1. Who we are, and our role
TitionersHub ("we", "us") is practice management software for physiotherapists, biokineticists, massage therapists, personal trainers and similar practitioners. It is operated by Luan Els, a sole proprietor in Cape Town, South Africa, and is available at titionershub.com, in the desktop apps and in the mobile app.
We have two roles under the Protection of Personal Information Act, 4 of 2013 (POPIA):
- For practitioners' own account information and for visitors to our website, we are the responsible party.
- For information about a practice's clients or patients, the practice is the responsible party and we are its operator: we process that information only on the practice's instructions, to provide TitionersHub to them. Our obligations as operator are set out in section 7 of our Terms of Service.
2. Who this policy covers
- Practitioners and their staff who use a TitionersHub account
- Clients and patients of those practices — whether the practice entered their details, or they registered themselves by scanning a practice's QR code, booked online, or used the client portal
- Visitors to titionershub.com
3. Information we collect
3.1 Practitioners
- Name, email address and password (stored only as a secure hash)
- Practice name, address, phone, practice and VAT numbers, qualifications, banking details and payment links you choose to print on invoices
- Subscription and payment status (card payments are handled by Paystack; we never see or store card numbers)
- Your settings: rates, packages, working hours for online booking, calendar connection
3.2 Clients and patients (health information — processed for the practice)
- Name, date of birth, gender, phone number and email address
- Medical aid name, member and authorisation numbers, referring practitioner
- Condition, ICD-10 diagnosis codes, clinical notes and documents the practitioner uploads
- Bookings, attendance, sessions, pain scores, exercise programmes and messages with the practice
- Invoices, packages and payments
3.3 Technical information
- A record of each time a client's information is viewed through the client portal, so the practice can see who accessed it
- IP addresses, kept briefly to limit repeated sign-in attempts and protect accounts
- Error reports when something in the app fails, so we can fix it
4. How we use it
- To run TitionersHub for the practice: records, bookings, programmes, invoices and reports
- To send messages for the practice: appointment reminders, invoices the practitioner chooses to send, and notices to the practitioner of online bookings and cancellations
- To manage practitioners' accounts and subscriptions, and send account emails such as the welcome email
- To keep the service secure and working, and to answer support requests
We do not sell personal information, use it for advertising, or share client information with anyone other than the service providers below.
5. Lawful basis
We process practitioners' information to perform our agreement with them, to meet legal obligations (for example tax records), and for our legitimate interest in keeping the service secure. Clients' health information is processed by the practice under the POPIA provisions that allow health professionals and their operators to process health information for care and administration, or with the client's consent. The practice is responsible for having a lawful basis and, where needed, the client's consent.
6. Service providers we use
These providers process information for us, under agreements that require them to protect it:
Supabase
Database, sign-in and file storage. Holds all practice and client records.
Netlify
Hosts the website and app. Handles web traffic; does not store client records.
Resend
Sends email: account emails to practitioners, appointment reminders to clients, and online-booking notices to practitioners (which include the client's name and appointment time).
Paystack
Takes practitioners' subscription payments. No access to client records.
Groq
Powers the AI Co-pilot. It receives the practitioner's question and, if a client is chosen, an anonymous summary — condition, programme week, latest pain score and number of sessions. Names, contact details, dates of birth and ID numbers are never sent. Practitioners should not type them into the Co-pilot either.
Google
Only if a practitioner connects Google Calendar: booking times and rooms are copied to their calendar, and client names only if they switch that on.
When a practitioner sends an invoice through WhatsApp or their own email, or a client pays through the practice's Yoco, SnapScan or Zapper link, that happens in those services under their own terms. TitionersHub never receives or holds clients' money.
7. Information stored outside South Africa
Some of our service providers store or process information outside South Africa. We use them only where they are bound by data-protection terms that give protection substantially similar to POPIA, as section 72 of POPIA requires.
8. How long we keep it
- Client and patient records are kept for at least six years after the last treatment, and for clients who were under 18, until they turn 21 — in line with the HPCSA's guidelines on keeping patient records. Archiving a client hides them from day-to-day use; it does not delete them.
- Records are permanently deleted only on the practice's instruction and once the required period has passed.
- Practitioner account information is kept while the account is active and for two years afterwards, and invoices for five years as tax law requires.
- Sign-in attempt records are deleted after two days.
9. How we protect it
- All connections are encrypted (HTTPS), and stored data is encrypted by our database provider
- Each practice's records are walled off from every other practice at database level
- Clients sign in to their portal with their own code and date of birth; repeated wrong attempts are blocked
- Every portal view of a client's record is logged
- On the desktop app, information kept for offline use is encrypted with the computer's own secure keychain; in a browser, only non-sensitive fields are kept
- Banking details are hidden on screen until deliberately unlocked
10. If something goes wrong
If we become aware that personal information has been accessed or acquired by someone not authorised to, we will tell the affected practices as soon as reasonably possible, so they can notify the Information Regulator and the people affected as POPIA requires. Where we are the responsible party, we will notify them ourselves.
11. Your rights
- Access — ask what information is held about you, and for a copy
- Correction — ask for inaccurate information to be corrected
- Deletion — ask for information to be deleted, subject to the retention periods above
- Objection — object to processing in certain circumstances
- Complaint — complain to the Information Regulator
Clients and patients: your practice controls your records, so please contact them first. We will help them respond. Practitioners and visitors: email titionershub@gmail.com. We respond within 30 days.
12. Children
Practices may keep records for clients under 18. The practice is responsible for obtaining consent from a parent or guardian where POPIA requires it.
13. Cookies and browser storage
We use only what the app needs to work: keeping you signed in, remembering your settings, and an offline copy of your client list. We do not use advertising or tracking cookies, and we do not use third-party analytics.
14. Information Regulator
Information Regulator (South Africa) · inforegulator.org.za · enquiries@inforegulator.org.za · 010 023 5200 · toll-free 0800 017 160 · Woodmead North Office Park, 54 Maxwell Drive, Woodmead, Johannesburg, 2191
15. Changes to this policy
We will tell practitioners by email about material changes before they take effect, and update the date at the top of this page.
Email: titionershub@gmail.com
Information Officer: Luan Els · Cape Town, South Africa