PsyCareAi Privacy Policy

1. Purpose of this policy

This Privacy Policy explains how PsyCareAi processes personal information when clinicians, practice staff and other authorised users access the PsyCareAi website, app and clinical practice platform. It must be read together with the Clinician Terms and Conditions of Use.

2. Our role and the clinician's role

For information relating to a clinician's own account, subscription, contact details, support requests and use of the PsyCareAi service, PsyCareAi acts as a responsible party for purposes of the Protection of Personal Information Act 4 of 2013 (POPIA).

For patient or client information entered into PsyCareAi by a clinician or practice, the clinician or practice ordinarily determines the purpose and means of the clinical processing and remains responsible for obtaining appropriate authority or consent and complying with professional record-keeping obligations. PsyCareAi processes that information in order to provide the platform and associated services.

3. Information we process

Depending on the services used, PsyCareAi may process clinician and practice information such as names, contact details, professional registration details, practice information, account identifiers, subscription information and support correspondence.

The platform may also process patient or client information entered by authorised clinicians, including identifying details, contact information, appointments, clinical notes, mental status examination information, diagnoses or coding, documents, invoices and other information required for lawful clinical practice.

Health information is sensitive personal information and must only be entered into PsyCareAi where the clinician or practice has a lawful basis to process it.

4. Why we process information

We process information to provide account registration and authentication, practice management, client record management, appointments, clinical documentation, billing, document creation, secure storage, support, security monitoring, platform administration and other services made available through PsyCareAi.

We may also process limited technical information required for security, fraud prevention, service reliability, auditing, error diagnosis and compliance with legal obligations.

5. AI-assisted features

Where AI-assisted tools are made available, their purpose is to assist qualified clinicians with tasks such as drafting, summarising, organising information or reflecting on clinical material. AI output remains a draft and does not replace professional judgement. Clinicians must review and approve information before it is relied upon as part of a clinical record or decision.

PsyCareAi does not treat AI-generated suggestions as independently verified clinical facts. Features that require additional consent, provider agreements or privacy controls may remain unavailable until those controls are implemented.

6. Lawful processing and professional responsibility

Clinicians and practices are responsible for ensuring that information entered into PsyCareAi is processed lawfully and in accordance with POPIA, the National Health Act, applicable professional rules and other relevant South African law.

Where patient consent is required, the clinician or practice must obtain that consent before using PsyCareAi to process the relevant information.

7. Where information is processed

PsyCareAi uses specialist technology service providers to operate the platform. At present, Supabase provides database and authentication infrastructure for the platform and the active PsyCareAi Supabase project is hosted in the European Union. Vercel provides application hosting and deployment infrastructure and production application processing may take place outside South Africa, including in the United States.

Accordingly, some personal information may be transferred or processed outside the Republic of South Africa. PsyCareAi will only use cross-border processing arrangements that are intended to satisfy the safeguards required by section 72 of POPIA, including appropriate contractual, organisational and technical protections where applicable.

8. Service providers and operators

PsyCareAi may use trusted service providers and operators for hosting, authentication, database services, deployment, email delivery, billing infrastructure, technical support and similar functions required to operate the service. Such providers are given access only to the information reasonably required to perform the relevant service and remain subject to applicable contractual and security obligations.

9. Security

PsyCareAi uses technical and organisational safeguards designed to protect personal information against unauthorised access, loss, misuse, alteration or disclosure. These include authenticated access, role-based database controls, row-level security, encrypted connections, restricted production configuration and security monitoring.

No electronic system can guarantee absolute security. Users must protect their login credentials, use appropriate device security and notify PsyCareAi promptly if they suspect unauthorised access or a security compromise.

10. Access controls

Clinical and practice information is intended to be accessible only to authenticated and authorised users associated with the relevant practice and role. Users must not share login credentials or permit unauthorised access to patient information.

11. Retention

Clinical records must be retained for the periods required by applicable healthcare and professional rules. PsyCareAi will not intentionally delete active clinical information in a manner that prevents a practice from meeting its lawful record-retention obligations.

Account, support, billing and technical records may be retained for so long as reasonably necessary for the purposes for which they were collected, legal obligations, dispute resolution, security and legitimate operational requirements.

12. Your rights

Subject to POPIA and other applicable law, data subjects may request access to personal information held about them, request correction of inaccurate information, request deletion where legally appropriate, object to certain processing, or raise a complaint about the processing of their personal information.

Requests relating to patient clinical records should ordinarily be directed first to the treating clinician or responsible practice because that clinician or practice is responsible for the clinical record and determines whether disclosure, correction or retention is permitted by law and professional rules.

13. Security compromises

If PsyCareAi becomes aware of a security compromise affecting personal information, it will take reasonable steps to contain and investigate the incident and will comply with applicable notification obligations under POPIA. Where PsyCareAi is acting as an operator for a clinician or practice, PsyCareAi will notify the responsible party so that appropriate regulatory and data-subject notifications can be made.

14. Cookies and technical information

PsyCareAi may use cookies and similar technologies required for authentication, session management, security, user preferences and essential website functionality. Disabling essential cookies may prevent parts of the service from functioning correctly.

Technical information such as IP address, browser information, device information and security logs may be processed where necessary to operate, secure and troubleshoot the platform.

15. Children and vulnerable data subjects

PsyCareAi is intended for use by authorised healthcare professionals and practice personnel. Where clinicians process information about children or other vulnerable data subjects, they remain responsible for ensuring that the processing is lawful and that any required consent, authority or other safeguards are in place.

16. Changes to this policy

We may update this Privacy Policy when our services, providers, processing activities or legal obligations change. The current version and effective date will be published on the PsyCareAi website. Material changes may also be communicated to registered users.

17. Contact PsyCareAi

Privacy, security and data-subject enquiries may be directed to:

Email: admin@psycareai.com
Telephone: 084 786 4794
Address: 63 Howick Road, Townhill, Pietermaritzburg, 3201, South Africa

18. Information Regulator

A data subject who is not satisfied with the handling of a privacy matter may lodge a complaint with the Information Regulator (South Africa). Current contact information is available from the Information Regulator at inforegulator.org.za.

Clinical responsibility: PsyCareAi is a software platform and does not replace the treating practitioner's legal, ethical or professional responsibility for patient care, consent, record keeping, confidentiality or clinical decision-making.