Security and POPIA

Responsible party. The practice decides what is processed and why, and remains the party the patient has a relationship with.

Operator under sections 20 and 21. We process records only on the practice's instructions, under a written operator agreement signed before any record is processed. flowxscale LLC is a Delaware company; its principal place of business, and the place from which ATTEND is administered, is Cape Town.

Sub-operator. Named in the operator agreement, with the operator's obligations flowed down. Any change of sub-operator requires notice to the practice and its consent.

ATTEND is designed so that patient records are stored and processed in South Africa. The production environment is being deployed on this basis, and the operator agreement records the location and any change to it.

The design gives each practice its own isolated environment, with no shared database and no shared credentials between practices. A misconfiguration in one cannot expose another.

Records are encrypted at rest. Backups are continuous and encrypted, and restoring from them is rehearsed as a drill, not only attempted in an emergency.

No transfer of patient records outside South Africa is part of the design. One optional feature sends a photograph of a hospital patient label to an AI vision service outside South Africa; it operates only with the patient's explicit, recorded consent, and every operator agreement discloses it as the sole exception.

Each doctor and staff member has their own account. Passwords are hashed with argon2id. Two-factor authentication with an authenticator app is mandatory for every account, not optional.

Access is by role: doctors, practice staff and administrators each see what their work requires.

Staff sign in from wherever they work — the consulting rooms, the hospital, or abroad — over HTTPS with two-factor authentication. Responses are marked not to be cached by the browser.

A South African identity number is validated and then hashed with a keyed secret before it is stored. The raw number is never stored, logged or included in a report file.

Each report carries a unique identifier in its footer. Because it contains the patient's name, ATTEND treats it as patient data everywhere: it never appears in logs or error messages.

Logs record the names of fields, counts and hashes — never the values. There is no analytics, telemetry or crash reporting inside ATTEND.

Each doctor has a cryptographic signing key, generated and held on the system and never exported, so a signed report can be verified as theirs.