Privacy Policy

SideClick Privacy Policy

This policy is written to match what the systems actually do and is kept consistent with the in-app Privacy & Data Protection Notice.

1. Scope — two very different kinds of data

Patient and clinical data is not covered by this policy, because we designed the product so we don't have it. Clinical records live in an encrypted database on each of the practice's own devices, and every entry is sealed on the device before it goes to our sync server, which keeps only sealed content we cannot read. For that data, the practice is the party responsible under the privacy law that applies to it, and we act as its zero-knowledge processor, operator or business associate under the instruments linked from the Terms of Service §12. Patients should read the plain-language patient portal privacy notice and their own practice's privacy notice.

This policy covers what SideClick itself is responsible for: information about our customers, account holders, website visitors, and correspondents.

2. Who we are

SideClick (Pty) Ltd, a South African company. Registration number 2026/655265/07. Registered office: 175 Neptune Way, Olympus, Pretoria, 0081. Data-protection contact: privacy@sideclick.io. Information Officer (POPIA): Franco De Beer, franco@sideclick.io.

3. What we collect, and why

What	Source	Why (lawful basis)
Name, email, edition and seat count, subscription period, payment-processor customer and subscription identifiers	Creem (merchant of record) purchase notifications	Put the seats you bought on your account and keep them in step with your subscription (performance of contract)
Your account on the sync server: the email address you sign up with (verified by a message to it), the name of the practice you set up (if you set one up), a value derived from your password that lets the server check it (never the password itself), your public keys, your private keys sealed under your password and under your recovery code (which we cannot open), and, if you turn on an authenticator app, its secret	You, at sign-up and in the app	Provide the account, sign-in and your seats (contract)
Your devices: for each device you sign in on, its device keys, the name of its operating system, the name the operating system gives it (sealed so that only your own devices can read it), a non-reversible hash of its machine identifier and install path, and when it connected and was last seen	The app, at sign-in	Your list of devices, approving a new one from another, the device limit per seat (contract; legitimate interest)
Support, security-report and feedback correspondence	You	Responding to you (legitimate interest; contract)

What we never receive: your password, your recovery code, card numbers, billing addresses and tax details. Card and billing details are collected and held by Creem (Armitage Labs OÜ, Estonia), the merchant of record, on its own checkout and billing pages, under its privacy notice. When you buy, you give Creem your name, email and billing address; Creem processes them for us under its data-processing agreement (it is listed in the sub-processor register) and, as the seller of record for the payment itself, keeps the invoicing and tax records its own obligations require. We also never receive patient data, clinical content, or usage analytics (§5).

What we can never recover: the keys that open practice data exist only on your devices, in your password and recovery code, and in the sealed copies wrapped for the people who may open each record. Because we never receive them, we cannot read your data — and we also cannot restore it if every copy of that material is lost. There is no vendor-side reset or escrow (EULA §7.6).

Website: the marketing site is static. It sets no cookies, uses no analytics or tracking, and requires no account (see the Cookie Notice). Our hosting infrastructure keeps standard web-server access logs for 30 days.

4. The sync server: what it holds and what it can see (processor role)

Every entry you write is sealed on your device and sent to our sync server, which keeps it — that is how the entry reaches your other devices and the people you work with, and how any device can be rebuilt after sign-in. The server holds the sealed entries (notes, bookings, invoices, payments, photos and voice memos), the key of each patient file and of each entry wrapped for every person who may open it, and the structure of your practices: which accounts belong to which practice and clinic, in which role and, where a membership has an end date, until when; invitations; grants and their end dates; which copies were sent to whom and when; and the retention number of the practice and of each person. None of this is readable to us.

What the server necessarily observes is delivery metadata. The sync server can see which sign-in sent each sealed entry, when, and which sealed file it belongs to — never the patient's name or what the entry says. It also sees the size of each sealed entry, push-notification subscriptions (browser push endpoints, or Apple device tokens for the iPhone companion), connection records with hashed network addresses, and, under each subscription, the seats handed out and the storage used (storage is included in the subscription; every sealed entry and every photo and voice memo counts). Patient portal identities on the server are random identifiers; the link between an identifier and a person exists only inside the practice's encrypted database. The precise inventory, and our obligations for it, are in the Sync Server DPA Annex A.

