Data Processing Agreement

This DPA governs the processing of Patient Data by the Operator on behalf of the Responsible Party for the purpose of providing the Medifile platform and associated services as described in the Terms of Service.

The Operator will process Patient Data for the following purposes only:

• Storing, organising, and retrieving patient health records as directed by the Responsible Party
• Applying OCR and AI processing to documents uploaded by the Responsible Party to extract and classify content
• Enabling the Responsible Party to create, share, and manage clinical notes, referrals, and related records
• Generating AI-assisted patient summaries from data uploaded by the Responsible Party
• Maintaining compliance, audit, and retention functions on behalf of the Responsible Party
• Providing technical support and troubleshooting (subject to clause 4.5)

Patients of the Responsible Party's medical practice, including minors where applicable.

• Identifying information: name, identity number, date of birth, gender, contact details
• Special personal information: health records, diagnoses, medications, treatment notes, lab results, imaging reports, and other clinical data (POPIA s26)
• Administrative records: consent forms, referral letters, correspondence, and appointment records

This DPA commences on the date the Responsible Party creates a Medifile account and continues until the termination of the Terms of Service and deletion of all Patient Data.

The Operator will process Patient Data only on documented instructions from the Responsible Party (including as set out in the Terms of Service and this DPA) and not for any other purpose. If required by law to process for another purpose, it will inform the Responsible Party to the extent permitted by law.

The Operator will ensure that all personnel authorised to process Patient Data are bound by appropriate confidentiality obligations and are aware of the sensitivity of health data. Access is limited to personnel who require it to perform their functions in delivering the Platform.

• 256-bit AES encryption of Patient Data at rest
• TLS 1.2+ encryption of Patient Data in transit
• Strict role-based access controls isolating each Practice's data from all others
• Multi-factor authentication for Platform access
• Immutable audit logging of all data access, modifications, and deletions
• Regular security testing and vulnerability assessments
• Access control policies limiting Medifile staff access to the minimum necessary for support
• Incident response procedures for Security Incidents

The Operator may engage sub-processors (Schedule 1). The Operator:

• Will enter into data processing agreements with all sub-processors on terms no less protective than this DPA
• Remains liable to the Responsible Party for the acts and omissions of sub-processors
• Will notify the Responsible Party of any intended changes to the sub-processor list at least 14 days before the change takes effect
• Will give the Responsible Party an opportunity to object to new sub-processors on reasonable grounds

Medifile staff may access Patient Data only to the extent necessary to investigate and resolve technical support issues raised by the Responsible Party, or to maintain and improve the security and integrity of the Platform. All such access is logged in the immutable audit trail.

The Operator will assist the Responsible Party in responding to data subject rights requests under POPIA by providing the tools available in the Platform. Additional assistance may be requested at hello@medifile.co.za.

• Demonstrate compliance with its POPIA obligations as Responsible Party
• Comply with data impact assessment requirements if applicable
• Conduct audits of the Operator's processing activities (subject to reasonable advance notice and confidentiality protections)

If the Operator becomes aware of a Security Incident affecting Patient Data, it will:

• Notify the Responsible Party without undue delay and in any event within 72 hours of becoming aware
• Provide available detail: nature of the incident; categories and approximate number of data subjects and records affected; likely consequences; measures taken or proposed
• Cooperate with the Responsible Party in investigating and remediating the incident
• Not make any public disclosure without the Responsible Party's prior consent, except where required by law

The Responsible Party retains sole responsibility for notifying the Information Regulator and affected data subjects as required by POPIA section 22.

• The Operator will delete all Patient Data within 30 days, unless a longer retention period is required by law
• The Operator will provide written confirmation of deletion on request
• The Responsible Party may request a data export in the 30 days before deletion
• Anonymised, aggregated data that cannot be re-identified is not subject to deletion obligations

The Operator will not:

• Use Patient Data to train AI or machine learning models without the explicit written consent of the Responsible Party
• Sell, licence, or otherwise commercialise Patient Data
• Process Patient Data for the Operator's own marketing or research purposes
• Combine Patient Data with data from other practices for any purpose other than platform-wide security and fraud prevention

In the event of conflict between this DPA and the Terms of Service on data-processing matters, this DPA shall prevail.

This DPA is governed by the laws of the Republic of South Africa, including POPIA.

By creating a Medifile account and accepting the Terms of Service at sign-up, the Responsible Party is deemed to have accepted this DPA. The acceptance is recorded with a timestamp in the Platform's audit log. No physical signature is required.

Medifile may update this DPA to reflect changes in law or practice. Material changes will be communicated by email at least 14 days before taking effect. The Responsible Party may object by terminating their account before the effective date.