Privacy Policy

This Privacy Policy explains how SnagMD collects, uses, stores, shares and protects personal information when healthcare practices, practice staff, website visitors, prospects and patients use or interact with SnagMD.

SnagMD provides patient intake infrastructure for healthcare practices. The platform helps practices collect patient forms, consent responses, medical aid details, appointment-related information and clinical history through a secure digital intake workflow before the appointment.

Because SnagMD may process health-related and other sensitive information, access is restricted to authorised users and processing is limited to documented service, security, support and legal purposes. This Privacy Policy should be read together with our Terms of Service and any applicable Data Processing Agreement.

This Privacy Policy is intended to support transparency and responsible processing. It does not replace any privacy notice, consent form or legal obligation of the healthcare practice using SnagMD.

SnagMD is the provider of the SnagMD platform and related services.

References to “SnagMD”, “we”, “us” or “our” mean the provider and operator of the SnagMD platform.

Privacy questions may be sent to legal@trysnagmd.co.za or support@trysnagmd.co.za.

This Privacy Policy applies to personal information processed through the SnagMD website, platform, intake workflows, dashboards, support channels, trial access, account administration, sales communications and related services.

This Privacy Policy may apply to healthcare practices, clinicians, reception staff, administrators, authorised practice users, patients, guardians, responsible persons, website visitors, prospects, suppliers and other people who interact with SnagMD.

Where a patient completes an intake form provided by a healthcare practice using SnagMD, the relevant practice may also have its own privacy policy, consent wording and patient notices. Patients should contact the practice for questions about clinical use of their information, medical records, treatment decisions or practice-specific privacy obligations.

For Patient Information submitted through SnagMD on behalf of a healthcare practice, the practice will usually act as the responsible party, controller or equivalent decision-maker under applicable privacy laws.

SnagMD will usually act as the operator, processor or service provider for Patient Information processed on behalf of the practice.

The practice decides which patients are invited, which forms are used, which questions are asked, why the information is collected, how the information is used after submission, and how it is stored in the practice’s own systems.

SnagMD may act as a responsible party or controller for its own business operations, including account administration, billing, support, security monitoring, website analytics, direct business communications, product improvement and legal compliance.

Nothing in this Privacy Policy transfers a practice’s legal, clinical, professional or regulatory responsibility for Patient Information to SnagMD.

The information processed through SnagMD depends on how a practice configures and uses the platform.

Patient Information may include names, surnames, dates of birth, contact details, addresses, appointment details, reason for visit, medical aid information, main member information, dependent information, consent responses, clinical history, medication history, allergy information, prior conditions, symptoms, administrative notes and other intake-related information requested by the practice.

Practice account information may include names, work email addresses, phone numbers, practice names, roles, job titles, account permissions, login information, billing information, subscription information and support communications.

Technical and security information may include IP addresses, device information, browser type, approximate location derived from technical data, timestamps, log-in events, access logs, audit logs, error logs, security logs and usage information.

Sales and communication information may include business contact details, email correspondence, enquiry details, demo requests, trial requests, outreach status, opt-out preferences and publicly available practice information.

Website information may include pages viewed, referring sites, browser information, device information, cookie identifiers, analytics events and other information collected through cookies or similar technologies where used.

Content information may include form responses, uploaded documents, signatures, consent records, messages, support requests and other information that a practice or patient submits to the Services.

We do not require a person to submit health information through the public marketing website. Patients and practices should submit information only through an authorised SnagMD workflow and only when instructed by the relevant practice.

SnagMD may process health-related information and other sensitive categories of information when a patient submits intake information to a practice through the platform.

This may include clinical history, symptoms, allergies, medications, medical aid information, appointment-related medical context and other information relevant to preparing for a healthcare appointment.

SnagMD processes this information to provide the platform to the relevant practice, support the intake workflow, maintain security, provide technical support, comply with legal obligations and operate the service.

