Privacy policy

1. What this covers

This policy explains how SecureSlip collects and processes personal information when you engage us to prepare a SARS medical expense supporting-documents pack, and how we handle the special personal information (medical and financial records) that involves.

2. What we process

To prepare your pack, we process, on your behalf:

• identity numbers, member numbers and contact details for you and your dependants;
• medical information: invoices, pharmacy dispensing records, medical scheme certificates and claims extracts (special personal information under section 26 of POPIA);
• financial information: bank and credit-card statements showing payment.

This is processed solely to prepare your supporting-documents pack. Nothing is sold, shared, or used for any other purpose.

3. How it’s processed

Document reading and reconciliation runs on private, on-device AI on our own hardware. Your documents are never sent to a cloud AI provider to get a claim put together. Data at rest is protected by full-disk encryption, and each client’s data is kept in its own directory with access limited to the operator.

4. Optional cloud escalation

By default, everything is processed locally. A document the local models can’t read is queued for you or the operator to sort out manually. It is never quietly sent elsewhere. If we ever ask to send a specific unreadable document to a named external AI service instead, that needs your explicit, separate consent for that document, and it’s logged.

4b. If you send us paper

If you choose paper intake, your originals are logged on arrival, stored locked while we work, and couriered back to you with your pack. The same delete-or-archive choice you make for your digital files applies to our scanned copies.

5. Retention

After your filing season closes, the choice is yours. We either delete everything we hold (documents, pack and processing caches), or archive the final pack and source documents, encrypted, for an agreed period in case SARS asks questions later. After that period it’s erased.

6. Your rights

Under POPIA you can request access to, correction of, or deletion of your personal information, and you can lodge a complaint with the Information Regulator. Contact us using the details below for any of these requests.

7. Breach notification

We acknowledge the duty under POPIA section 22 to notify the Information Regulator and affected clients of any compromise of personal information as soon as reasonably possible.

8. Questions

This is a working policy for an operator-assisted service, not a substitute for formal legal advice. If anything here is unclear, or you want more detail on how your specific documents are handled, contact hello@secureslip.com.