Compliance
Compliance map
This page sets out, rule by rule, what PPM does about the HPCSA's ethical guidelines and POPIA, where in the product it does it, and what is still outstanding. Statuses were checked against the live system on 23 October 2026.
PPM has not yet had its legal review. A South African attorney with POPIA and health-law experience will review PPM, its operator agreement and its consent wording before any real client's information is entered. Until then PPM runs on fictional test data only. Nothing here is legal advice, and the HPCSA does not approve or endorse software (Booklet 20, para 2.2).
Status legend
- In place
- Being built
- Before first real client
- Needs legal sign-off
HPCSA Booklet 20: Ethical guidelines on the use of artificial intelligence (September 2025)
| Rule | What it requires | What PPM does, and where | Status |
|---|---|---|---|
| B20 3.7, 9.1, 9.2 | The practitioner always makes the final decision on patient care. AI may not be the final decision maker. | AI output is saved as a draft. A note only enters the record when a registered therapist approves it, and the approval records who signed and when. Notes made with AI are marked as AI-assisted.Session note, Approve |
|
| B20 5.2, 3.7 | The practitioner is ultimately responsible for the AI tools they use, with accountability for errors clearly defined. | The signer is recorded on every note. Signed notes cannot be changed; corrections are separate dated addenda by a named therapist. Supervised practitioners' notes need the supervisor's approval of that exact version before signing.Session note, Addenda, Review |
|
| B20 5.4 | Avoid over-reliance on AI that undermines independent judgement. | Each drafted sentence links to the transcript moment it came from, so the therapist checks the source rather than trusting the draft. Sentences the checker cannot support are flagged.Session note, source links |
|
| B20 4.1, 4.2 | Use only tools that are not secret, are fit for purpose, and can be explained to patients, including limitations and risks. | PPM names the models it uses (Whisper for transcription, an open-weight language model for drafting) and publishes what they do, what they do not do and their known limitations on this site.Public site, “The AI” |
|
| B20 6.2 | Patients must be told when AI assisted, and patients who decline AI may not be disadvantaged or refused services. | Separate, versioned consents for session recording and for AI processing. A therapist can always write a note manually, so declining changes nothing about care. A practice setting can block recording without consent.Client, Consents; Settings |
|
| B20 6.3, 6.7 | Before AI is used, disclose its capabilities, limitations and bias safeguards; information on how it works available on request. | Plain-language explanation on this site. A one-page client information sheet for the practice to hand out is being written. |
|
| B20 3.8, 10.1, 10.2 | Protect patient health information against improper disclosure, unauthorised access and inappropriate use. | Recordings and records are stored in South Africa. Transcription and drafting run on PPM's own hardware in South Africa, with no overseas AI provider. Each practice's data is isolated at database level, and every change to a client record is logged. |
|
| B20 12.2 | Platforms in South Africa should meet the applicable law, including POPIA and PAIA. | See the POPIA table below. A PAIA manual for MDB TechWorks is being prepared. |
|
| B20 4.6, 14.1 | AI in a medical device must meet SAHPRA requirements; choosing the right tool is the practitioner's responsibility. | PPM is a documentation and administration tool. It does not diagnose, recommend treatment or analyse clinical measurements. Our position is that it is not a medical device; this is part of the legal review. |
|
| B20 8.1, 8.2 | Practitioners keep the skills to use AI safely, including its limits and privacy implications. | Onboarding for each practice covers how drafts are made, their limits and how to check them. |
|
HPCSA Booklet 9: Guidelines on the keeping of patient records (2016)
| Rule | What it requires | What PPM does, and where | Status |
|---|---|---|---|
| B9 4.1 | Records include the patient's particulars, date, time and place of each consultation, assessment and management, referrals, and written proof of informed consent. | Client profiles, sessions with date and time, notes per session, referral sources, and consent records with the signed form attached.Clients, Calendar, Sessions, Consents |
|
| B9 8.1 to 8.4, 13.5 | Nothing may be removed from a record. Corrections keep the original legible and are dated and signed. Later additions are dated and signed. | Signed notes are locked by the database. Corrections are dated addenda by a named therapist. Every version of a note is kept and cannot be edited or deleted. Records are soft-deleted only, never erased.Session note, Addenda, Version history |
|
| B9 9.2, 9.3.1 | Keep adult records at least 6 years after they become dormant; keep minors' records until their 21st birthday. | Each practice's settings hold a retention period (6 years) and a minors' rule (until age 21). Nothing is hard-deleted today. Automatic retention scheduling and legal holds for medico-legal matters are being built.Settings, Data retention |
|
| B9 9.3.2, 9.4, 9.8 | Mentally incompetent patients: keep for life. Occupational health records: 20 years. Statutory periods override. | Additional retention categories, and which apply to functional capacity and medico-legal work, are part of the legal review. |
|