What SideClick's own staff can see is the account email, the subscription, its seats, the storage used and the number of devices — never a record.

5. What the desktop and mobile apps send us: almost nothing

The apps are engineered for local-first operation and contain no telemetry, analytics, or crash reporting. The complete list of network calls the apps can make to anyone:

1. Sign-up and sign-in (§3) — the account and device data above, to our sync server. There is no key to type and no separate activation request: your seat is held on the sync server with your account, and each device learns it at sign-in and keeps working on what it last knew.
2. Updates — on store platforms (Microsoft Store, Mac App Store, App Store), the platform store delivers updates under its own terms and may collect its own installation and update telemetry, which we neither receive nor control. Where a direct (non-store) channel is used, an update check is an ordinary fetch of a static release file from our distribution host; the request carries no account or practice information beyond what any web request reveals (network address, user agent).
3. AI and speech model downloads — enabling on-device AI downloads the language model once from Hugging Face's content network; Hugging Face sees a normal download request (your network address, the model requested) under its own privacy policy. On macOS, dictation uses Apple's on-device speech framework, which downloads its speech model from Apple once, on first use, under Apple's terms. All AI inference and all speech recognition then run entirely on your device; recordings and clinical text never leave it. The iPhone companion ships no AI model download at all.
4. Sync server traffic (§4) — every entry, sealed on the device before it leaves. The phone companion also uploads sealed captures (photos, voice memos, pending changes) in the background while the phone is locked — the same sealed traffic, with no readable content.
5. Push notifications — if enabled, delivered via your browser's push service or the Apple Push Notification service. The payloads are engineered to be content-free (a fixed alert text and opaque identifiers, enforced by automated test); Apple sees the device's push token and delivery metadata, never your data.
6. Video-consultation links — if you store a link from a video service you chose, opening it sends your browser to that service; the app itself sends nothing to it.

6. Sharing

The parties that process personal information for us are listed in the sub-processor register: Amazon Web Services (hosting of your sealed practice data), Apple (push-notification delivery to iPhones — device tokens and content-free payloads only) and Creem (purchases — your name, email and billing details, on its own checkout and billing pages; never practice data).

Some recipients are not sub-processors: Hugging Face and Apple (as download sources your own device contacts directly for the optional AI and speech models); and the platform app stores (distributors of the apps under their own developer terms, including any store telemetry). We also disclose to authorities where the law requires. We do not sell personal information and we do not advertise with it.

7. International transfers

We are based in South Africa; customer records and the seat grants are processed on Amazon Web Services infrastructure. The sync server — your account, your devices, the sealed entries and media — is hosted in the United States (AWS us-east-1), and its backup copies are kept in a second region in the United States (AWS us-west-2, Oregon), so that a failure of one region loses nothing. A backup copy is encrypted just as the original is. Our servers keep hosted practice data only in the United States, and it moves between those two regions only as those backup copies. Push notifications to iPhones traverse Apple's infrastructure in the United States (content-free payloads — §5). Where personal information leaves your jurisdiction we rely on the safeguards your region's law provides for: standard contractual clauses or an adequacy decision for the EU and the UK, and the equivalent grounds under other laws, as set out in the regional disclosures in §13.

8. Retention

• Commercial records (purchases and seat grants): for as long as tax and accounting law requires after the relationship ends.
• Your account and device records: for as long as the account exists. You can delete the account yourself, from inside the app (§9); the copies you hold on the sync server go with it.
• Your sealed copy on the sync server: for as long as you hold a seat, and for 90 days after the last seat you held ends — readable and exportable, with no adding — with a warning on day 1, day 60 and day 83; then it is deleted. That deletion, 90 days after a subscription ends, is the one deletion our server performs on its own (the Terms of Service §5 and §7 say so); the app itself never deletes a record — a record past a retention period is listed, and the keeper chooses Keep or Delete. Every copy of a record has one keeper: the practice for the practice's record, and a person for a copy they hold — the copy they took when they left a practice, or a copy sent to them. A record leaves the server when its keeper deletes it, or under the 90-day rule when nobody with a seat still holds it; a practice's record is untouched by a person's Delete or a person's 90 days, and a person's copy by the practice's. Photos and voice memos are kept, sealed, for the life of the subscription and the 90 days after it, then go the same way. Your devices keep what is on them whatever the state.
• Support and security correspondence: 24 months after the last message.

