinical verticals, availability, and expertise. Payment Processing: Calculating and processing monthly consultation earnings via EFT. HPCSA Compliance: Verifying and maintaining your registration status in compliance with HPCSA requirements. Platform Security: Monitoring for fraudulent activity, unauthorised access, or clinical safety concerns. Quality Assurance: Reviewing consultation records for quality and safety monitoring (with appropriate clinical governance). Regulatory Reporting: Mandatory reporting to HPCSA, DoH, or law enforcement where required by law. Communication: Sending appointment notifications, platform updates, policy changes, and operational communications.
3. Patient Data Access
As a registered iScript provider, you will have access to patient health information necessary for conducting consultations. You acknowledge and agree that: • Patient health information is shared with you solely for the purpose of providing clinical care • You are bound by the ethical obligations of the HPCSA and the confidentiality requirements of the Health Professions Act • You may not use, share, copy, or disclose patient information for any purpose outside of direct clinical care • You will comply with POPIA in all interactions with patient data • Access to patient records is logged and audited • Breach of patient confidentiality will result in immediate suspension and may be reported to the HPCSA
4. AI-Assisted Clinical Tools
iScript provides AI-assisted clinical decision support tools that process patient assessment data to assist your consultations. As a provider, you acknowledge: • AI-generated reports and suggestions are clinical decision support tools — not autonomous diagnoses • All clinical decisions remain your professional responsibility • You are not obligated to follow AI suggestions • AI outputs are logged for quality assurance purposes • You should alert iScript to any AI outputs that appear clinically unsafe or inappropriate
5. Financial Data & Payment
Your banking details are stored using industry-standard encryption and are used exclusively for fee payment purposes. iScript does not share your banking information with third parties other than the bank processing your EFT payment. Monthly earnings statements are available in your dashboard. All payment records are maintained for 5 years in accordance with SARS requirements. Queries about payments should be directed to practice@iscript.co.za.
6. Data Sharing with Third Parties
Your professional information (name, title, specialty, practice details, and HPCSA number) may be displayed to patients on the iScript platform for the purpose of appointment booking. This is a necessary and expected part of operating as a provider on a public health platform. We do not share your personal or financial information with advertisers, marketing companies, or unrelated third parties. Regulatory authorities may request information about your practice activity in accordance with their statutory powers.
7. Your Rights as a Provider Under POPIA
As a healthcare provider registered on the iScript platform, you retain all rights afforded to data subjects under POPIA, including rights of access, correction, and objection. To exercise these rights, contact practice@iscript.co.za. You may deactivate your iScript profile at any time. Deactivation will prevent new bookings. Historical consultation records will be retained for the legally required period to protect both patient rights and your professional interests.
8. Data Security
Provider login credentials are protected by mandatory two-factor authentication. Consultation session data is encrypted in transit and at rest. Clinical records are stored on secure, South Africa-based servers. All access is role-based and strictly limited to the information needed for each function. Any suspected security breach should be reported immediately to practice@iscript.co.za.
9. Complaints
If you believe your privacy rights have been violated by iScript, please contact our Information Officer at practice@iscript.co.za. If not resolved to your satisfaction, you may lodge a complaint with the Information Regulator: complaints.IR@justice.gov.za.
