POPIA Operator Agreement
Version 1.0 · effective 15 September 2026.
This Operator Agreement records the terms on which Netpractice (Pty) Ltd processes personal information on behalf of your practice, as required by section 21(1) of the Protection of Personal Information Act 4 of 2013 ("POPIA").
It is incorporated into the Terms of Service by clause 8.2, so it applies to your practice from the effective date above without any further signature. If your compliance file or your auditor requires a copy signed by Netpractice, request one at privacy@netpractice.co.za and we will countersign and return it.
1. Parties and roles
1.1. The parties are your practice (the "Responsible Party") and Netpractice (Pty) Ltd, registration number 2012/072246/07 (the "Operator").
1.2. Your practice determines the purpose and means of processing the personal information of your patients. You are the Responsible Party for that information.
1.3. Netpractice processes that information on your behalf and on your instruction. Netpractice is your Operator, as defined in section 1 of POPIA.
1.4. Nothing in this Agreement makes Netpractice the Responsible Party for your patients' information, and Netpractice does not determine the purposes for which it is processed.
2. Definitions
Words defined in POPIA carry the same meaning here. In addition:
"Personal Information" means the personal information, including Special Personal Information as contemplated by section 26 of POPIA, that Netpractice processes on your behalf through the Service.
"Security Compromise" means any circumstance in which there are reasonable grounds to believe that Personal Information has been accessed or acquired by an unauthorised person.
"Service" means the Netpractice practice management, medical billing, and patient health information platform.
"Sub-operator" means a third party engaged by Netpractice to process Personal Information on Netpractice's behalf in the course of providing the Service.
3. Processing only on your instruction
3.1. Netpractice will process Personal Information only:
- with your knowledge and authorisation, in accordance with section 20 of POPIA; and
- for the purpose of providing the Service to you, or as otherwise instructed by you in writing.
3.2. Your instructions are given by your use of the Service and its configured features, together with any written instruction you send to Netpractice.
3.3. Netpractice will not process Personal Information for its own purposes. In particular, Netpractice will not sell it, will not use it for marketing, and will not use identifiable patient information to train any machine-learning model.
3.4. Netpractice may generate aggregated, de-identified statistics about use of the Service. Those statistics contain no personal information and are not subject to clause 3.3.
3.5. If Netpractice believes an instruction from you would breach POPIA, it will tell you promptly and may suspend that part of the processing until the matter is resolved.
3.6. Where Netpractice is compelled by law to process or disclose Personal Information otherwise than on your instruction, it will notify you before doing so unless the law prohibits that notification.
4. Your responsibilities as Responsible Party
4.1. You warrant that you have a lawful basis under POPIA for the processing you instruct, whether that is the data subject's consent or the medical-treatment basis in section 32(1) of POPIA.
4.2. You are responsible for the accuracy and lawfulness of the Personal Information you enter into the Service, for issuing your own patient-facing privacy notice, and for complying with the National Health Act 61 of 2003 and applicable HPCSA rules.
4.3. You are responsible for managing access by your own users, and for revoking access promptly when a person leaves your practice.
5. Confidentiality
5.1. Netpractice will treat all Personal Information as confidential and will not disclose it except as permitted by this Agreement or required by law.
5.2. Netpractice will ensure that every person authorised to process Personal Information is subject to a written duty of confidentiality that survives the end of their engagement, and is trained on the handling of health information.
5.3. Netpractice personnel will not access identifiable patient records except where you have granted permission to assist with a technical issue, or where access is unavoidable in operating and maintaining the Service. Such access is logged and available to you on request.
6. Security measures
6.1. Netpractice will secure the integrity and confidentiality of Personal Information in its possession or under its control by taking appropriate, reasonable technical and organisational measures to prevent loss of, damage to, or unauthorised destruction of it, and unlawful access to or processing of it, as required by sections 19 and 21 of POPIA.
6.2. Those measures include:
- Encryption in transit. TLS on all connections between users, the Service, and its data stores.
- Encryption at rest. Databases, backups, and document storage are encrypted at rest.
- Access control. Role-based access, with staff access to production data restricted to those who require it and logged.
- Network controls. Restriction of network access to the systems holding Personal Information, with administrative access limited to controlled paths.
- Risk assessment. Periodic identification of reasonably foreseeable internal and external risks, with safeguards implemented against those risks, verified for effectiveness, and updated in response to new risks or deficiencies, in accordance with section 19(2) of POPIA.
- Governance. An appointed Information Officer, and internal policies governing the handling of health information, having regard to generally accepted information security practice.