| B9 9.1, 12.1 | Store records safely, protected by passwords and encryption, with a separate backup that can be compared if tampering is suspected. | Password sign-in, encrypted connections, encrypted nightly backups held off-site, and a content fingerprint stored with every note version so tampering can be detected. |
|
| B9 11.1 | Patients may access their records; guardians may apply for children under 16 with the child's written consent. | A record export request is built in, logged and time-limited.Client, Export |
|
Protection of Personal Information Act, 2013 (POPIA)
| Rule | What it requires | What PPM does, and where | Status |
|---|---|---|---|
| s26, s27, s32(1)(a), s32(2) | Health information is special personal information. Health professionals may process it for proper treatment and care, under a duty of confidentiality. | PPM processes client information only for the practice, inside the practice's own isolated space. Everyone at MDB TechWorks with system access will sign a confidentiality undertaking. |
|
| s19 | Secure the integrity and confidentiality of personal information with reasonable technical and organisational measures. | Per-practice database isolation, role-based access, audit logging of every change, encrypted connections, encrypted backups. An independent security review is scheduled before go-live. |
|
| s20, s21 | An operator processes only with the responsible party's authority, under a written contract that requires security measures. | PPM acts as the practice's operator. A written operator agreement is being drafted with our attorney. |
|
| s22 | Notify the Information Regulator and affected people of a security compromise as soon as reasonably possible. | A written breach response plan, with the audit log as its evidence trail. |
|
| s14 | Do not keep records longer than needed, unless the law or a legitimate purpose requires it. | Retention settings per practice, aligned to HPCSA Booklet 9; soft delete with retention; hard delete only after the period ends and no legal hold applies. |
|
| s23, s24 | People may ask for their information and for corrections. | Record export requests; corrections to signed notes as dated addenda, so the original stays visible. |
|
| s34, s35 | Children's information needs the consent of a competent person, normally a parent or guardian. | Guardian details on the client file; each consent records who signed and their relationship to the client. Photos of children are treated as the most sensitive data in PPM. |
|
| s71 | No decision with legal or significant effects based solely on automated processing. | PPM makes no automated decisions about clients. The AI drafts; a therapist decides and signs. |
|
| s72 | Personal information may leave South Africa only on the grounds in section 72. | Records, recordings, transcripts, files and AI processing are in South Africa. Exceptions are listed openly in “Where your data lives” below and are part of the legal review. |
|
| s55, s56 | Each responsible party has an Information Officer registered with the Information Regulator. | MDB TechWorks will register its Information Officer. Each practice remains responsible for its own registration. |
|
| Health information regulations (March 2026) | Extra rules for insurers, medical schemes, employers and similar bodies under s32(1)(b) to (f). | These target bodies such as insurers and employers rather than treating practices. PPM's safeguards already follow their direction (confidentiality, security, cross-border limits). |
|
Medico-legal work: Uniform Rules of Court, rule 36(9)(b)
| Rule | What it requires | What PPM does, and where | Status |
|---|---|---|---|
| Rule 36(9)(b), as amended from 19 June 2023 | An expert's summary of opinion must be compiled by the expert personally, in their own words, with a statement of truth. | For medico-legal work PPM extracts and organises what was said, with verbatim quotes and timestamps. It does not write the expert's opinion or the report narrative. |
|
Where your data lives
| What | Where | Notes |
|---|---|---|
| Client records, notes, consents, files and recordings | South Africa (Softechware, Gauteng) | Primary database and file storage. |
| Transcription and note drafting | South Africa | PPM's own hardware. No overseas AI provider. |
| Web application hosting | Vercel, currently Frankfurt (web) and US East (API) | Moving to Vercel's Cape Town region before the first real client. |
| Encrypted nightly backups | Cloudflare R2, Europe | Encrypted before they leave. Part of the section 72 legal review; a South African backup location is being evaluated. |
| Error monitoring | Sentry, outside South Africa | Client information is stripped from error reports before they are sent. |
| Phone notifications | Google Firebase | Notifications never contain client names or clinical details. |
What is still outstanding before the first real client
- Attorney review of PPM, the operator agreement, consent wording and retention periods.
- Client information sheet on AI use.
- Recording consent enforcement switched on for every practice.
- Breach response plan and Information Officer registration.
- Independent security review.
- Automated retention with legal holds.
- Web hosting in South Africa, and a decision on backup location.
Sources
- HPCSA, Ethical Guidelines on the Use of Artificial Intelligence, Booklet 20, September 2025
- HPCSA, Guidelines on the Keeping of Patient Records, Booklet 9, 2016
- Protection of Personal Information Act 4 of 2013
- Bowmans, POPIA health information regulations, March 2026
- Uniform Rules of Court, rule 36(9)(b), as amended by GNR 3397, Government Gazette 48571, effective 19 June 2023.
Last reviewed: 23 October 2026.