9. Your rights

Depending on where you live, you may have rights to access, correct, delete, or restrict the personal information we hold about you, to receive a copy of it, and to object to certain processing. Ask us at privacy@sideclick.io; we answer within 30 days. You may also complain to the privacy regulator for your country — the regional disclosures in §13 name them. We never make automated decisions with legal effect about you.

Deleting your account. You can delete your account from inside the app, on any of your devices (Settings → Your devices → Delete your account), with your password typed again. You choose whether it happens in 30 days — until then nothing changes and you can cancel it on the same screen from any device — or at once. What is deleted: your account and device records, your public and sealed keys, the copies you hold on the sync server (a copy you took when you left a practice, a copy sent to you, and anything only you held, with its photos and voice memos), your seat and your subscription; every device of yours is signed out and erases the app's data the next time it connects. What stays: the entries you wrote in a practice's records stay that practice's, held for its retention period and under its owners' control, because the practice is their keeper and must keep them by law; our purchase records, for as long as tax and accounting law requires. Two things can stand in the way, and the app says so: if you are the only owner of a practice that still has other members, make someone else an owner first (the records need a keeper); if other people hold seats you pay for, release the seats first (nobody loses a paid seat because someone else deleted a login). A subscription bought on our website is cancelled for you and runs to the end of the period you have paid for; a subscription billed by Apple keeps running until you cancel it in the App Store — deleting your account does not cancel it, and the app tells you so before you confirm. We confirm the deletion by email once it is done. The email address is free to create a new account at once.

10. Security

Customer records and the seat grants are held in encrypted stores with strict access control; passwords never reach us, only a verifier derived from them; device identifiers are stored only as one-way hashes; and practice data is sealed on the device before it reaches our sync server, so that our staff cannot read it even in principle. If a security incident affects personal information, we notify affected practices and regulators under our incident-response process within the statutory deadlines that apply to each of them.

11. Children

Our website and store are aimed at healthcare professionals, not children. Patients — including minors under the care of a practice — interact with their practice's portal under the practice's own notices (portal privacy notice).

12. Changes

We will post changes here and, for material changes, notify customers by email at least 30 days in advance. This policy must always match what the software actually does; where the in-app Privacy & Data Protection Notice is more specific, the more specific statement governs. The in-app notice is versioned and maintained in lock-step with this policy — a revision of either is carried into the other in the same change.

13. Regional disclosures

United States. For practices covered by HIPAA we act as a business associate for the sync server and the portal under the Sync Server Business Associate Agreement. We do not sell personal information, we do not share it for advertising, and we use no tracking technologies on our website or in our apps.

European Union and United Kingdom. We are the controller of the information in §3 and a processor of hosted practice data under the Sync Server Data Processing Agreement. You have the rights in Chapter III of the GDPR (and the UK GDPR): access, rectification, erasure, restriction, portability, and objection. Transfers out of the EU and the UK rely on standard contractual clauses or an adequacy decision. You may complain to your national supervisory authority, or in the UK to the Information Commissioner's Office. We will publish the details of an EU or UK representative here if and when one is appointed.

Australia. We handle personal information under the Australian Privacy Principles. You may complain to the Office of the Australian Information Commissioner if we do not resolve a complaint to your satisfaction.

South Africa. We are a responsible party under the Protection of Personal Information Act and, for hosted practice data, an operator under the POPIA operator schedule. You may exercise your rights under sections 23 to 25 of the Act through privacy@sideclick.io, and you may complain to the Information Regulator (South Africa) at enquiries@inforegulator.org.za or POPIAComplaints@inforegulator.org.za.

---

SideClick (Pty) Ltd · privacy@sideclick.io Version 1.9 · Published 2026-10-26