- Resilience. Daily automated backups to redundant storage, with restoration tested periodically.
- Secure disposal. Deletion, destruction, or de-identification of records in a manner that prevents their reconstruction in an intelligible form.
6.3. Netpractice will not materially reduce the level of protection described in this clause during the term of this Agreement.
7. Sub-operators
7.1. You authorise Netpractice to engage Sub-operators to process Personal Information in the course of providing the Service.
7.2. Netpractice will impose on each Sub-operator, by written contract, data protection obligations no less protective than those in this Agreement, including the security and breach notification obligations.
7.3. Netpractice remains responsible to you for the processing carried out by its Sub-operators.
7.4. The current list of Sub-operators, what each does, and where each processes Personal Information, is published in the Privacy Policy and forms part of this Agreement.
7.5. Netpractice will give you at least 20 (twenty) business days' notice before adding or replacing a Sub-operator that processes patient Personal Information. If you reasonably object on data protection grounds, you may terminate the affected part of the Service without penalty.
7.6. Clause 7.5 does not apply to the claim submission chain described in clause 7A, because the route a claim takes is determined by the scheme you are claiming against rather than by Netpractice selecting a supplier, and a scheme may change its own connection at short notice.
7A. Claim submission: schemes and switches
7A.1. When you submit a claim through the Service, Netpractice transmits it on your instruction to the medical scheme or scheme administrator concerned. Most schemes are not reached directly. The claim passes through a switching provider that connects healthcare providers to schemes.
7A.2. Netpractice currently transmits claims through the following routes:
| Route | Role |
|---|---|
| MediLink | Claim switching provider |
| Allegra | Claim switching provider |
| SwitchOn | Claim switching provider |
| Metropolitan Health | Direct scheme connection |
| Discovery Health | Scheme administrator, reached through a switching provider above |
| Other schemes and administrators | The scheme your patient is a member of, reached through a switching provider above |
7A.3. These parties are not Sub-operators of Netpractice. They are separate Responsible Parties: they process claim information for their own purposes, principally adjudicating and paying the claim, under their own privacy terms and the rules of the relevant scheme. Netpractice does not instruct them and is not responsible for their processing.
7A.4. Netpractice discloses them here because you are the Responsible Party to your patients and are answerable for the chain their information travels through. The route for a given claim is determined by the scheme and plan being claimed against.
7A.5. Netpractice will keep the list in clause 7A.2 current, and will transmit claim information only to the extent necessary to submit the claim you have instructed and to receive the response.
8. Transfers outside South Africa
8.1. Patient Personal Information is hosted primarily in South Africa.
8.2. Netpractice will transfer Personal Information outside the Republic only where one of the conditions in section 72(1) of POPIA is met, and in practice only under a written agreement binding the recipient to obligations substantially similar to POPIA's conditions for lawful processing.
8.3. The countries in which Sub-operators process Personal Information are disclosed in the sub-operator table in the Privacy Policy. Netpractice will provide the specific transfer basis for any Sub-operator on request.
9. Notifying you of a Security Compromise
9.1. Where Netpractice has reasonable grounds to believe that Personal Information it processes for you has been subject to a Security Compromise, it will notify you in writing without undue delay and in any event within 72 (seventy-two) hours of becoming aware of it, as contemplated by section 21(2) of POPIA.
9.2. The notification will include, to the extent then known: what happened and when; the categories and approximate volume of Personal Information involved; the patients or practices affected; the likely consequences; the measures Netpractice has taken or proposes to take; and a contact point for further information. Where the full picture is not yet available, Netpractice will notify you on the information it has and supplement it as the investigation progresses.
9.3. Netpractice will give you the information and assistance you reasonably require to meet your own obligations under section 22 of POPIA, including notifying the Information Regulator and affected data subjects.
9.4. Netpractice will not make any public statement identifying your practice in connection with a Security Compromise without consulting you first, unless it is legally compelled to do so.
9.5. As between the parties, the obligation to notify the Information Regulator and the affected data subjects rests with you as the Responsible Party. Netpractice will notify the Regulator of compromises affecting information for which it is itself the Responsible Party.
10. Assisting with data subject requests
10.1. Where a patient exercises a right under POPIA - access, correction, deletion, or objection - Netpractice will, on your reasonable request, help you locate, produce, correct, or delete the relevant Personal Information held in the Service.
10.2. If a patient contacts Netpractice directly, Netpractice will not respond on your behalf. It will refer the patient to your practice and tell you that the request was made.
