Who we are
Drop Doctor (Pty) Ltd (registration number 2025/521876/07), trading as DropDr, operates the website at drop-dr.com and the DropDr mobile applications. We are the responsible party for the personal information described in this notice.
Our registered address is 1st Floor, Office 2, 96 Jorissen Street, Braamfontein, Johannesburg, 2001, South Africa. Our Information Officer can be contacted at dropdoct@gmail.com.
Healthcare professionals who consult with you through DropDr are independent practitioners. They are responsible parties in their own right for the clinical information they record about you, and they carry their own obligations under the Protection of Personal Information Act 4 of 2013 (POPIA) and under the rules of their registering body.
What this notice covers
This notice covers two different things, and the distinction matters:
- This website. A public marketing site. It collects very little, and it should never be used to send health information.
- The DropDr applications. Where accounts, consultations, prescriptions and records live. This is where health information is processed, and where the protections described below apply in full.
If you are reading this because you are about to type something sensitive into a form on this website, please do not. Book a consultation in the app instead.
Information we collect
From this website
- Information you submit through an enquiry form: your name, email address, enquiry type, organisation, professional details where relevant, and the content of your message.
- Essential technical information required to serve the site securely, including your IP address in server logs.
- Analytics information, only if you choose "Allow analytics" on the cookie banner.
In the DropDr applications
- Account information — name, mobile number, email address, date of birth, gender and profile photograph.
- Identity verification information — a government-issued identity document and a photograph confirming it is you, where you request a home visit.
- Location information — the address and map location you provide for a home visit, and approximate location where you search for nearby professionals.
- Health information — symptoms you describe, consultation notes recorded by the treating professional, prescriptions, laboratory requests and results, and documents issued to you.
- Transaction information — bookings, payments, refunds and wallet activity. Card details are handled by the payment provider, not stored by DropDr.
- Communications — messages exchanged with a professional through the platform, and notifications sent to you.
- Technical information — device type, operating system, app version and log data needed to operate and secure the service.
For healthcare professionals, we additionally collect qualifications, professional registration details, practice information, service areas, published prices and banking details for settlement.
Health information
Health information is "special personal information" under section 26 of POPIA and is subject to a higher standard of protection. We process it on the bases permitted by section 32, principally that it is necessary for the provision of medical care by a healthcare professional, and with your consent.
- Health information is processed inside the DropDr applications, not through this website.
- It is visible to the healthcare professional you consult, and to you.
- Other professionals see it only where you grant them access.
- Access to records is logged.
- Video consultations are not recorded by default. The clinical record is the professional's notes and the documents issued.
- Health information is never sold, rented, or used for advertising.
Why we process information
We process personal information to:
- Create and administer your account and verify who you are.
- Let you find, compare and choose a healthcare professional.
- Arrange, deliver and record consultations and home visits.
- Process payments, refunds and settlement to professionals and partners.
- Carry prescriptions to the pharmacy you choose and laboratory requests to the laboratory you choose, and return results.
- Send you notifications, reminders and service messages.
- Verify professional credentials and registration before activating a profile, and monitor that registration remains current.
- Detect, investigate and prevent fraud, abuse and security incidents.
- Comply with legal obligations, including record-keeping and reporting duties.
- Improve the service, using aggregated or de-identified information wherever possible.
Who we share information with
We share personal information only as far as the task requires:
- The healthcare professional you choose — the information they need to consult with you safely.
- The pharmacy you choose — the prescription, the prescribing professional's details and the minimum patient details required to dispense. Not your wider medical history.
- The laboratory you choose — the test request and the details required to collect a sample and return a result.
- Payment providers — to process payment, refunds and settlement.
- Service providers — hosting, communications, security and support providers who act on our instructions under written agreements.
- Authorities — where we are legally obliged to disclose, including reporting obligations under the Cybercrimes Act 19 of 2020.
We do not sell personal information. We do not share health information for marketing.
Your rights
Subject to applicable law, you may:
- Ask what personal information we hold about you.
- Ask us to correct information that is inaccurate or incomplete.
- Ask us to delete information, subject to retention obligations that override the request.
- Object to processing in certain circumstances.
- Withdraw consent where processing relies on consent — noting that some processing is necessary to provide the service at all.
- Complain to us, and then to the Information Regulator if you are not satisfied.
To exercise any of these, contact our Information Officer at info@drop-dr.com. We may need to verify your identity before we act, precisely because acting on an unverified request would itself be a breach.
Retention and deletion
We keep personal information only as long as necessary for the purpose it was collected for, or as required by law. Health records and financial records carry statutory retention periods that are longer than most people expect, and those periods override a deletion request.
When you delete your account, your information is deactivated and placed beyond ordinary access. It is not immediately erased from every system: transaction records, clinical records and audit logs are retained for the periods the law requires, including so that evidence is preserved where a lawful request is later made under the Cybercrimes Act.
Security
- Encryption of personal information in transit and at rest.
- Role-based access control, so that people and systems see only what their function requires.
- Audit logging of access to records.
- Secure authentication, including one-time verification of mobile numbers.
- Written agreements with service providers who process information on our behalf.
- Incident response procedures, including notification to the Information Regulator and to affected people where a breach is reportable, and reporting to the South African Police Service where the Cybercrimes Act requires it.
No system is perfectly secure. If you believe your account has been compromised, contact us immediately at info@drop-dr.com.
Children
An account holder must be 18 or older. A parent or legal guardian may arrange care for a child using their own account, and remains responsible for the information they provide about that child. Information about children is treated with the additional care POPIA requires.
Changes to this notice
We may update this notice as the service develops or as the law changes. The date at the top of this page shows when it was last updated. Material changes will be brought to your attention through the service.
Questions about this notice can be sent to info@drop-dr.com.