Terms of Service

The Platform provides digital storage, organisation, and management tools for patient health records. Depending on the Subscription selected, the Platform may include:

• Secure digital file storage and patient folders
• Full-text OCR search across uploaded documents
• POPIA compliance tools including consent logs, audit trails, and breach management
• Specialist referral packet creation and delivery (Complete System only)
• Clinical notes, appointment scheduling, and AI-generated summaries (Complete System only)
• Patient portal and messaging (Complete System only)
• Physical document scanning and digitisation (add-on service, Gauteng only)

The Platform is a record management and workflow tool, not a clinical decision-support system. Nothing on the Platform constitutes medical advice, a clinical guideline, or a recommendation regarding patient care. AI-generated summaries are assistive tools only and do not replace clinical judgement.

Medifile does not provide medical aid claims submission or integration with medical aid schemes. Invoices generated on the Platform are for the Practice's own use and are not submitted to medical schemes by Medifile.

We aim to maintain platform availability of 99.5% monthly, excluding scheduled maintenance windows. We do not guarantee uninterrupted access and are not liable for losses arising from downtime beyond our reasonable control.

The Platform is available to registered health professionals and their practices operating in South Africa. By registering, you represent that:

• You are a registered health professional in good standing with the HPCSA or relevant statutory body, or are acting under the supervision of such a professional
• You have the legal authority to enter into these Terms on behalf of the Practice
• All information provided at registration is accurate and complete

You are responsible for maintaining the confidentiality of login credentials and for all activity that occurs under your account. You must:

• Use a strong, unique password for each user account
• Enable multi-factor authentication when prompted
• Notify us immediately at hello@medifile.co.za if you suspect unauthorised access
• Not share credentials between Users — each User must have their own account

The Practice Owner may invite additional Users with designated roles (Doctor, Nurse, Receptionist, Assistant). Each User is bound by these Terms. The Practice Owner is responsible for the conduct of all Users within the Practice account and must remove access promptly when a User leaves the Practice.

Medifile offers two product types — Records Storage and Complete System — available in monthly or annual billing cycles. Current pricing is published at medifile.co.za/pricing. Annual subscribers receive two months free relative to the equivalent monthly rate.

New accounts receive a 14-day free trial of the selected plan. No credit card is required to start a trial. At the end of the trial period, the account will convert to the paid plan selected or access will be restricted until a plan is confirmed.

Payment is processed via PayFast. By subscribing, you authorise Medifile to charge the applicable fee at the start of each billing cycle. All amounts are in South African Rand and exclude VAT (where applicable). Medifile is not currently VAT-registered.

If a payment fails, we will notify you and retry. If payment is not received within 7 days of the due date, access to the Platform may be suspended. Data is retained for 30 days after suspension, after which the account may be deactivated.

You may cancel your subscription at any time through the Practice Settings. Cancellation takes effect at the end of the current billing period. We do not provide pro-rata refunds for unused portions of a subscription period. Annual subscribers who cancel mid-year will retain access until the anniversary date.

You may upgrade or downgrade your plan at any time. Upgrades take effect immediately. Downgrades take effect at the start of the next billing cycle. If a downgrade would cause your usage to exceed the new plan limit, upload functionality will be restricted until usage is reduced or the plan is restored.

You may use the Platform solely for legitimate medical practice management purposes, including storing, organising, and sharing patient health records in connection with the delivery of healthcare services.

You must not:

1. Upload or store content that is unlawful, fraudulent, or misrepresents the identity or qualifications of any person
2. Use the Platform to process data of individuals who have not been patients of your Practice
3. Attempt to circumvent access controls, reverse-engineer the Platform, or gain unauthorised access to other practices' data
4. Use automated tools to scrape, extract, or bulk-download data from the Platform without our prior written consent
5. Resell, sublicense, or otherwise commercialise access to the Platform
6. Use the Platform in a manner that violates POPIA, the National Health Act, or any applicable professional rules of the HPCSA
7. Interfere with the security or integrity of the Platform or its underlying infrastructure

Under POPIA, the Practice is the Responsible Party in respect of all Patient Data processed through the Platform. This means the Practice determines the purpose and means of processing and bears primary legal responsibility for compliance with POPIA. Medifile acts as Operator on your behalf.