The practice is responsible for ensuring that it has a lawful basis or justification to collect and process special personal information or health data through SnagMD.

SnagMD does not use Patient Information submitted through intake workflows to market to patients.

SnagMD may be used by practices that treat children or collect information about minors.

Where children’s information is processed through SnagMD, the practice is responsible for ensuring that the collection and processing is lawful and properly authorised.

The practice is responsible for deciding whether a parent, guardian, caregiver, responsible person or authorised representative must complete or approve a form.

SnagMD does not independently verify legal guardianship, parental authority, patient capacity or the authority of the person completing a form.

Information may be collected directly from patients when they complete an intake workflow.

Information may be collected from practice users when they create accounts, configure workflows, invite patients, access dashboards, contact support or use SnagMD.

Information may be collected automatically through platform use, logs, cookies, analytics tools, security systems and similar technologies.

Information may be collected from public sources, referrals, websites, business directories or existing business relationships where SnagMD contacts practices about relevant services.

Information may also be received from service providers, infrastructure providers, payment providers, support tools or other suppliers used to operate the platform.

SnagMD processes information to provide, operate, secure, maintain and improve the platform.

For patient intake workflows, information is processed to allow patients to complete forms, allow practices to receive organised intake information, support pre-appointment administration, reduce fragmented information collection and help practices prepare for appointments.

For practice accounts, information is processed to create and manage accounts, provide access, configure workflows, provide support, manage trials, issue invoices, process payments, communicate service updates and maintain customer relationships.

For security and reliability, information may be processed to detect misuse, investigate incidents, prevent unauthorised access, maintain logs, troubleshoot issues, monitor performance, fix bugs and protect the platform.

For business operations, information may be processed to respond to enquiries, manage sales communications, improve product functionality, understand website usage, comply with legal obligations, enforce agreements and protect SnagMD’s rights.

SnagMD does not make clinical decisions, diagnose patients, determine treatment, or use Patient Information for independent advertising to patients. We do not make decisions producing legal or similarly significant effects solely by automated means through the Services.

The lawful basis or justification for processing depends on the type of information, the person involved and the context of processing.

For Patient Information submitted through a practice workflow, the practice is usually responsible for determining the applicable lawful basis or justification for collection and use.

SnagMD may process Patient Information on the instructions of the practice to provide the service, support the intake workflow, maintain security and comply with applicable obligations.

SnagMD may process account, billing, support, security and business information where necessary to perform a contract, take steps before entering a contract, comply with legal obligations, protect legitimate interests, maintain platform security, respond to enquiries, manage customer relationships or where consent applies.

Where consent is used, the relevant person may have the right to withdraw consent, subject to applicable law and the context in which the information was collected.

When a patient completes a SnagMD intake workflow, the information is collected for the relevant practice and made available to that practice for appointment preparation and related administrative purposes.

SnagMD does not provide medical advice, diagnosis, treatment, triage, emergency care, clinical review or clinical decision-making.

Patient submissions may not be reviewed immediately by the practice. Patients should not use SnagMD for urgent medical issues or emergencies.

Patients should contact the practice directly, contact emergency services or seek appropriate medical care if they need urgent assistance.

The practice is responsible for reviewing submitted information, contacting patients where necessary, and maintaining its own medical and administrative records.

The practice is responsible for deciding what information is collected through SnagMD and ensuring that the information requested is relevant, appropriate and lawful.

The practice is responsible for providing appropriate patient-facing privacy wording, consent wording, financial wording, medical aid wording and appointment instructions.

The practice is responsible for ensuring that only authorised staff access Patient Information.

The practice is responsible for handling exported, downloaded, copied, printed, emailed or transferred Patient Information securely and lawfully.

The practice is responsible for responding to patient questions about clinical care, medical records, treatment, billing, consent and the practice’s own privacy obligations.

Patient Information submitted through SnagMD may be shared with or made available to the relevant practice and its authorised users.

