Legal Notice

1. Protection of Personal Information Act (POPIA - South Africa)

All personal information is collected and processed lawfully and responsibly under the Protection of Personal Information Act, 2013 (Act No. 4 of 2013).

Our processing activities ensure that:

• Information is collected directly from the data subject unless otherwise permitted by law.
• Data is used only for legitimate healthcare, billing, and administrative purposes.
• Reasonable security measures are in place to protect data from loss, damage, or unauthorised access.
• Patients may access, correct, or request deletion of their personal information at any time.

2. General Data Protection Regulation (GDPR - Article 6(1)(b))

Where applicable, data is also processed under GDPR Article 6(1)(b), which permits processing necessary for:

• The performance of a contract between you and MedKulula, such as subscription management or service delivery.
• Steps taken at your request prior to entering into such a contract, for example when you inquire or register online.

3. Healthcare Compliance

As a medical service provider, Dr Mukudu & Partners processes patient data in compliance with healthcare and ethical frameworks, including:

• Health Professions Council of South Africa (HPCSA) guidelines on patient confidentiality and record retention.
• National Health Act (Act No. 61 of 2003) requirements for the protection and lawful use of medical records.
• Medical Schemes Act where information is shared with schemes for billing or benefits administration.

4. Legitimate Interests and Consent

We may process personal data under legitimate interests, such as improving our healthcare systems or responding to patient inquiries, provided this does not override your privacy rights.

Where explicit consent is required, for example for newsletters or electronic communication, it is obtained separately and may be withdrawn at any time.

5. Cross-Border Data Protection

All personal data processed through TeledoctorSA or MedKulula's digital systems is stored on secure servers in South Africa.

If limited cross-border transfer occurs, for example during data backup or system support, it is conducted under conditions that ensure an equivalent level of protection as required by POPIA and GDPR.