Privacy Notice
Drafted against the build as it stands. Last reviewed: on deployment.
Template — needs legal review
This document was drafted to match how the software behaves. Before you go live, have a South African attorney review it, add your registered entity details and an information officer contact, and confirm the retention periods match what you actually configure.
Who we are
AbilityAccess Directory operates a directory of disability services, practitioners and peer support groups. For the purposes of the Protection of Personal Information Act 4 of 2013 (POPIA), we are the responsible party for the personal information described below.
Health and disability information
This is the most important section on this page, so it comes first.
Information about your health or disability is special personal information under section 26 of POPIA. It may not be processed unless a specific ground in section 27 applies — in our case, your express consent.
What that means in practice:
- You never have to tell us your condition. Filtering the directory by condition happens in your browser as an ordinary link. We do not record which filters you clicked, and no account exists to attach them to.
- Enquiry forms make it optional. The condition field on a support group enquiry has a “Rather not say” option and it is genuinely optional. If you fill it in, you are giving express consent for us to pass it to that group’s facilitator, and to nobody else.
- Access needs are shared only with the group you asked about. If you tell us you need a hearing loop or step-free access, that goes to that facilitator so they can prepare. It is not added to a profile, because there is no profile.
- The WhatsApp assistant. If you tell the assistant what you are looking for, that message is held only while the conversation is active so we can answer you, then erased. Referral records keep the category and condition filter used, never the message text and never your number.
What we collect
From people using the directory: nothing at all unless you contact us. Browsing and filtering require no account.
From people using the WhatsApp assistant: your WhatsApp number, the messages you send, and the area or location you share so we can match you to a hub.
From people enquiring about a support group: the name you give us, one contact detail, and anything optional you choose to add — a condition, access needs, a message.
From providers and group facilitators applying to list: organisation or practitioner name, contact name, email, WhatsApp number, qualification and registration number, area of operation, description, declared condition experience and access features.
Automatically: essential cookies to keep an administrator signed in, and a local record that you dismissed the cookie notice. No advertising or tracking cookies, and no analytics that profile you.
Why we process it
- To match you to providers or groups and connect the two of you.
- To pass a group enquiry to that group’s facilitator.
- To record that a referral happened, so providers can see results.
- To collect ratings from people we actually referred.
- To review listing applications, and to verify registration numbers with the relevant professional council.
- To send providers a monthly report of the referrals they received.
What we deliberately do not store
Referral records identify the requester only by a salted, one-way hash of their phone number — never the number itself, and never alongside a condition. Your raw WhatsApp number is held only while a conversation is active, and is erased when the conversation goes stale or immediately if you send STOP.
We do not build profiles, we do not track you across the site, and we do not sell personal information to anyone. There is no advertising on this directory and there will not be.
Who we share it with
When you ask us to connect you, we open a WhatsApp chat with the provider you chose. From that point the conversation is between the two of you and this notice no longer covers it.
Group enquiries go to that group’s facilitator. Facilitators are usually volunteers rather than clinicians, and we ask them to keep enquiries confidential — but they are not bound by professional confidentiality rules the way a registered practitioner is. Share only what you are comfortable sharing.
We use processors to run the service: Meta Platforms (WhatsApp Business Platform), our email provider, our hosting provider and our database provider.
How long we keep it
- Active WhatsApp conversation state, including your raw number: erased after the retention window configured on this deployment.
- Group enquiries: kept while the facilitator needs them to respond, then closed and periodically purged.
- Referral and rating records: retained as hashed, non-identifying records so providers can see historic totals.
- Listings: for as long as they are live, plus a reasonable period after removal.
Your rights under POPIA
You may ask what we hold about you, ask us to correct or delete it, object to processing, or withdraw consent for special personal information at any time. You may also complain to the Information Regulator of South Africa.
Send STOP on WhatsApp and we delete that conversation immediately. For anything else, contact us using the details on this site. You do not need to explain why.
Security
Administrative access is restricted, and every approval or rejection is recorded in an audit log. Inbound WhatsApp traffic is signature verified. We keep personal information to the minimum the service needs to work, which is the strongest protection available.
Changes
If we change how we process personal information we will update this notice, and where the change is material we will tell you directly.