SnagMD may share information with service providers that help us operate, host, secure, maintain, support, monitor, analyse, bill for or improve the platform.

Service providers may include hosting providers, database providers, infrastructure providers, email providers, analytics providers, monitoring tools, support tools, payment providers, professional advisers and other suppliers.

SnagMD may disclose information where required by law, court order, regulator request, legal process, contract enforcement, security investigation or to protect the rights, safety and integrity of SnagMD, practices, patients or others.

SnagMD does not sell Patient Information.

SnagMD does not disclose Patient Information to advertisers for their independent marketing purposes.

We require service providers to use information only for the services they provide to SnagMD, subject to appropriate confidentiality, security and data protection obligations. We do not authorise them to sell Patient Information or use it for their own unrelated advertising.

SnagMD may use third-party service providers and subprocessors to provide the platform and related services.

These providers may process information only as reasonably necessary to provide their services to SnagMD, subject to applicable contractual, technical and organisational safeguards.

Where SnagMD publishes or provides a subprocessor list, that list may include provider names, purposes, data categories, locations and whether patient data may be involved.

The subprocessor list may be updated from time to time as SnagMD’s suppliers, infrastructure or product requirements change.

Practices that require specific subprocessor terms should enter into a separate Data Processing Agreement or written agreement with SnagMD.

Information may be processed or stored in countries other than the country where the practice or patient is located, depending on SnagMD’s infrastructure, service providers and operational requirements.

Where required by applicable law, SnagMD will take reasonable steps to ensure that cross-border processing is subject to appropriate safeguards or lawful transfer mechanisms.

The practice is responsible for assessing whether its use of SnagMD is appropriate for its own cross-border data protection obligations, unless a separate written agreement states otherwise.

SnagMD retains information only for as long as reasonably necessary for the stated purpose, to provide the services, support customers, maintain security, comply with legal obligations, resolve disputes, enforce agreements, maintain backups and meet legitimate operational needs. Retention periods may differ by data type and customer configuration.

Patient Information retention may depend on the practice’s account status, subscription, trial period, product configuration, legal obligations, backup cycles and any applicable written agreement.

SnagMD is not intended to be the practice’s permanent clinical record system, official medical record system, legal archive or long-term document management system.

The practice is responsible for exporting and retaining any records it requires for clinical, legal, professional, medical aid, insurance, billing or operational purposes.

Deletion of information may be subject to backup cycles, legal obligations, accounting requirements, security requirements, dispute preservation and technical limitations.

A practice may request export or deletion of Customer Data according to the functionality available in SnagMD or the applicable written agreement.

SnagMD may need to verify the identity and authority of the person making an export or deletion request.

Where SnagMD acts as operator or processor for Patient Information, patient requests may need to be directed to the relevant practice as the responsible party or controller.

Once a practice exports, downloads, prints, emails, copies or transfers information out of SnagMD, SnagMD is not responsible for that external copy.

SnagMD may retain limited information where necessary for legal compliance, security, audit, fraud prevention, billing, dispute resolution, backup management or enforcement of agreements.

SnagMD uses reasonable technical and organisational measures designed to protect information within the platform.

Security measures may include secure transmission, access controls, restricted administrative access, logging, monitoring, infrastructure controls, backups and other safeguards appropriate to the nature of the services.

No digital platform, internet transmission, hosting environment, database, email system, device, user account or third-party service can be guaranteed to be completely secure.

The practice is responsible for securing its own users, passwords, devices, email accounts, browsers, downloaded files, exported information, printed records, internal systems and third-party platforms.

Practices should promptly remove access for staff who leave or no longer require access and should notify SnagMD if they suspect unauthorised access or compromise.

No security measure eliminates risk. Users must not send passwords, access codes, unredacted health information or other sensitive material to SnagMD support unless specifically requested through an authorised support process.

If SnagMD becomes aware of a confirmed security incident affecting information within the SnagMD environment, SnagMD will investigate and take appropriate steps to contain, mitigate and remediate the issue.

