1. What AinurPractice is
AinurPractice is practice-management software for booking, clinical records, billing and a patient portal, used by independent healthcare and wellness practices. Each practice (“the Practice”) has its own separate, access-controlled account. This policy explains how information is handled by the platform itself.
2. Who is responsible for your information
If you are a patient or client of a practice using AinurPractice, your information is collected and controlled by that Practice. Under South Africa’s Protection of Personal Information Act (POPIA), the Practice is the Responsible Party for your personal and health information.
Ainur Labs, which builds and operates AinurPractice, acts as an Operator. We process data on the Practice’s instructions to provide and protect the software it uses. Requests to access, correct or delete your own records should be directed to the Practice first.
3. Information collected
Staff accounts
- Name, email address, hashed password, and role or permissions within the Practice.
Patient and client records
- Contact and demographic details entered by the Practice or by patients through the portal.
- Clinical notes, diagnosis codes and file attachments. These are treated as special personal information under POPIA, with role-gated access and audit history.
- Appointment, booking and intake-form data.
- Billing and invoice records, including medical-scheme details where captured by the Practice.
Payments
Card numbers are not entered into AinurPractice and do not reach our servers. Card payments take place on Yoco’s hosted checkout. AinurPractice receives only the status and reference needed to reconcile the payment.
4. Google Calendar integration
A practitioner may choose to connect their Google Calendar. AinurPractice requests only the permissions needed to prevent clashes and keep confirmed bookings in sync:
calendar.eventsCreates a calendar event when a booking is confirmed and removes it if that booking is cancelled.
calendar.freebusyChecks busy periods so AinurPractice does not offer a slot that is already occupied.
openid · emailIdentifies and displays which Google account the practitioner has connected.
A practitioner may separately opt to display existing event titles and times in their own AinurPractice calendar. Events marked private in Google, or personal in AinurPractice, have their titles withheld.
Google OAuth refresh tokens are encrypted at rest using AES-256-GCM and are never exposed to the browser. Disconnecting the calendar stops further synchronisation and revokes AinurPractice’s access.
AinurPractice’s use and transfer of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements. Google user data is used only to provide the calendar functions described here. It is never used for advertising, never sold, and never shared with third parties except as necessary to provide or secure those functions, comply with law, or with the user’s explicit consent.
5. How information is used and shared
Information is used to run booking, clinical-record, billing, communication and patient-portal features; send confirmations, reminders and payment links selected by the Practice; and maintain appropriate audit history.
We do not sell personal information. Data is shared only with the Practice and its authorised staff; Google for a practitioner’s connected calendar; Yoco for a payment initiated by a patient; and infrastructure providers that host or secure the service under appropriate agreements.
6. Retention and deletion
Clinical and billing records are retained according to the Practice’s legal and professional record-keeping obligations. A Practice may request export or deletion of data that is no longer subject to a legal retention requirement.
Disconnecting Google Calendar revokes access and stops further sync. A practitioner may also remove AinurPractice from the third-party connections in their Google Account. Calendar access tokens are then deleted or rendered unusable; booking records already held by the Practice remain subject to its ordinary record-retention duties.
7. Security
- Per-practice isolation is enforced at database level, in addition to application controls.
- Clinical access is controlled by staff role and permission.
- Passwords are hashed and never stored in plain text.
- Sensitive provider tokens are encrypted at rest.
- Clinical reads, writes and downloads are recorded in audit history.
Children’s information
Where a Practice records information about a minor, it does so under its own consent obligations as Responsible Party under POPIA, including guardian or competent-person consent where applicable.
8. Your rights and contact
To access, correct or request deletion of your patient record, contact the Practice you attended. For questions about the AinurPractice platform’s handling of information, email privacy@ainur-labs.co.za.
You may lodge a complaint with South Africa’s Information Regulator. We may update this policy as the platform changes; the revision date at the top will change when we do.