Privacy & compliance
What we do with information, stated plainly.
MULO holds clinical and operational information on behalf of healthcare practices. That carries obligations under the Protection of Personal Information Act, 2013 (POPIA), and a simpler one besides: to say clearly what we do, rather than to say as little as possible.
01 · Privacy & POPIA notice
Who is responsible for what
Under POPIA, the practice using MULO is the responsible party for its patients' personal information. MULO acts as an operator: we process that information on the practice's instruction, for the purposes the practice sets, and not for our own.
For information you give us directly — a demonstration request, an email, a support conversation — MULO is the responsible party.
What we hold
- Patient information entered by the practice: identity and contact details, medical scheme and cover details, visit records, clinical notes, coding, documents and consents.
- Billing information: claims, remittances, balances and related correspondence.
- Practice user information: names, roles, work contact details and a record of actions taken in the system.
- Enquiry information: what you send us through the demonstration form or by email.
Why we process it
To operate the service the practice has asked us to operate: running the practice's day, supporting verification, assembling and tracking claims, reconciling payments and keeping the record intact. We also process a limited amount of technical information to keep the service secure and available.
We do not sell personal information. We do not use patient information for advertising. We do not use identifiable patient information to train models. [CONFIRM: any product analytics or de-identified use]
How long we keep it
Clinical records are retained for the periods the practice is required to observe under the Health Professions Council of South Africa's guidance and the National Health Act — generally not less than six years from the last entry, and longer for minors and for certain categories of record. The practice sets the retention position; MULO does not delete clinical records on its own initiative.
Enquiry information sent through this website is kept for [PERIOD TO CONFIRM — suggested: 24 months] and then deleted.
Your rights
You may ask what personal information is held about you, ask for it to be corrected or deleted, object to processing, and complain to the Information Regulator. If you are a patient, the practice holds your record — please ask the practice first, and they can ask us. If a request reaches us directly, we will pass it to the practice and tell you that we have.
Information Regulator (South Africa): complaints.IR@justice.gov.za · inforegulator.org.za
02 · Practice data processing
This section applies to practices using MULO and forms part of the operator arrangement between the practice and MULO.
Where information is held
Practice data is hosted with [HOSTING PROVIDER AND REGION TO CONFIRM]. Where information is processed outside South Africa, we rely on the transfer conditions in section 72 of POPIA.
Who else touches it
A short list of operators supports the service — hosting, backup, email delivery and error monitoring. Each is bound by contract to process information only on our instruction:
- [SUB-OPERATOR — purpose, country]
- [SUB-OPERATOR — purpose, country]
We will tell practices before we add an operator that processes patient information.
Security
Information is encrypted in transit. Access is controlled by role. Work against a record is attributable to a user. Backups are taken on a defined schedule. [CONFIRM: encryption at rest, backup frequency and restore testing, breach notification process and timeline]
Taking your data out
On request, a practice can obtain its patient and billing records in a standard, readable format, during the agreement and at its end.
03 · Terms of service
MULO is supplied to healthcare practices under a written agreement. That agreement governs pricing, service levels, support, term and termination, and it takes precedence over anything on this website.
MULO supports the administration and record-keeping of a practice. It does not provide medical advice, does not make clinical decisions, and does not replace the professional judgement of a registered healthcare practitioner. Responsibility for clinical decisions, for the accuracy of what is recorded, and for compliance with professional and statutory obligations remains with the practice and its practitioners.
MULO is not an emergency service. In an emergency, contact emergency services directly.
[CONFIRM with your attorney: liability, warranties, service levels, governing law]
04 · Acceptable use
Access to MULO is issued to named individuals authorised by the practice. Accordingly:
- Credentials are personal and must not be shared.
- Access must be used only for the practice's own legitimate purposes.
- Patient information must not be extracted for any purpose the practice is not entitled to.
- Practices must tell us promptly if a device is lost or an account may have been compromised, so access can be withdrawn.
- Attempts to probe, scan or interfere with the service are not permitted.
05 · Cookie notice
This website sets no advertising or tracking cookies, and loads no third-party fonts, scripts or pixels. The only information it collects is what you type into the demonstration form and send us deliberately. Standard web server logs — IP address, time and page requested — are kept by our host for security and troubleshooting.
The client access environment uses a strictly necessary session cookie to keep you signed in. It carries no advertising or profiling function and cannot be switched off without preventing sign-in.
06 · Access to information (PAIA) & contact
Requests for access to records held by MULO may be made under the Promotion of Access to Information Act, 2000. Our PAIA manual is available on request.
For privacy, compliance, access requests and general enquiries, write to hello@mulohealth.co.za. We reply within one working day and will tell you if a request needs to go to the practice instead.
MULO is operated by Galdea Holdings (Pty) Ltd, registration 2022/564057/07, Regus Cradlestone Mall, corner Hendrik Potgieter and Furrow Road, Krugersdorp, Gauteng.
This page is a plain-language statement of position rather than legal advice, and it has not yet been reviewed by an attorney. Items marked in red must be confirmed or replaced before this page is published.