01Scope & who this covers
This policy explains how MS Nova Meditech (Pty) Ltd (registration 2026/506439/07), trading as VaxTrack SA ("VaxTrack", "we", "us"), handles personal information across the VaxTrack SA platform, including the web application, the appointment booking pages, WhatsApp reminder links, and the public certificate verification page.
Two distinct groups of people are covered by this policy, and their information is treated differently:
- Practice accounts. The healthcare providers, vaccinators, and practice owners who register for VaxTrack SA and use it to manage their patients ("Customers", "you", "practices").
- Patients. The individuals whose vaccination and appointment records a practice keeps inside VaxTrack SA ("patients", "data subjects"). Patients do not hold their own VaxTrack account — their data is entered, viewed, and managed by the practice that treats them, except where a patient uses a booking link or certificate link issued to them directly.
02Our role under POPIA
This distinction matters because it determines who is legally accountable for what, under the Protection of Personal Information Act 4 of 2013 (POPIA).
| Data | Our role | Who is accountable |
|---|---|---|
| Practice account & billing data (your name, email, organisation, SANC/HPCSA/SAPC number, payment history) | Responsible Party | VaxTrack SA determines why and how this data is processed, in line with this policy. |
| Patient data entered by a practice (names, DOB, ID numbers, contact details, vaccination history, appointment bookings, consent records) | Operator | The practice is the Responsible Party. VaxTrack SA processes this data only on the practice's instructions, as their record-keeping system. |
03Information we collect
3.1 Practice & user account information
- Full name, email address, mobile number, and password (stored as a salted hash, never in plain text)
- Organisation name, practice site(s), and province
- SANC, HPCSA, or SAPC registration number, as applicable to your profession (stored encrypted). We validate the format of this number only — we do not query SANC, HPCSA, or SAPC to confirm active registration status
- Role within the organisation (owner, vaccinator, superadmin)
- Subscription plan, seat count, and billing history
3.2 Patient information (processed on behalf of practices)
- Identity details: full name, date of birth, ID or passport number, patient type (infant/child, adult, maternal)
- Contact details: phone number, WhatsApp number, email address
- Medical aid scheme and membership number, where provided
- Guardian or parent details, for minors
- Allergy information, entered as free text by the vaccinator
- Vaccination records: vaccine given, batch number, expiry date, dose number, route, injection site, and any observed reactions
- Consent records captured at each visit
- Appointment bookings made through the online booking page, and the corresponding booking link credential
All fields listed above with an identity or contact nature are stored using AES-256-GCM field-level encryption. See Section 9 for detail.
3.3 Images processed for extraction, not retained
- Photographs or scans of paper Road to Health Booklets, submitted by a vaccinator to digitise a patient's historical vaccination record
- Photographs or PDF uploads of stock invoices, submitted to extract batch and quantity details into stock records
3.4 Payment information
Subscription payments are processed by Netcash, a licensed South African payment service provider. VaxTrack SA does not receive or store your full card number. We hold only the transaction outcome (paid, unpaid, disputed, refunded), the amount, and Netcash's own reference for that transaction.
3.5 Technical & usage data
- Login timestamps, IP address, and device/browser information, for security and rate-limiting purposes
- Audit trail of significant actions taken in the system (who did what, when) — see Section 9
04How we use information
- To provide the core service: recording, retrieving, and organising vaccination records against the EPI-SA schedule and private vaccine programmes
- To generate vaccination certificates and enable their verification via a signed QR link
- To operate the online appointment booking system, including issuing and validating per-patient booking links
- To prepare WhatsApp reminder messages that a vaccinator chooses to send manually — VaxTrack SA does not send automated messages to patients on its own initiative
- To manage stock, cold chain, and billing/export functions within a practice
- To process subscription payments and manage trial, grace, and suspension states
- To maintain security, detect abuse, and keep an audit trail of significant actions
- To communicate with practice account holders about their account, billing, and material service changes
We do not use patient information for marketing, do not sell personal information, and do not use patient data to train any AI model.
05AI-assisted processing
VaxTrack SA uses Anthropic's Claude models for two narrow, human-reviewed extraction tasks:
| Feature | What is sent | What happens after |
|---|---|---|
| Paper booklet take-on | A photo of a patient's paper vaccination booklet page | Extracted rows are shown on a mandatory review screen. Nothing saves until the vaccinator confirms each row. The photo is discarded once extraction completes. |
| Stock invoice scanning | A photo or PDF of a supplier invoice | Extracted line items are shown on a review screen for confirmation before they are written to stock. The image is not retained. |
In both cases, the AI's output is a draft that a human at the practice must review and can freely correct before it is saved — VaxTrack SA does not allow an AI extraction to reach a patient or stock record automatically. We do not use any conversational or "AI chat" feature that has open-ended access to a patient's full record.
06Barcode scanning & camera access
VaxTrack SA supports scanning the 2D DataMatrix barcode printed on a vaccine vial in two ways: using the device's own camera live, on-device, when recording a vaccination on a phone or tablet; or, from a desktop without a camera, via a short-lived remote scan session where a link (valid for 5 minutes) is opened on a phone to scan the barcode, with the result sent back to the desktop session automatically.