Where required by applicable law or written agreement, SnagMD will notify the affected practice within a reasonable time after becoming aware of the confirmed incident.

The practice is responsible for determining whether it must notify patients, regulators, insurers, medical schemes, professional bodies or other third parties, unless applicable law requires otherwise.

SnagMD may provide reasonable information to assist the practice with its own assessment, including the nature of the incident, affected data categories where known, mitigation steps and recommended actions where appropriate.

A notification, investigation or cooperation step by SnagMD does not constitute an admission of fault, liability, breach, negligence or unlawful conduct.

SnagMD may contact healthcare practices, clinics or business representatives using publicly available business contact details, enquiry forms, referrals or existing business relationships.

Marketing communications will relate to SnagMD’s services or relevant healthcare administration workflows.

Recipients may opt out of marketing communications using the method provided in the message or by contacting SnagMD.

SnagMD may maintain a suppression list to avoid contacting people or organisations that have opted out.

SnagMD does not use Patient Information submitted through intake workflows to market to patients.

SnagMD may use cookies, analytics tools, pixels or similar technologies on its website to operate the site, understand usage, improve performance, measure marketing activity and protect against misuse.

Cookies may include essential cookies, analytics cookies, preference cookies and marketing cookies, depending on the tools implemented on the website.

Where required by law, SnagMD will request consent before using non-essential cookies or similar technologies.

The current public website includes Simple Analytics or another analytics service as configured by SnagMD. Analytics is used to understand website traffic and performance; it is not intended to receive Patient Information submitted through an intake workflow. Users may be able to disable cookies through browser settings, although some website functionality may not work correctly.

Depending on applicable law and context, individuals may have rights to access, correct, delete, object to, restrict or withdraw consent for the processing of their personal information.

Individuals may also have rights to complain to a regulator or supervisory authority.

Where SnagMD acts as operator or processor for Patient Information, requests relating to Patient Information may need to be handled by the relevant practice as the responsible party or controller.

SnagMD may take reasonable steps to verify identity and authority before responding to a request.

Some requests may be limited by legal obligations, clinical recordkeeping requirements, contractual obligations, security requirements, technical limitations, legitimate interests or the rights of others.

Patients should usually contact the relevant healthcare practice for requests relating to medical records, clinical records, treatment information, billing information, consent records or practice-held Patient Information.

Practice users, website visitors and other individuals may contact SnagMD at legal@trysnagmd.co.za for privacy-related requests concerning information controlled by SnagMD.

A request should include enough information for SnagMD to identify the requester, understand the request and verify authority where necessary.

SnagMD may redirect a request to the relevant practice where the practice is the responsible party or controller for the information involved.

If you have a privacy concern, you may contact SnagMD at legal@trysnagmd.co.za.

Patients may also contact the relevant healthcare practice where the concern relates to clinical use of information, medical records, treatment, billing, consent wording or the practice’s own handling of Patient Information.

Individuals may have the right to complain to the Information Regulator in South Africa or another applicable data protection authority, depending on the law that applies.

SnagMD will aim to handle privacy complaints responsibly and cooperate where appropriate, subject to confidentiality, security and legal limitations.

The SnagMD website or platform may contain links to third-party websites, tools or services.

SnagMD is not responsible for the privacy practices, security, content, availability or conduct of third-party websites or services.

Users should review the privacy policies and terms of any third-party services they access.

SnagMD may update this Privacy Policy from time to time to reflect legal developments, product changes, security improvements, operational changes or business requirements.

The updated Privacy Policy will apply from the effective date stated on the page or as otherwise communicated.

Where practical, SnagMD will try to communicate material changes that significantly affect customers or users.

Continued use of SnagMD after an updated Privacy Policy becomes effective means the updated policy applies to that use, subject to any notice or consent requirement imposed by applicable law.

Privacy questions may be sent to legal@trysnagmd.co.za.

Support questions may be sent to support@trysnagmd.co.za.