Privacy policy
- Optometrics is practice management software for optometry practices in South Africa. We follow the Protection of Personal Information Act, 2013 (POPIA).
- Each practice owns its patient records. We process them only on the practice's instructions, to run the service.
- If a practice connects Google Calendar, we use that access only to keep the practice's diary and its Google Calendar in step. We never sell Google user data, use it for advertising, or use it to train AI models.
- Data is stored on servers in South Africa, encrypted in backups, and never sold.
- Who we are
- Practices, patients and us
- Information we collect
- Google user data
- How we use information
- Who we share it with
- Where and how it's stored
- How long we keep it
- Cookies
- Your rights
- Changes to this policy
- Contact us
1. Who we are
Optometrics ("we", "us") is a cloud-based practice management system for independent optometry practices, available at optometrics.co.za. Optometrics is operated by [LEGAL ENTITY NAME] (registration number [REGISTRATION NUMBER]), [PHYSICAL ADDRESS], South Africa.
This policy covers the Optometrics application, this website, and any related support we provide.
2. Practices, patients and us
POPIA gives different responsibilities to different parties, so it matters whose information is whose:
- Patient information. The optometry practice that uses Optometrics is the responsible party for its patients' information. Optometrics acts as the practice's operator: we process patient information only on the practice's behalf, under a written agreement with the practice, and for no other purpose. If you are a patient, please contact your practice first about your records. We will help the practice respond.
- Practice and staff accounts, website visitors and enquiries. For this information, Optometrics is the responsible party.
3. Information we collect
Practice and staff account information
Practice name, practice number, contact details, billing details, and for each staff user: name, work email address, role, sign-in credentials (stored as one-way hashes) and records of sign-ins and actions in the system (the audit log).
Patient information entered by the practice
The practice decides what to capture. This typically includes names, contact details, ID or passport numbers, date of birth, medical-aid details, appointments, eye examination results, prescriptions, health history, quotes, invoices, payments and correspondence. Health information is special personal information under POPIA and receives extra protection (see section 7).
Google account information
Only if a practice chooses to connect Google Calendar. See section 4.
Website visitors
This website does not use analytics or advertising trackers. Our hosting provider keeps standard technical logs (such as IP address and browser type) for security and to keep the site running. If you email us, we keep your email and our reply.
4. Google user data
Optometrics can optionally sync a practice's diary with Google Calendar. This section explains exactly what that involves.
What we access
| Permission (scope) | What we use it for |
|---|---|
openid and userinfo.email | To confirm which Google account was connected and show its email address on the practice's settings page, so staff can see which calendar each diary is linked to. |
calendar.events | To create, update and delete the events that mirror the practice's Optometrics appointments, and to read events in the connected calendar. Reading lets us pick up appointment time changes made in Google, and show time booked directly in Google (for example, a meeting or leave) as busy in the practice diary. |
We do not request access to Gmail, Google Drive, contacts or any other Google service, and we do not request full control of the Google Calendar account.
How we use it
- Google user data is used only to provide and improve the diary-sync feature that the practice has turned on, and is visible only within that practice's own Optometrics account.
- To limit what reaches Google, appointments we send to Google Calendar contain only the patient's first name, surname initial, appointment type and time, plus a link back to the appointment in Optometrics (which only signed-in practice staff can open). ID numbers, medical-aid details and clinical information are never sent to Google.
How we store and protect it
The Google access credential (a refresh token) is encrypted with AES-256 before it is saved, and stored on our servers in South Africa. Event information read from Google is kept only as long as needed to keep the diary in sync.
What we never do
- We do not sell Google user data or transfer it to anyone, except as needed to provide the feature, to comply with the law, or as part of a merger or sale of the business with notice to you.
- We do not use it for advertising, including retargeting, personalised or interest-based ads.
- We do not use it to train, develop or improve generalised or non-personalised artificial intelligence or machine learning models.
- Our staff do not read it unless the practice asks us to for support, it is needed for security purposes such as investigating abuse, or the law requires it.
Optometrics' use and transfer to any other app of information received from Google APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements.
Disconnecting and deletion
A practice owner or administrator can disconnect Google Calendar at any time under Settings → Google Calendar. When they do, we revoke our access at Google and delete the stored credential and connection details straight away. Access can also be removed from the Google side at myaccount.google.com/permissions. Events that were already copied into Google Calendar stay in that calendar until the account holder deletes them.
5. How we use information
- To provide the service: the diary, patient files, quotes, invoicing, medical-aid claims, recalls and reminders.
- To keep it secure: sign-in protection, audit logs, fraud and abuse prevention.
- To support practices, fix problems and make backups.
- To move a practice's records from its previous system when it asks us to.
- To bill practices and keep accounting records.
- To meet legal obligations.
We do not use patient information for marketing, and we do not sell personal information.
6. Who we share it with
We share information only with service providers who help us run Optometrics, under agreements that require them to protect it, and only as far as each one needs:
| Who | Why |
|---|---|
| Hosting and backup providers in South Africa | To run the application and keep encrypted backups |
| Only for practices that connect Google Calendar (section 4) | |
| Medical-aid claims switches | To submit the practice's claims, when the practice uses this feature |
| Email and SMS providers | To send appointment reminders and system emails on the practice's behalf |
| Cloudflare | To host and protect this website |
We may also disclose information when the law requires it, or to protect someone's life or safety.
7. Where and how it's stored
Application data and backups are stored in data centres in South Africa. Some service providers, such as Google, Cloudflare or email providers, may process limited information outside South Africa. Where that happens we rely on the protections POPIA requires for cross-border transfers (section 72).
Our safeguards include:
- encryption in transit (HTTPS) and of backups and ID numbers at rest
- a database that is not reachable from the internet
- role-based access, so staff see only what their role allows
- an audit log of who viewed or changed records
- automatic security updates, and monitoring with alerts
- continuous off-site backups, with regular restore tests
If we become aware of a security compromise affecting personal information, we will notify the affected practice without undue delay so that it can meet its own obligations, and we will notify the Information Regulator where we are required to.
8. How long we keep it
- Patient records are kept for as long as the practice uses Optometrics, following the practice's instructions and its legal duties to keep health records. When a practice leaves, we give it a full export and then delete its data from live systems within 90 days. Copies in backups are deleted as those backups expire.
- Google connection data is deleted as soon as Google Calendar is disconnected (section 4).
- Account and billing records are kept as long as tax and company law requires.
- Website logs are kept only for a short period for security purposes.
9. Cookies
The Optometrics application uses only essential cookies: one to keep staff signed in, and a short-lived one to protect the Google Calendar connection step against forged requests. This website sets no tracking or advertising cookies.
10. Your rights
Under POPIA you can ask to see the personal information held about you, ask for it to be corrected or deleted, object to certain processing, and complain to the Information Regulator. Patients should contact their practice, which is responsible for their records; we will help the practice respond. For anything else, contact our Information Officer below.
You can complain to the Information Regulator (South Africa) at inforegulator.org.za.
11. Changes to this policy
If we change this policy, we will update the date at the top of this page. If a change is significant, for example a new use of Google user data, we will tell practices by email before it takes effect, and ask for fresh consent where required.
12. Contact us
Information Officer: [INFORMATION OFFICER NAME]
Email: privacy@optometrics.co.za
Post: [LEGAL ENTITY NAME], [PHYSICAL ADDRESS], South Africa