Operator agreement

Version 1.0, in force from 11 November 2026

This agreement is between the practice that accepts it (the "practice") and Neil Cuninghame Consulting (Pty) Ltd, registration number 2014/155763/07 (the "operator"), which provides Hello by Kinilo ("Hello"). It is the written contract that sections 20 and 21 of the Protection of Personal Information Act 4 of 2013 ("POPIA") require between a responsible party and an operator. Words defined in POPIA and in Hello's terms of service have the same meaning here. On anything concerning personal information, this agreement prevails over the terms of service.

1. Roles

The practice is the responsible party for the personal information of its patients and decides why and how it is processed. The operator processes that information only on the practice's behalf, to provide Hello. For the personal information of the practice's own users (names, emails, roles, sign-in records), the operator is a responsible party in its own right, as Hello's privacy policy explains.

2. What is processed

The categories of people, information and processing are set out in Schedule 1. All patient information in Hello is treated as special personal information about health under section 26 of POPIA, whatever a particular message says.

3. Only on the practice's instructions

The operator processes patient information only on the practice's documented instructions. The practice gives those instructions through the settings, connections, message wording and automations it chooses in Hello, through the principal owner's written requests, and through this agreement. The operator will tell the practice at once if it believes an instruction would break POPIA or another law, and need not carry it out until the practice confirms it in writing or withdraws it.

The operator does not use patient information for its own purposes. It does not sell it, use it for advertising, combine it with any other practice's information, or use it to train any artificial intelligence model. Two kinds of processing happen only on a separate, recorded instruction from an owner: importing earlier WhatsApp chat history when a number is connected through Meta's coexistence route (that history may include chats that are not with patients, and the practice decides whether it is brought in), and opening read-only support access, which lasts only for the period the owner chooses and is recorded in the practice's Activity log.

4. Confidentiality

The operator treats all patient information as confidential, in line with section 14 of the National Health Act 61 of 2003 and the ethical rules of the HPCSA and AHPCSA on confidentiality. Every person who processes it for the operator, whether employee, contractor or person acting on the operator's behalf, is bound by a written duty of confidentiality that continues after their work ends, and has completed the operator's data protection training. No one at the operator has standing access to patient information.

5. Security measures

The operator maintains the technical and organisational measures in Schedule 2, as section 19 of POPIA requires, and reviews them at least once a year and whenever Hello changes how it handles personal information. It may change them, provided the overall level of protection does not fall. The practice is responsible for the security of its own devices, email accounts and users' sign-ins, for how long it lets its users stay signed in, and for choosing whether to make two-step sign-in compulsory for its team.

6. Sub-operators

The practice authorises the operator to use the sub-operators listed in Schedule 3 and on the sub-operators page. The operator will give the practice at least 30 days' notice by email before adding or replacing a sub-operator that processes patient information. If the practice objects on reasonable data protection grounds and the parties cannot resolve it, the practice may end the agreement before the change takes effect without any charge for the period after it. The operator binds every sub-operator to terms that protect personal information at least as well as this agreement, and remains responsible to the practice for what each sub-operator does.

Meta Platforms, Inc. carries WhatsApp messages under its own agreement with the practice. The connected systems the practice chooses, such as Cliniko or Bookem, are the practice's own operators, not the operator's.

7. Information outside South Africa

Each practice's database and backups are held by Cloudflare inside the European Union. Schedule 3 shows which sub-operators are based in, or may process information in, other countries. The operator relies on section 72(1)(a) of POPIA, through the law of the European Union and the binding data processing terms of each sub-operator. The operator will not move practice databases or backups outside the European Union or South Africa without 30 days' notice under clause 6.

8. Security compromises

If the operator has reasonable grounds to believe that patient information has been accessed or acquired by an unauthorised person, it will notify the practice immediately, as section 21(2) of POPIA requires, and in any event within 24 hours of forming that belief. The notice goes by email to every owner of the practice and says what is known: what happened, when it was discovered, what information may be involved, what has been done, and what the practice should do next. The operator will not wait for an investigation to finish before giving notice, and will send updates as more is known.

The operator will give the practice everything it reasonably needs to notify the Information Regulator and its patients under section 22, including a draft notice to patients. It will not contact patients or the Regulator about the practice's patients unless the practice asks it to or the law requires it. Where the compromise was caused by the operator's breach of this agreement, the operator bears the reasonable cost of notifying the patients affected.

