PAIA / POPIA Manual

Med88 POPIA Data-Handling Policy

Q88Link (Pty) Ltd, trading as Med88

1. Purpose

This policy sets out how Med88 staff and contractors must handle Personal Information — including patient health information — collected through the Med88 patient onboarding platform, in compliance with the Protection of Personal Information Act 4 of 2013 (POPIA). It supplements, and must be read with, the Q88Link (Pty) Ltd PAIA/POPIA Manual.

2. Why This Matters More for Med88

• Patient information disclosed during onboarding is "special personal information" (health data) under section 26 of POPIA — it carries stricter processing conditions than ordinary personal information.
• Med88 typically acts as an Operator on behalf of each participating medical practice (the Responsible Party for that practice's patients), which brings specific contractual and security obligations under section 21 of POPIA.
• A breach involving health data carries higher reputational, regulatory and patient-trust risk than an ordinary data breach.

3. Roles: Operator vs Responsible Party

In most cases, the participating medical practice is the Responsible Party — it determines why patient data is collected. Med88 (Q88Link) acts as the Operator, processing that data only on the practice's instruction and for the purpose of providing the onboarding service.

This has practical consequences:

• Med88 must have a written Operator Agreement with every practice, per section 21 of POPIA, before onboarding any patient data.
• Med88 may not use practice or patient data for its own separate purposes, such as marketing, without explicit written instruction or separate consent.
• If Med88 also markets directly to patients or practitioners using platform data, that specific use requires its own lawful basis and must be assessed separately.

4. Lawful Processing Conditions (Sections 9–12 of POPIA)

• Process only the minimum patient information needed for onboarding, appointment administration and billing — no excessive fields.
• Collect information directly from the patient or the practice wherever possible, not from unrelated third parties.
• Give patients clear notice on the onboarding form or app of what is collected, why it is collected and their rights.
• Do not retain patient records for longer than the purpose requires, or as required by the applicable practice's record-keeping obligations. Retention is set by the practice, not Med88.

5. Special Personal Information (Health Data) — Sections 26–27

Processing of health information is generally prohibited unless an exception applies. The relevant exceptions for Med88 are typically:

• the patient has given explicit consent to the processing, captured at onboarding; or
• processing is necessary for the proper treatment and care of the patient, or for the administration of the practice providing that care.

Practical requirement: The onboarding flow must capture explicit, informed consent through a checkbox that is not preselected before any health information is collected or stored.

6. Security Safeguards (Section 19)

6.1 Technical controls

• Encryption of patient data at rest and in transit, including TLS for data in transit and encrypted database or storage at rest.
• Role-based access control so practice staff can only see their own practice's patients; Med88 staff access is logged and limited to what support requires.
• Multi-factor authentication for Med88 staff or administrator accounts with access to production patient data.
• Regular, at least annual, penetration testing or vulnerability assessment of the platform.
• Automated backups, tested restore procedures and a documented disaster-recovery plan.

6.2 Organisational controls

• Signed confidentiality undertakings for staff and contractors with data access.
• A documented access log recording who accessed a patient's record, when and why.
• Data Processing or Operator Agreements signed with every practice before go-live, and with every sub-processor before use.
• A named Information Officer and Deputy registered with the Information Regulator.

7. Data Breach Response

Section 22 of POPIA requires notification as soon as reasonably possible after a breach is discovered. Med88's process is:

1. Contain: Isolate the affected system or account immediately on discovery.
2. Assess: Determine what data and how many data subjects are affected.
3. Notify: Notify the Information Regulator, affected data subjects and the relevant practice as Responsible Party without undue delay, in writing, including the likely consequences and steps taken or recommended.
4. Record: Log the breach, response actions and outcome for the Information Officer's records, even where notification thresholds are not met.

8. Cross-Border and Cloud Hosting

Where infrastructure is hosted outside South Africa, this constitutes a transborder flow of personal information under section 72 of POPIA. Med88 must confirm and document:

• Hosting provider and data region: Google Cloud, europe-west1 (Belgium).
• Whether the provider is bound by an adequate law, binding corporate rules or a binding agreement providing equivalent protection to POPIA.
• A signed Data Processing Addendum with the hosting provider or sub-processor covering security, breach notification and deletion on termination.

9. Data Subject Rights — Operational Checklist

Because Med88 is typically the Operator, most patient rights requests should be directed to the practice as Responsible Party. Med88 must still be able to support this operationally:

• Ability to export or delete a single patient's data on the practice's instruction within a reasonable timeframe.
• A documented process for forwarding a request received directly from a patient to the relevant practice and informing the patient this has been done.
• A correction and update mechanism so practice staff can amend inaccurate patient information.

10. Compliance Checklist

• PAIA/POPIA Manual finalised and published on the Med88 website.
• Information Officer and Deputy Information Officer named and registered with the Information Regulator.
• Operator Agreement template drafted and signed with each onboarded practice.
• Onboarding flow includes an explicit, informed consent step for health information.
• Privacy notice or POPIA notice visible to patients at the point of data collection.
• Encryption at rest and in transit confirmed with the hosting provider.
• Role-based access control implemented and tested.
• Data Processing Addendum signed with cloud hosting providers and sub-processors.
• Breach-response plan documented and responsible contacts assigned.
• Data-retention and deletion schedule agreed with practices.
• Legal and compliance review completed by a qualified attorney or POPIA compliance specialist.

11. Review

This policy must be reviewed at least annually and immediately after any material change to the platform, hosting arrangement or applicable law.

Prepared: 17 September 2026 — Owner: Q88Link (Pty) Ltd Information Officer