Privacy Notice

Under the Protection of Personal Information Act 4 of 2013 (POPIA) there are two distinct roles, and which one applies decides who you go to.

• Your practice is the responsible party. The dental or GP practice you are a patient of decides why your information is collected and what happens to it. It holds the clinical relationship and it answers for the record.
• CareSavi is an operator. We process information on the practice's documented instructions: which modules it has enabled, which automations it has switched on, which consent wording it uses. We do not decide the purposes of processing, we do not use patient information for our own ends, and we do not decide when a clinical record is destroyed.

Practically: if you are a patient, exercise your rights with your practice. It is the responsible party, and we act on its instruction. If you are a practice, CareSavi is the responsible party for your own account and billing information, and this notice applies to us directly.

CareSavi is operated by Dinnative Technologies (Pty) Ltd, a company registered in South Africa under registration number 2017/280514/07 (VAT 4640303303), with its registered address at 74 Montrose Avenue, Northgate, Randburg, 2162, South Africa and postal address 74 Montrose Avenue, Northgate, Randburg, 2162, South Africa.

No Deputy Information Officer has been designated (POPIA s56 requires deputies only where they are necessary), so the Information Officer handles every request personally.

Our PAIA manual, which sets out the records we hold and how to request them, is at /paia.

We process only the categories below. We do not buy personal information, and we do not enrich a patient record from outside sources.

POPIA and the 2026 Regulations on the processing of health information require a separate, identifiable ground for each purpose. A single “I accept the terms” tick is not enough for health data. Each practice therefore keeps a processing register, and the rows below are the ones CareSavi ships with.

An honest note on two of these. Appointment reminders rest on the arrangement your booking creates rather than on consent, because nothing asks you for consent to a reminder and inferring it from the act of booking would be wrong. Strictly, that basis carries no statutory objection right, but we honour STOP for reminders anyway, and say so in the messages themselves.

Health information is special personal information. POPIA s26 prohibits processing it at all unless a s27 ground applies, and the Regulations relating to the Processing of Data Subjects' Health Information (Gazette 54268, in force 6 March 2026) add further requirements. The consequences you can see in the product:

• Health information is encrypted before it is stored, not merely stored on an encrypted disk.
• Every read and write is audited to an append-only log naming who did it and when. That log is what lets a practice tell you who has seen your record.
• Health information is never written to system logs, error reports or analytics. Only opaque identifiers are.
• Consent for health processing is explicit, purpose-specific and timestamped, and recorded with the exact wording version you were shown.

CareSavi's databases, caches, file storage and application servers run in Oracle Cloud Infrastructure's af-johannesburg-1 region, in South Africa. That is the residency anchor for the whole system: patient records, clinical notes, uploaded documents, message history and the search index that powers the AI assistant all sit there.

Practice knowledge used for AI search is, by default, converted into a numeric index by a model that runs inside our own South African infrastructure, so that step involves no third party and no transfer at all.

The exceptions are the transfers in §7 and §8, which are exactly the ones a WhatsApp, payment or AI feature cannot avoid.

These are the third parties that may process information on our behalf, what they touch, and where. We keep this list current; the register behind it is also stored in the system, per practice, so a subject-access request can name the recipients for your record specifically.

Not on this list, deliberately. CareSavi does not use a speech-to-text vendor: the clinical note assistant is text-only and no audio is recorded or transmitted. A practice may also supply its own AI provider key, which narrows that relationship to the practice and the provider directly.

POPIA s72 allows personal information to leave South Africa only where you have consented, or where a binding agreement gives protection substantially similar to POPIA, or where the recipient country's law is comparable. We rely on all three layers together:

1. A distinct consent for the transfer itself, recorded per purpose: AI, messaging, payments and the clinical note assistant are four separate consents, not one.
2. Contractual protection with each recipient, carrying the retention and no-secondary-use commitments in §7 down the chain.
3. Minimisation before egress is the primary control. We send the least data the function needs, never the record. The AI receptionist sees minimised conversation text, not your file; the note assistant sees one visit's draft and nothing else: no history, no prior notes, no documents, no identifiers, no medical-aid data, no messages.

• Encryption at the record level. Health and identifying fields are encrypted record by record (AES-256-GCM), with keys wrapped by a separate master key held as a restricted platform secret. This sits on top of transport and disk encryption.
• Hard separation between practices. Every record carries its practice, and the database itself enforces the boundary with row-level security, so a query that forgot to filter returns nothing rather than someone else's data.
• An append-only audit trail. Audit entries are chained and cannot be edited or deleted, including by us.
• No health data in logs. Enforced automatically in our build, not by policy alone. Error reports are scrubbed before they leave our servers.
• Access control. Role-based permissions, two-factor authentication, and a second authentication step before the most sensitive actions.
• Time-limited file access. Uploaded documents are served through short-lived signed links, never a public URL.

If information under our control is compromised, we notify the affected practice immediately so it can meet its own POPIA s22 obligations to you and to the Information Regulator.

