Privacy Policy

1. Who this policy covers

This Privacy Policy explains how Fola collects, uses, shares, and protects information when you use the Service, whether as a patient, clinical staff member, or clinic administrator. Each clinic using Fola is the responsible party for its patients' health information under applicable data protection law (including South Africa's Protection of Personal Information Act, POPIA); Fola acts as an operator processing that information on the clinic's behalf.

2. Information we collect

• Account and profile information: name, email, phone, date of birth, national ID details, gender, nationality, and (for clinical staff) role and specialty.
• Health information: appointment details, consultation notes, prescriptions, lab test orders, medical record entries, and vitals recorded during in-person consultations.
• Communications: messages exchanged with your care team through the Service, and any file attachments you send.
• Billing information: invoice and payment status. Full card details are handled directly by Stripe and are not stored by Fola.
• Technical information: authentication session data needed to keep you signed in. Fola does not use third-party advertising or analytics tracking cookies.

3. How we use this information

We use this information to provide the Service: scheduling and managing appointments, enabling secure communication between you and your care team, maintaining medical records and prescriptions, processing billing, and sending notifications you've opted into (email or SMS). We do not sell personal or health information, and we do not use it for advertising.

4. Who we share it with

• Your care team: clinical staff and administrators within your own clinic who have a legitimate reason to access your record, gated by role and by an established care relationship.
• Service providers we use to run Fola: Google Cloud Platform and Firebase (hosting, authentication, database, file storage), and Stripe (payment processing). These providers act on our instructions and are contractually restricted from using your data for their own purposes.
• Legal requirements: where required to comply with a legal obligation, court order, or to protect the rights, safety, or property of Fola, a clinic, or others.

Fola does not share health information across clinics -- each clinic's data is isolated from every other clinic on the platform.

5. Data security

We apply role- and relationship-based access controls so that only staff with a legitimate reason can access a given patient's information, tenant isolation between clinics, and encryption of data in transit. No system is completely secure, and we can't guarantee absolute security, but we work to protect your information using practices appropriate to the sensitivity of health data.

6. Data retention

We retain health records for as long as your clinic's account is active and as required by applicable medical record-keeping and legal obligations, which may extend beyond account closure.

7. Your rights

Subject to applicable law, you may have the right to access, correct, or request deletion of your personal information, and to object to or restrict certain processing. Because your clinic is the responsible party for your health records, most requests should start with your clinic; contact them directly, or reach out to Fola and we will route your request appropriately.

8. Changes to this policy

We may update this Privacy Policy from time to time. Material changes will be reflected by an updated “Last updated” date above.

9. Contact

Questions about this policy can be directed to your clinic administrator or to Fola directly.