Medifile processes Patient Data strictly on your instructions and for the purpose of providing the Platform. We do not use Patient Data for any purpose other than delivering and improving the services described in these Terms. A dedicated Data Processing Agreement (DPA) governing this relationship is available at medifile.co.za/dpa and is incorporated into these Terms by reference.

By using the Platform, you confirm that:

• You have a lawful basis to collect and process the Patient Data you upload
• You have obtained the necessary consent from patients where required
• You have notified patients of your use of third-party processors including Medifile
• You have appointed a POPIA Information Officer and registered with the Information Regulator where required
• You will respond to patient access, deletion, and objection requests using the compliance tools in the Platform

Health records must be retained for a minimum of 6 years from the date of last entry, or 6 years after a minor patient turns 18, in accordance with HPCSA guidelines. The Platform's retention tools assist you in tracking and managing retention periods. The Practice remains responsible for determining the applicable retention period for each record and for ensuring records are not deleted prematurely.

If Medifile becomes aware of a security incident affecting Patient Data, we will notify you within 72 hours of becoming aware, providing sufficient information for you to comply with your obligation to notify the Information Regulator and affected data subjects under POPIA section 22.

The Platform, including all software, designs, trademarks, and content created by Medifile, is and remains the intellectual property of Medifile. These Terms do not grant you any rights in or to the Platform other than the limited right to use it as described herein.

All Patient Data and other content uploaded by the Practice remains the property of the Practice. You grant Medifile a limited, non-exclusive licence to store, process, and display your data solely for the purpose of providing the Platform. We do not claim ownership of your data.

If you provide suggestions or feedback about the Platform, you grant Medifile a royalty-free, worldwide licence to use that feedback without restriction or obligation to you.

The Platform is provided “as is” and “as available”. Medifile makes no warranties, express or implied, regarding fitness for a particular purpose, accuracy of AI-generated content, or continuous availability.

To the maximum extent permitted by law, Medifile's total aggregate liability to the Practice under or in connection with these Terms — whether in contract, delict, or otherwise — shall not exceed the total Subscription fees paid by the Practice in the 12 months immediately preceding the event giving rise to the claim.

Medifile shall not be liable for indirect, consequential, incidental, or punitive losses including loss of profits, loss of data (other than as caused by Medifile's gross negligence), or loss of business opportunity, whether or not Medifile was advised of the possibility of such losses.

Medifile is not liable for any clinical decisions made by health professionals using the Platform, including decisions based on AI-generated summaries or records stored on the Platform.

These Terms commence when you create an account and continue until terminated.

You may terminate your account at any time by cancelling your Subscription and requesting account deletion at hello@medifile.co.za. We will process account deletion within 30 days of receiving your request.

We may suspend or terminate your account immediately if you breach these Terms, fail to pay amounts due, or use the Platform in a manner that poses a risk to other users or to the Platform's integrity. We will give reasonable notice where practical.

On termination, your right to access the Platform ceases. We will retain your data for 30 days after the termination date, during which you may request an export. After 30 days, your data will be permanently deleted unless a longer retention period is required by law.

These Terms are governed by the laws of the Republic of South Africa. Any dispute arising under these Terms shall be subject to the non-exclusive jurisdiction of the High Court of South Africa (Gauteng Division, Pretoria).

We may update these Terms from time to time. Material changes will be communicated by email to the Practice Owner at least 14 days before taking effect. Continued use of the Platform after the effective date constitutes acceptance of the updated Terms.

If any provision of these Terms is found to be unenforceable, it shall be modified to the minimum extent necessary to make it enforceable, and the remaining provisions shall continue in full force.

These Terms, together with the Privacy Policy and Data Processing Agreement, constitute the entire agreement between the parties in respect of the Platform and supersede all prior representations and agreements.