Security

Last updated 11 November 2026

How Hello by Kinilo protects the information practices trust it with, and how to tell us about a security problem.

Reporting a security problem

If you believe you have found a weakness in Hello by Kinilo, please email hello@kinilo.co.za with "Security report" in the subject, describing what you found and how to see it again. We will acknowledge your report within two working days, keep you informed while we fix it, and credit you if you wish once it is fixed.

While looking, please do not open, change or keep anyone's information beyond what is needed to show the problem, do not try to disrupt the service, and give us reasonable time to fix a problem before telling anyone else. Research done in good faith on those terms is welcome, and we will not pursue anyone for it.

How information is protected

Each practice's information is kept in its own separate database inside the European Union, apart from every other practice. Every connection uses HTTPS, every page carries a strict content security policy, and every message from Meta is checked against its signature and stored safely before it is acknowledged. Credentials for a practice's appointment system and WhatsApp account are encrypted before they are stored, and identity numbers are sealed with the practice's own key. Practices can require two-step sign-in for their whole team and decide how long anyone stays signed in; it is compulsory for our own administrators. Practitioners can keep a conversation private from reception. We have no standing access to any practice's information: a practice opens time-limited, read-only support access when it asks for help, and every visit is logged where the practice can see it.

Every night each practice's information is backed up, encrypted with a key that belongs to that practice alone, and locked so that it cannot be altered or deleted before it expires. Each backup is checked as soon as it is made, and restoring it is rehearsed every week. When a practice is deleted its key is destroyed, so its backups can never be opened again.

If we have reasonable grounds to believe that personal information has been accessed or acquired by someone without authority, we tell each affected practice immediately, as section 21 of the Protection of Personal Information Act requires, and in any event within 24 hours, and help it notify the Information Regulator and its patients. Our privacy policy and operator agreement set out the rest.