In both cases, only the decoded text from the barcode — batch number, expiry date, and manufacturer — is transmitted or stored. No photo, video, or image of the scan itself is uploaded to or retained on our servers. For a remote scan session, we temporarily store the scan token, its expiry time, the decoded result once submitted, and the IP address of the requesting device, solely to connect the desktop and phone sessions; this record is deleted as soon as the desktop retrieves the result, or expires automatically after 5 minutes if unused.
07Legal basis for processing
Under POPIA, we process personal information on one or more of the following grounds:
- Performance of a contract — processing needed to provide the VaxTrack SA service to a registered practice, and, for a patient, to deliver the vaccination record-keeping, booking, or certificate service requested by their healthcare provider
- Consent — where a patient or guardian gives specific consent, for example the consent flow captured at a vaccination visit
- Legal obligation — healthcare record-keeping obligations that apply to the practice
- Legitimate interest — for security, fraud prevention, and service-improvement purposes that do not override the rights of the data subject
09Cross-border transfers
Application and database hosting is based in South Africa. Where an image is sent to Anthropic for AI-assisted extraction (Section 5), that processing may occur on infrastructure located outside South Africa. This transfer is limited to the single image submitted for a specific extraction call, is not retained by the AI provider beyond that call, and is protected by Anthropic's contractual data-handling commitments. No other patient data field is routinely transferred outside South Africa in the ordinary operation of the service.
Google Tag Manager and the Meta Pixel, used only on our public marketing pages (Section 13), separately involve website interaction data being processed by Google LLC and Meta Platforms, Inc., both based in the United States. This is limited to general marketing-page analytics and advertising measurement from website visitors, and does not include any patient vaccination information, which never reaches these tools.
10Security measures
- Field-level encryption. Identity and contact fields (name, date of birth, ID number, phone, WhatsApp, email) are encrypted individually using AES-256-GCM, with a unique initialisation vector per value. The encryption key is stored outside the web-accessible file system and is never stored in the database or in version control.
- Access control. Every request is scoped to the requesting practice's organisation; cross-organisation access is not possible at the API layer. Authentication uses SHA-256-hashed bearer tokens with a limited expiry, and can be revoked.
- Booking & certificate links. Patient booking links use 32 bytes of cryptographically random data; only a SHA-256 hash of the token is stored, and links can be revoked instantly by the practice. Certificates are signed with HMAC-SHA256, so any tampering invalidates them.
- Audit trail. Significant actions — record changes, bookings, cancellations, link issuance and revocation — are written to an immutable audit log.
- Input handling. All database queries use parameterised statements; free-text input is sanitised before storage or display.
No system can guarantee absolute security. If we become aware of a security incident affecting personal information, we will notify affected practices and, where required by POPIA, the Information Regulator, without undue delay.
11Retention
- Patient vaccination records are retained for as long as the practice's account remains active, and are not deleted if a subscription lapses, enters grace, or is suspended — access resumes immediately on reinstatement.
- Cancelled appointments are retained rather than deleted, consistent with the platform's general retention posture.
- Booklet and invoice images are never retained — see Section 3.3.
- Booking links expire after one year by default and can be revoked earlier by the practice.
- Vaccination certificates remain valid, and verifiable via QR code, for one year from issue.
- Where a practice permanently closes its account and requests deletion, we will delete or de-identify patient data within a reasonable period, except where retention is required by law.
12Your rights
Subject to POPIA, you (or, for a patient, the practice acting on their behalf, or the patient directly where they hold a valid access mechanism such as a certificate or booking link) have the right to:
- Request confirmation of what personal information we hold and access to it
- Request correction or updating of inaccurate, outdated, or incomplete information
- Request deletion or de-identification of personal information, subject to legal record-keeping requirements
- Object to processing carried out on the basis of legitimate interest
- Withdraw consent, where processing is based on consent, without affecting processing already carried out
- Lodge a complaint with the Information Regulator (South Africa) if you believe your rights under POPIA have been infringed
Because most patient data is held by us as an Operator on a practice's instruction, a patient request relating to their own vaccination record should generally be directed to the treating practice first. We will support the practice in fulfilling that request.
13Minors & guardian consent
A significant share of records on VaxTrack SA relate to infants and children on the EPI-SA schedule. Where the patient is a minor, the vaccination consent flow is directed to, and completed by, the parent or legal guardian at the point of care. VaxTrack SA does not independently market to, or collect information directly from, a minor.
15Changes to this policy
We may update this policy as the platform evolves — for example, as new features such as appointment booking or paper take-on are added. Material changes will be communicated to practice account holders. The effective date at the top of this page reflects the most recent revision.
16Contact & Information Officer
| Legal entity | MS Nova Meditech (Pty) Ltd, registration 2026/506439/07 |
| Trading as | VaxTrack South Africa |
| Registered address | 21 Van Bruggen Str, La Hoff, Klerksdorp |
| Information Officer | Mandi Smit — webmaster@vaxtrack.co.za |
| General & privacy enquiries | webmaster@vaxtrack.co.za |
| Product | vaxtrack.co.za |