9. Requests from patients and the Regulator

Hello lets the practice see, download, correct, stop messages to and erase a patient's information. If a patient or anyone else sends the operator a request about a patient's information, the operator will forward it to the practice's owners within two working days and will not answer it itself unless the practice asks. The operator will help the practice respond to any request, complaint, inspection or enforcement notice from the Information Regulator concerning Hello.

10. The practice's undertakings

The practice confirms the warranties in clause 8 of the terms of service: that it has a lawful basis under sections 26 to 33 of POPIA and sections 14 and 15 of the National Health Act for the information it gives Hello; that patients have agreed to receive WhatsApp messages from it; that a competent person has consented for patients under 18; that promotional messages comply with section 69 of POPIA; that its staff are bound by confidentiality; and that it has told its patients how it uses Hello. The practice will keep its own clinical record of any message that forms part of a patient's care.

11. Private conversations

A practitioner or owner may mark a patient's conversation as private, so that reception cannot read it, while reception still manages that patient's appointments. The practice's owners can read private conversations of the practitioners they oversee. The practice decides who in it may read which conversations, and is responsible for telling patients of practitioners who use private conversations who reads their messages.

12. Backups and restores

The operator backs up the practice's information as Schedule 2 describes. It restores information only on the instruction of the practice or to recover from a fault. Before a restore it keeps a copy of the state before; after it, it reapplies every erasure the practice has made, holds messages that fell due in between, and tells the practice's owners what was done and why.

13. How long information is kept, and what happens at the end

Message wording is kept for the period the practice sets (6 to 120 months, 72 months (six years) unless it chooses otherwise), after which the wording is removed and the fact that a message was sent remains. Hello warns the practice that a period under six years may be shorter than its own record-keeping duties.

The practice may download all of its information at any time in a structured, commonly used format, and each patient's conversation as a dated record. When the agreement ends without a new plan being chosen, the operator keeps the practice's information for 90 days, warns its owners 30, 14, 7 and 1 day before, and then deletes it. On deletion the practice's encryption key is destroyed in every place it is held, so that every backup becomes permanently unreadable; the encrypted backups then expire within 12 months. If the principal owner deletes the practice, this happens at once. On written request the operator will confirm in writing that deletion is complete. Invoices and billing records are kept only as tax and company law require.

14. Clinical records

Hello does not hold clinical notes or dictations. Before any Kinilo module does, the parties will agree an addendum that sets retention periods no shorter than the HPCSA and AHPCSA require, records every view and change, restricts rather than erases records a practice must keep, and provides for the return of all clinical records to the practice, or to whoever it nominates, when it leaves. Clinical records will never be deleted automatically when a subscription ends.

15. Requests from authorities

If a court, regulator or law-enforcement body asks the operator for patient information, the operator will refer it to the practice, notify the practice before disclosing anything unless the law forbids it, disclose only what it is legally compelled to, and record the request.

16. Showing compliance

Once a year, and after any security compromise, the operator will on request answer the practice's reasonable written questions about how it complies with this agreement and provide a summary of its security measures, its sub-operators and its most recent restore rehearsal. Where the Information Regulator or the practice's professional council requires more, the operator will cooperate at the practice's reasonable cost.

17. Artificial intelligence

No patient information in Hello is processed by an artificial intelligence service. If the operator offers a feature that does so, such as dictation transcription, it will be off unless an owner switches it on after reading what it does, the service will first be added under clause 6, it will be bound not to keep or train on the information, and the practice remains responsible for checking anything it produces before relying on it.

18. Liability

Each party's liability under this agreement is subject to clause 12 of the terms of service, including its separate limit for breaches of this agreement and of POPIA.

19. Duration and general

This agreement starts when the practice accepts it and continues for as long as the operator processes the practice's information, including the 90 days after a subscription ends. Clauses 4, 8, 9, 13, 15 and 18 survive it. The operator may change it only by publishing a new version and asking the practice to accept it, with at least 30 days' notice unless the change is required by law or only adds protection. It is governed by the law of the Republic of South Africa.

Schedule 1: what is processed

Schedule 2: security measures

Schedule 3: sub-operators

Meta Platforms, Inc. carries WhatsApp messages under the practice's own agreement with Meta and is listed here for completeness.