10.3. The Service provides self-service export and correction tools. Netpractice provides this assistance at no charge where those tools are sufficient.
11. Records, audit, and assurance
11.1. Netpractice will maintain records of the processing it carries out for you sufficient to demonstrate compliance with this Agreement.
11.2. On reasonable written notice, and no more than once in any 12-month period unless a Security Compromise has occurred, Netpractice will provide you with the information you reasonably require to satisfy yourself of its compliance with this Agreement.
11.3. Netpractice may satisfy clause 11.2 by providing a written description of its controls, a completed security questionnaire, or a third-party assurance report where one is available.
11.4. Any audit is subject to confidentiality, must not compromise the security or privacy of other practices' data, and takes place during business hours at your cost.
12. Retention, return, and deletion
12.1. Netpractice will retain Personal Information only for as long as it is required to provide the Service, or for longer where the law requires it or you instruct it in writing.
12.2. On termination, Netpractice retains your Personal Information for 40 (forty) days. Netpractice will not delete it during that period without first giving you a reasonable opportunity to export it, and will provide an export in a common machine-readable format on request.
12.3. Where you are legally obliged to retain records for longer, including patient record retention obligations under the National Health Act and HPCSA rules, Netpractice will extend the retention period on your written request, subject to agreement on any applicable storage fee.
12.4. After the retention period, Netpractice will delete, destroy, or de-identify the Personal Information in a manner that prevents its reconstruction in an intelligible form, save for copies held in routine backups, which age out on their ordinary cycle, and any records Netpractice must keep by law.
12.5. Netpractice will confirm completion of deletion in writing on request.
13. Duration
13.1. This Agreement takes effect on the effective date above, or on the date you first accept the Terms of Service if later, and continues for as long as Netpractice processes Personal Information on your behalf.
13.2. The obligations in clauses 5, 6, 9, and 12 survive termination for as long as Netpractice holds any of your Personal Information.
14. General
14.1. Where this Agreement conflicts with the Terms of Service in relation to the processing of Personal Information, this Agreement prevails.
14.2. Netpractice may amend this Agreement to reflect changes in law or in its processing. Material changes will be notified to you at least 20 (twenty) business days before they take effect, and each version is recorded in the version history below.
14.3. This Agreement is governed by the laws of the Republic of South Africa.
14.4. Nothing in this Agreement limits any liability that cannot lawfully be limited, including liability under section 99 of POPIA for damage suffered by a data subject.
Annexure A - Description of the processing
This annexure describes the processing Netpractice carries out on your behalf, for your records and for your auditor.
| Item | Detail |
|---|---|
| Subject matter | Provision of practice management, medical billing, and claim submission software to a registered healthcare practice. |
| Duration | The term of your subscription, plus the retention period in clause 12. |
| Nature and purpose | Storing and organising patient demographic, clinical, and billing records; producing invoices, statements, and receipts; submitting claims to medical schemes and receiving their responses; sending appointment and account communications on your instruction; producing reports for your practice. |
| Categories of data subject | Your patients and their dependants; the guardians or principal members responsible for a patient's account; your practitioners and staff who use the Service. |
| Categories of personal information | Identifying and contact details (name, identity or passport number, date of birth, address, telephone, email); medical scheme membership and dependant codes; clinical information including diagnosis codes, procedure and tariff codes, and consultation notes entered by your practice; account and payment information; and, for your own users, professional registration details and login credentials. |
| Special Personal Information | Information concerning health, processed under section 32 of POPIA. Where dictated by a claim, information that may reveal a data subject's sex life is processed on the same basis. |
| Children's information | Personal information of minors is processed where they are patients of your practice, on the authority of a competent person as contemplated by section 35 of POPIA. |
| Recipients | The Sub-operators listed in the Privacy Policy; and, on your instruction, the medical schemes, scheme administrators, and switching providers listed in clause 7A.2 (MediLink, Allegra, SwitchOn, and the direct Metropolitan Health connection). |
| Locations | Primarily South Africa. See the sub-operator table in the Privacy Policy for processing outside the Republic. |
Signature
Netpractice accepts the obligations in this Agreement in respect of every practice that has accepted the Terms of Service.
Signed for and on behalf of Netpractice (Pty) Ltd by its duly authorised representative. A copy signed for your practice specifically, naming your practice and practice number, is available on request from privacy@netpractice.co.za.
Version history
| Version | Effective | Note |
|---|---|---|
| 1.0 | 15 September 2026 | First issue. Records the section 21(1) terms previously covered only in general form by the Terms of Service. |