Privacy Policy

Dr. Chomba & Associates, Inc (trading as iScript)
Effective Date: 1 January 2026 · Version 2.0
POPIA Compliant · HPCSA Compliant · Health Professions Act Compliant

1. Introduction

Dr. Chomba & Associates, Inc (trading as iScript, "we", "us", "our") is committed to protecting your personal information. This Privacy Policy explains how we collect, use, store, and disclose your information in compliance with the Protection of Personal Information Act 4 of 2013 (POPIA), the Health Professions Act 56 of 1974, the Medicines and Related Substances Act 101 of 1965, and the HPCSA Guidelines for Telemedicine (Booklet 10). This policy applies to all users of the iScript platform (website, mobile application, and related services). By using our services, you consent to the collection and use of your information as described in this policy.

2. Information We Collect

We collect the following categories of personal information: Identity Information: Full name, date of birth, gender, South African ID number, profile photograph. Contact Information: Email address, mobile number, physical address. Health Information (Special Personal Information under POPIA): Medical history, current medications, allergies, chronic conditions, symptoms, consultation notes, diagnoses, prescriptions, and laboratory results. Financial Information: Payment card details (processed and tokenised by PayFast — not stored by iScript), medical aid name, membership number, and plan details. Technical Information: IP address, browser type, device identifiers, usage logs, and session data. Communication Records: Records of consultations, chat messages, emails, and support interactions.

3. Lawful Basis for Processing

Under POPIA, we process your personal information on the following bases: Consent: You provide explicit consent during registration and at each consultation for processing of your health information. Contract: Processing necessary to fulfil the teleconsultation service agreement. Legal Obligation: Processing required to comply with South African health law, including reporting obligations under the National Health Act. Legitimate Interests: Platform security, fraud prevention, and service improvement — where not overridden by your rights. Health Treatment: Processing by healthcare professionals for the purpose of providing medical treatment, as permitted under POPIA Section 32.

4. Use of Your Information

We use your information to: • Provide telehealth consultation services • Generate e-prescriptions and transmit to pharmacies • Submit medical aid claims on your behalf • Communicate appointment reminders and health-related notifications • Generate AI-assisted clinical assessments and reports (anonymised for AI processing) • Comply with legal and regulatory reporting obligations • Investigate complaints and resolve disputes • Improve platform security and service quality We do NOT use your health information for advertising, profiling for commercial purposes, or sale to third parties.

5. Sharing of Your Information

Your information may be shared with: Healthcare Providers: HPCSA-registered doctors contracted to iScript who provide your consultations. Partner Pharmacies: Dispensing pharmacies to fulfil your prescriptions, with your consent. Medical Aid Schemes: For claims submission, subject to your scheme's membership agreement. Laboratory Services (Ampath/Lancet): For test requests, with your consent. Velobiotics: For nutraceutical recommendations made by your doctor, where you have consented. Payment Processors (PayFast): For secure payment processing — your card data is processed by PayFast and not stored by iScript. Legal Authorities: Where required by law, court order, or to protect the safety of individuals. We require all third parties to process your data lawfully, fairly, and in accordance with POPIA.

6. AI Processing of Health Data

iScript uses artificial intelligence to analyse patient assessment data and generate clinical reports to assist our doctors. AI processing of health data is: • Conducted within secure, South Africa-based infrastructure • Used only for the purpose of improving clinical decision support • Reviewed and validated by a qualified HPCSA-registered doctor before any clinical action is taken • Not used to make autonomous medical decisions The AI never acts independently — all clinical decisions remain with the attending doctor. Data used for AI training is anonymised and aggregated in accordance with POPIA requirements.

7. Data Retention

We retain patient health records for a minimum of 6 years from the date of last consultation, as required by the National Health Act and HPCSA Guidelines. Financial records are retained for 5 years in accordance with the Tax Administration Act. You may request deletion of non-health data (contact, marketing preferences) at any time. Health records cannot be deleted before the legally required retention period expires.

8. Your Rights Under POPIA

You have the right to: • Access your personal information held by iScript • Request correction of inaccurate information • Request deletion of your data (subject to retention obligations) • Object to processing of your data • Lodge a complaint with the Information Regulator To exercise these rights, contact our Information Officer at practice@iscript.co.za or 011 392 6199. The Information Regulator (South Africa): complaints.IR@justice.gov.za | www.justice.gov.za/inforeg

9. Security Measures

We implement industry-standard security measures including: • 256-bit TLS encryption for all data in transit • AES-256 encryption for data at rest • Multi-factor authentication for all healthcare provider accounts • Regular security audits and penetration testing • Role-based access controls limiting data access to authorised personnel only • Audit logs for all access to patient health records In the event of a data breach affecting your personal information, we will notify you and the Information Regulator within the required timeframes in accordance with POPIA Section 22.

10. Cookies & Tracking

iScript uses essential cookies necessary for platform functionality. We do not use third-party advertising cookies. Analytics cookies (anonymised) help us improve the platform. You can manage cookie preferences in your browser settings.

11. Children

iScript does not knowingly collect personal information from children under 18 without parental consent. If your child requires medical care via iScript, a parent or legal guardian must register on their behalf and provide consent for processing of the child's health information. The parent/guardian accepts this Privacy Policy on the child's behalf.

12. Changes to This Policy

We may update this Privacy Policy from time to time. Material changes will be communicated to you via email and in-app notification at least 14 days before taking effect. The "Effective Date" at the top of this policy will be updated accordingly.

13. Contact Our Information Officer

For privacy-related queries, requests, or complaints: Dr. Chomba Chuma (Information Officer) Dr. Chomba & Associates, Inc (trading as iScript) 10 Kruin Street, Klopperpark, Germiston, 1406 practice@iscript.co.za | 011 392 6199