Privacy Policy

Hlokomela Healthcare (“Hlokomela”, “we”, “us”) is a booking platform operated by Knockturnal Innovations (Pty) Ltd, a company registered in South Africa. This policy explains what personal information we collect from patients and healthcare providers using our mobile apps (iOS, Android, AppGallery) and web platform, how we use it, and the choices you have.

We process personal information in line with the Protection of Personal Information Act, 2013 (POPIA).

Hlokomela is a booking platform that connects patients with independently licensed healthcare providers. We are not a medical device, a telehealth provider, or a clinical decision-support tool. We do not diagnose, treat, or dispense medicine — we only help schedule in-person consultations with providers who are responsible for their own clinical practice.

Account information

Name, email address, phone number, date of birth, gender, and (for providers) HPCSA registration number, specialty, facility and qualification documents. National ID or passport is optional.

Booking & message content

Appointment details you create, notes you add, chat messages you exchange with providers on the platform, and post-visit ratings and reviews you leave.

Health information you choose to share

Free-text medical history entries and profile photos you upload. You control what you enter — Hlokomela does not import clinical records from third parties.

Device & usage

Device model, operating system, app version, push-notification tokens (Firebase Cloud Messaging or Huawei Push Kit depending on your device), IP address, and diagnostic events used to detect crashes and errors.

Location (when you allow it)

When you use the “near me” provider search, we ask for your device location so we can sort providers by distance. Your location is used on-device for that search only. We do not store your location on our servers or share it with third parties.

• To create and maintain your account and let you sign in securely.
• To let patients find and book healthcare providers, and to give providers the information they need to prepare for a consultation.
• To send booking confirmations, reminders and status updates by email, SMS and push notification.
• To operate in-app messaging between a patient and the provider they have booked.
• To verify provider credentials before activating a provider account (best-effort review; providers remain responsible for their own HPCSA registration).
• To detect abuse, prevent fraud, keep the service safe, and diagnose faults.
• To meet our legal obligations under POPIA and other law.

When you book with a provider, the provider receives the information they need to identify and contact you and to prepare for the consultation. Patients see basic public provider profile information.

We also share limited information with service providers who help us run the platform:

• Amazon Web Services — hosting and database storage in the AWS Cape Town region (af-south-1), keeping your data in South Africa.
• Africa’s Talking — sending transactional SMS reminders and confirmations.
• Resend— sending transactional email from noreply@hlokomela.com.
• Google Firebase Cloud Messaging and Huawei Push Kit— delivering push notifications to your device.
• Sentry(EU region) — crash and error diagnostics. We disable personal-data capture so events contain stack traces and technical context, not your form fields.
• Google Sign-In and Sign in with Apple — only if you choose to sign in that way. We receive your verified email and, if you allow it, your name.

We do not sell your personal information. We do not share it for third-party advertising.

Application data (accounts, bookings, messages, medical history) is stored in the AWS Cape Town region. Profile photos are stored in an AWS S3 bucket in the same region. Error diagnostics are processed by Sentry in the European Union. Push tokens transit Google or Huawei infrastructure depending on your device.

We keep your account and booking history for as long as your account is active. When you delete your account (see below), your personally identifying details are anonymised in place and child records (messages, notifications) are removed. We may retain minimal booking records where the law requires us to keep proof of a transaction.

You have the right to:

• ask us what personal information we hold about you;
• correct information that is wrong or out of date;
• delete your account — use Profile → Delete account in the mobile app, or email us to request it;
• object to a specific use of your information;
• lodge a complaint with the Information Regulator of South Africa at inforegulator.org.za.

Data is transmitted over HTTPS. Passwords are hashed. Sessions are authenticated with signed tokens. Access to production databases is restricted to authorised personnel using audited short-lived credentials. No system is perfect, but we treat any security incident that affects your data seriously and will notify you and the Regulator where the law requires it.

Hlokomela is intended for people aged 18 and over. If you are a parent or guardian and believe a child has created an account, contact us and we will remove it.

We may update this policy as the product evolves or the law changes. Material changes will be surfaced in the app or by email before they take effect. The “Last updated” date at the top always reflects the current version.

Questions, requests or complaints: info@hlokomela.com. For the attention of the Information Officer, Knockturnal Innovations (Pty) Ltd, South Africa.