Privacy & POPIA notice
This notice is maintained by springlifemedical and describes the personal information the DocCo onboarding platform actually collects, the operators used to process it, and your rights under the Protection of Personal Information Act, 2013 (POPIA). It describes our own practices; it is not an independent certification or audit of them.
Last reviewed on the date this platform was last deployed.
springlifemedical is the responsible party for the information described below. Questions, access requests and objections go to the contact address published by springlifemedical to participating doctors; the portfolio administrator who issued your portal link can direct you to it.
Everything below is collected for one purpose: to assess your eligibility as a shareholding doctor, to record your subscription for shares, and to hold evidence of the agreements you sign. It is not used for marketing, and it is not sold or shared for anyone else’s commercial purposes.
Identity & contact
Full name as per ID, ID or passport number, date of birth, email address, mobile number and residential address.
Professional standing
HPCSA registration number, primary qualification, discipline or specialty and current practice or employer.
Shareholding details
Whether shares are held personally, by a company or by a trust; entity name and registration number; proposed share count; subscription amount in rand; payment arrangement; and declared source of funds.
Eligibility declarations
Your answers on HPCSA good standing, insolvency history, director disqualification, convictions involving dishonesty, and any disclosed conflicting interest.
Supporting documents
The files you upload: identity document, proof of address, HPCSA registration certificate, CV, banking details, tax documents, and — where shares are held by a company or trust — the relevant constitutional and resolution documents.
Signature evidence
For each agreement you sign: the exact text you were shown and its hash, the date and time, the one-time-pin verification, your IP address and browser user agent. This record is immutable and exists so a signature can be evidenced later.
Access records
Sign-in and one-time-pin events, pack status changes, administrator actions, IP address and browser user agent, each written to an audit log with a correlation reference.
These are the only third parties involved in processing your information on this platform. There is no analytics tracking, no advertising network, no SMS provider, and no artificial intelligence feature that receives your pack content.
Supabase (database, authentication, storage)
Hosts the database, issues the one-time pins used to verify your email address, and stores your uploaded documents in a private bucket that is only reachable through short-lived signed links. Supabase acts as an operator processing this information on our instruction.
Supabase Auth email delivery
Sends the one-time pins for portal access and for signing. The message contains your email address and the code, and no other pack content.
Application hosting
The web application itself is hosted on Lovable's infrastructure, which processes requests in transit in order to serve the pages you use.
Signature evidence, share certificates and the securities register are retained for as long as you hold shares and thereafter for the periods required by the Companies Act and other applicable law. Application material for a doctor who does not proceed is retained only for as long as needed to record that outcome. Ask the portfolio administrator for the retention period applied to a specific record.
You may ask what personal information we hold about you, ask that inaccurate information be corrected, object to processing, and ask for deletion of information we are not legally required to keep. You may also complain to the Information Regulator (South Africa). Signed agreements and register entries cannot be deleted on request, because they are the record of a completed transaction and are retained under law.