Patient Portal — Privacy Notice

Patient Portal — Privacy Notice

This notice matches the privacy statement shown inside the portal itself, and the two are kept consistent.

This notice explains how your information is protected when you use the patient portal your clinic invited you to. Your clinic is responsible for your health information; SideClick operates the delivery service on your clinic's behalf and — as explained below — cannot read what passes through it.

1. Sealed envelopes: how your information travels

Everything your clinic shares with you is sealed to a private key that exists only on the device you set up. The server that moves messages between you and your clinic stores sealed envelopes it cannot open — it never holds your health information in a readable form, and neither do we.

2. What the delivery service can see

What that server can see is delivery information: that your portal account exchanged sealed envelopes with your clinic, when, and how large they were — much like a postal service sees addresses and parcel sizes but not contents. It never sees your name, your records, or anything inside the envelopes.

In detail, the delivery service keeps: a random account identifier (not your name — the link between the identifier and you exists only inside your clinic's own encrypted records), the technical keys needed to route sealed envelopes to your device, the sealed envelopes themselves with their dates and sizes, and standard connection records in which your network address is stored only in a scrambled (one-way-hashed) form.

3. What is visible by design

Two things your clinic may choose to publish are readable, because they must be: the clinic's open appointment slots (appointment types, times and durations — never patient information), and any calendar feed your clinic publishes for its own diary, which is stripped of patient details before it leaves the clinic.

4. On your device

The portal keeps its keys and sign-in state in your browser's storage on your device. It sets no advertising or analytics trackers. Anyone who can unlock your device and browser could open your portal — please keep them secure, and add a passkey if offered.

If your clinic hands you one of its own devices to fill in a form at the front desk, that is the clinic's device and part of the clinic's own records system: nothing about you is kept on it for the portal, and the clinic is responsible for what you enter there.

5. If you lose your device or clear your browser

Nothing is lost and nothing is exposed: your clinic keeps the originals, turns off the old access, and sends you a fresh invitation. The sealed envelopes on the server remain unreadable without your device's key.

6. Your rights

Your rights over your health information — to see it, correct it, or ask for it to be deleted — are exercised with your clinic, which holds the readable records. The privacy law of your country gives you these rights, and your clinic's own privacy notice explains how to use them. For questions about the delivery service itself: privacy@sideclick.io.

---

SideClick (Pty) Ltd · privacy@sideclick.io Version 1.1 · Published 2026-09-12