Health records are the one place where “keep as little as possible” loses. South African law sets minimum retention periods that override minimisation:

Because CareSavi is an operator, we do not choose a destruction date. The practice sets one; our system validates it against the statutory floor above and refuses a date that would destroy a record too early. Where the practice has set no date, nothing is destroyed. A daily job carries out only the destructions the practice has actually instructed, and records each one in the audit trail.

Ask your practice: it is the responsible party. The practice exercises each of these through CareSavi, and every request is itself audited.

Two limits we will not pretend away. First, deletion cannot override the statutory minimums in §10: a request against a record still under a retention obligation is deferred, not refused, and the response says so rather than reporting a deletion that did not happen. Second, WhatsApp offers no message-deletion facility: once a message has been delivered through Meta's platform, an erasure on our side cannot reach the copy Meta holds. We can guarantee the destruction of our own copy, and we do; we cannot promise more than that.

CareSavi is WhatsApp-first. Messages fall into two kinds and the distinction is enforced in code, not left to judgement:

• Clinical and transactional: appointment confirmations, reminders, aftercare nudges. These do not depend on a marketing opt-in, because gating a clinical follow-up on a marketing consent would silence it for every patient who declined marketing.
• Marketing and engagement: recalls, review requests, satisfaction surveys, practice news. These require a separate opt-in under POPIA s69, checked again at the moment of sending rather than only when the message was scheduled.

CareSavi can enable a narrow SMS fallback; it is not active today. When it is, it covers only a WhatsApp message that could not be delivered. It is never a second channel, and never goes past a recorded objection.

Aftercare instructions, visit summaries and clinical notes are not sent as WhatsApp messages. What you receive is a content-free knock: the practice name and a single-use link. The summary itself is served by the practice's patient portal, hosted in South Africa, behind a one-time PIN sent to you and then a PIN you choose. The “aftercare” option in the WhatsApp menu re-sends that link and nothing else.

This is why the sub-processors carrying WhatsApp messages in §7 are described as receiving message content but never clinical detail. There is none in the message to receive.

CareSavi uses a large language model for an AI receptionist on WhatsApp, for classifying and summarising conversations, and for a clinical note assistant. Four rules govern all of it:

1. The model proposes; code decides. Bookings, payments, sends and record writes are performed by ordinary application code with its own checks. The model can only ask for one of a fixed set of actions.
2. Never diagnostic. The assistant is instructed not to diagnose or give clinical advice, and messages describing urgent symptoms are passed to a person by fixed rules instead of being handled by the model.
3. Clinician in the loop. The note assistant produces a draft that a clinician edits and explicitly approves. Until that approval, no clinical note exists. A clinician can decline it entirely.
4. Consented before use. The AI receptionist is on unless your practice asks us to switch it off; the clinical note assistant is off unless switched on. A patient's messages reach the model only after that patient agrees to the cross-border transfer.

What the AI provider keeps

Only one provider is active for a practice at a time, and it receives the minimum the task needs, never the patient record. What each keeps, on the terms it publishes (checked 27 September 2026):

• OpenAI does not use data sent to its API to train its models unless the customer opts in to share it. It keeps API inputs and outputs in abuse-monitoring logs for up to 30 days and then deletes them, unless the law requires longer or it is reasonably necessary to protect its services or others from harm. CareSavi asks it to keep nothing more: every request is sent with storage switched off (store: false), so no conversation is saved to OpenAI's stored-completions or logs features. OpenAI offers Zero Data Retention, which removes even the 30-day log, only to customers it approves; CareSavi does not have it.
• Anthropic does not use API inputs or outputs to train its models by default. It deletes them within 30 days, or keeps them for up to 2 years if a request is flagged under its usage policy.
• Alibaba Cloud Model Studio states that it never uses customer data for model training. It publishes no retention period for model inputs and outputs, so we cannot state one.

On our side, we record that an AI interaction happened and what it cost, never the content of the prompt or the reply outside the encrypted store.

This marketing site holds no patient information, has no login and sets no analytics or advertising cookies. Its copy and images are read from the CareSavi API by our own servers, and images reach your browser through this site rather than from the API. Fonts are self-hosted, so your browser makes no request to Google.

The practice application, the patient portal and the API are separate systems with their own authentication; they use strictly-necessary cookies to keep you signed in.

Where the patient is a child or cannot consent for themselves, consent must be given by a competent person: a parent, guardian or someone lawfully authorised. Records of minors are kept until the patient turns 21, per §10, which means a deletion request made before then is deferred rather than carried out.

We update this notice when what the system does changes, including whenever a sub-processor is added or removed. The version and effective date are at the top. Practices are notified of material changes per their agreement with us.

Raise it with your practice first, or with our Information Officer at legal@caresavi.com. If you are not satisfied, you may complain to the Information Regulator (South Africa) at inforegulator.org.za. You may also apply to a court.

See also our Terms of Service and PAIA manual.