These Terms govern your access to and use of HPSuite+ (the “Platform”), a practice-management and clinical-support service. By registering an account or accepting these Terms during patient intake, you agree to be bound by them.
For all personal information of patients processed through the Platform, the registered healthcare practice (and its Information Officer) is the Responsible Party. HPSuite+, operated by Wolfatek Evolutions, acts strictly as an Operator (processor) that processes personal information on behalf of, and under the documented instruction of, the practice.
24-hour commitment. Where there are reasonable grounds to believe that the personal information of a data subject has been accessed or acquired by an unauthorised person, the Operator will notify the affected Responsible Party (practice) as soon as reasonably possible and in any event within 24 hours of the Operator becoming aware of the compromise. The notification will describe, to the extent known, the nature of the compromise, the categories of information involved, and the remedial steps taken, so the Responsible Party can meet its own obligations to the Information Regulator and affected data subjects under section 22.
Patient personal information processed through the Platform is hosted within South Africa, supporting data-sovereignty expectations for South African health data.
Patients are entitled to be informed of the collection of their information, to access it, to request correction or deletion, and to object to processing. Consent captured through the Platform (registration, patient intake, and marketing where applicable) is logged with a timestamp, source IP, and a version fingerprint of the exact terms accepted, providing a verifiable consent record.
Each party indemnifies the other against direct losses arising from its own breach of these Terms or of POPIA. The Operator’s aggregate liability is limited to the fees paid for the Platform in the twelve months preceding the event giving rise to the claim, save for liability that cannot be limited under law. The Responsible Party remains responsible for the lawfulness of the personal information it uploads and the instructions it issues.
The Operator may engage sub-operators (e.g. hosting and communication providers) under written terms no less protective than these. A current list is available from the Operator on request.
On termination, the Operator will, at the Responsible Party’s election, return or securely delete the personal information it holds on the practice’s behalf, save where retention is required by law (for example statutory clinical-record retention periods).