1. Who we are

Observable (Pty) Ltd ("Observable", "we", "us", "our") is a South African software company registered in the Republic of South Africa. We build and operate focused SaaS products including Nextapt, Clinicapt, and SA Paediatric Resus.

This policy explains how we collect, use, store, and protect personal information in accordance with the Protection of Personal Information Act 4 of 2013 (POPIA) and applicable data protection law.

Our Information Officer can be reached at support@observable.co.za.

2. What information we collect

The information we collect depends on which product or service you use:

• Nextapt — business name, owner name, contact number, WhatsApp number, booking records (client name, contact number, appointment time and service).
• Clinicapt — clinic name, practitioner details, patient name, contact number, appointment history, and where provided, clinical notes. Patient health information is treated as special personal information under POPIA.
• SA Paediatric Resus — this is a calculator tool. We do not collect or store personal information about users or patients.
• Website visitors — IP address, browser type, pages visited, and referring URL via server logs and analytics, where enabled.
• Contact and support — name, email address, and the content of any message you send us.

3. How we use your information

• To provide, operate, and improve our products and services.
• To send transactional communications such as booking confirmations and appointment reminders.
• To respond to support requests and enquiries.
• To detect and prevent fraud, abuse, or security incidents.
• To comply with legal obligations.

We do not sell personal information to third parties. We do not use personal information for unsolicited marketing without your consent.

4. Legal basis for processing

We process personal information on the following grounds under POPIA:

• Contract — processing is necessary to perform a contract with you or take steps at your request before entering into a contract.
• Legitimate interest — processing is necessary for our legitimate business interests, provided those interests are not overridden by your rights.
• Legal obligation — processing is required to comply with a legal obligation.
• Consent — where we rely on consent, you may withdraw it at any time.

For special personal information (such as health data processed through Clinicapt), we obtain explicit consent from the responsible party (the clinic or healthcare practitioner) before processing.

5. Data sharing

We share personal information only in the following circumstances:

• Service providers — third-party operators who assist us in delivering our services (e.g. cloud hosting, messaging infrastructure). These parties are bound by confidentiality agreements and may only process information on our instructions.
• WhatsApp / Meta — Nextapt uses the WhatsApp Business API. Messages sent via our platform are subject to Meta's privacy policy in addition to this policy.
• Legal requirements — where disclosure is required by law, court order, or regulatory authority.

6. Data retention

We retain personal information for as long as necessary to fulfil the purpose for which it was collected, or as required by law. When information is no longer needed, we delete or anonymise it securely.

• Booking and appointment records — retained for the duration of the business relationship plus 12 months, unless a longer period is required by law.
• Clinical data — retained in accordance with the National Health Act and instructions from the responsible clinic.
• Support correspondence — retained for 24 months from last contact.

7. Security

We implement appropriate technical and organisational measures to protect personal information against unauthorised access, loss, destruction, or disclosure. These include encrypted data storage, access controls, and regular security reviews.

In the event of a data breach that poses a risk to data subjects, we will notify the Information Regulator and affected individuals as required by POPIA.

8. Cookies and analytics

Our websites may use cookies and similar technologies to understand how visitors use our sites and to improve the user experience. You can control cookie settings through your browser. Disabling cookies may affect the functionality of some features.

9. Your rights under POPIA

As a data subject, you have the right to:

• Be notified that your personal information is being collected.
• Access the personal information we hold about you.
• Request correction of inaccurate or incomplete information.
• Request deletion of your personal information, subject to legal retention requirements.
• Object to the processing of your personal information.
• Lodge a complaint with the Information Regulator of South Africa.

To exercise any of these rights, contact us at support@observable.co.za. We will respond within 30 days.

10. Children's privacy

Our products are not directed at children under the age of 18. We do not knowingly collect personal information from children. Where health data about minors is processed through Clinicapt, the responsible party is the healthcare practitioner or clinic acting in loco parentis or under appropriate consent.

11. Changes to this policy

We may update this policy from time to time. Material changes will be communicated via email or a notice on our website. The effective date at the top of this page reflects the most recent revision.

12. Contact

Observable (Pty) Ltd
Information Officer: support@observable.co.za

Information Regulator of South Africa: www.justice.gov.za/inforeg