Operator Agreement

Processing of personal information under the Protection of Personal Information Act 4 of 2013

Parties

Dr Sophie Ramsaroop (Pty) Ltd, registration number 2021/383189/07, a private company incorporated in the Republic of South Africa, with its registered address at 261 Underwood Road, Glen Park, Pinetown, KwaZulu-Natal, 3610, trading as GlowFlow (“GlowFlow”, “we”, “us”, “the Operator”)

and

the subscribing clinic identified in the GlowFlow account and electronic acceptance record, with its legal name, registration number (if applicable), address and Information Officer details as recorded in the account and/or the Clinic's applicable Privacy Notice and PAIA Manual (“the Clinic”, “you”, “the Responsible Party”).

Each a “Party” and together the “Parties”.

Acceptance at sign-up.

This Agreement is accepted electronically when an authorised representative of a subscribing Clinic ticks the acceptance box for this Operator Agreement during account creation or activation. The Clinic will be given access to the Agreement before acceptance. GlowFlow will record the Clinic's identity, the authorised representative or accepting user, the document version, and the date and time of acceptance, together with relevant technical information used to evidence the acceptance. The accepted version will be retained for subsequent reference.

The Agreement then forms part of the contractual arrangements between GlowFlow and the Clinic.

1. Background and purpose

The Clinic uses the GlowFlow platform to run its practice: taking bookings, keeping client and clinical records, storing consent forms and clinical photographs, managing stock, and sending appointment messages to its clients.

In doing so, GlowFlow processes personal information — including special personal information concerning health — on behalf of and at the direction of the Clinic.

Section 21 of the Protection of Personal Information Act 4 of 2013 (“POPIA”) requires that processing of this kind be governed by a written contract. This agreement is that contract. It supplements, and does not replace, the GlowFlow Terms of Use. Where this agreement and the Terms of Use conflict on a matter of personal information processing, this agreement prevails.

2. Definitions

Words defined in POPIA carry their POPIA meaning in this agreement. In particular, “personal information”, “special personal information”, “processing”, “responsible party”, “operator”, “data subject”, “Regulator” and “information officer” are used as POPIA uses them.

“Client Personal Information” means personal information relating to the Clinic’s own clients, patients, staff and contacts that GlowFlow processes on the Clinic’s behalf through the platform.

“Sub-operator” means a third party engaged by GlowFlow to carry out part of the processing on the Clinic’s behalf.

3. Roles of the Parties

The Clinic is the responsible party. It determines the purpose of and means for processing Client Personal Information. It decides which clients to treat, what clinical records to keep, what photographs to take, and what messages to send.

GlowFlow is the operator. It processes Client Personal Information only for the Clinic and only in order to provide the platform.

Nothing in this agreement makes GlowFlow a responsible party in respect of Client Personal Information, and GlowFlow does not use Client Personal Information for its own purposes.

GlowFlow is separately a responsible party in respect of the Clinic’s own account information — the details of the clinic and its owner, billing records, and support correspondence. That processing is governed by the GlowFlow Privacy Policy, not by this agreement.

4. The Clinic’s responsibilities as responsible party

The Clinic warrants that:

• it has a lawful basis under POPIA for every category of personal information it puts into the platform, and has given its clients the notification required by section 18;
• it has obtained the consent required by section 27 for processing special personal information concerning health, and the consent required by section 34 and, where applicable, of a competent person for the personal information of children;
• it has obtained the consent required by section 69 before using the platform to send direct marketing to its clients, and will honour every objection and unsubscribe;
• the instructions it gives GlowFlow, and the processing it carries out through the platform, do not cause GlowFlow to breach POPIA or any other law;
• it will keep the clinical and administrative records it is required to keep under the Health Professions Act 56 of 1974, the National Health Act 61 of 2003 and any applicable HPCSA rules, and that the platform is not a substitute for the Clinic’s own record-keeping obligations; and
• it will keep its account credentials secure, remove staff access promptly when someone leaves, and grant each staff member only the access their role requires.

The Clinic remains responsible for the accuracy of the information it enters and for the clinical decisions it takes.

5. GlowFlow’s obligations as operator

5.1 Processing only on instruction

GlowFlow processes Client Personal Information only with the knowledge and authorisation of the Clinic, and only as necessary to provide the platform, as required by section 20 of POPIA.

The Clinic’s documented instructions consist of this agreement, the Terms of Use, the settings and configuration chosen in the Clinic’s account, and the actions the Clinic’s authorised users take in the platform.

If GlowFlow is required by law to process Client Personal Information otherwise than on the Clinic’s instruction, it will tell the Clinic before doing so, unless that law prohibits it from telling the Clinic.

If GlowFlow forms the view that an instruction would breach POPIA, it will tell the Clinic without delay and may decline to act on it.

5.2 Confidentiality

GlowFlow treats Client Personal Information as confidential and will not disclose it except as permitted by section 20(b) of POPIA — that is, where required by law or in the proper performance of its duties under this agreement.

GlowFlow ensures that every person it authorises to process Client Personal Information is bound by an appropriate duty of confidentiality, and limits access to those who need it.

5.3 Security safeguards

GlowFlow secures the integrity and confidentiality of Client Personal Information by taking appropriate, reasonable technical and organisational measures, as required by section 19 of POPIA. Those measures are described in Annexure B.

GlowFlow will keep those measures under review and may change them, provided the level of protection is not reduced.

5.4 Notification of compromise

Where GlowFlow has reasonable grounds to believe that Client Personal Information has been accessed or acquired by an unauthorised person, GlowFlow will notify the Clinic immediately, and in any event within forty-eight (48) hours after becoming aware of the Security Compromise.

That notification will describe, as far as GlowFlow then knows: what happened, when, which categories of personal information and roughly how many data subjects are affected, the likely consequences, and what GlowFlow is doing about it.

The Clinic, as responsible party, is responsible for notifying the Regulator and affected data subjects under section 22. GlowFlow will give the Clinic the reasonable assistance it needs to do so, and will not make any public statement identifying the Clinic without first consulting the Clinic, unless required by law.

5.5 Assisting with data subject requests

If a data subject approaches GlowFlow directly to exercise a right under POPIA in respect of Client Personal Information, GlowFlow will not respond on the merits. It will refer the data subject to the Clinic and tell the Clinic without undue delay.

GlowFlow will provide the Clinic with reasonable assistance, taking into account the nature of the processing and the information available to GlowFlow, so the Clinic can:

• give a data subject access to their personal information under section 23;
• correct or delete personal information that is inaccurate, irrelevant, excessive, out of date, incomplete, misleading or unlawfully obtained, under section 24; and
• stop processing where a data subject objects under section 11(3).

GlowFlow provides functions in the platform for exporting and for erasing a client’s information. Where a request cannot be met through those functions, GlowFlow will assist by other reasonable means.

5.6 Assisting with the Regulator

GlowFlow will give the Clinic reasonable assistance with any investigation, enquiry or assessment by the Information Regulator that concerns Client Personal Information processed through the platform.

6. Sub-operators

The Clinic authorises GlowFlow to engage Sub-operators to carry out parts of the processing. The Sub-operators GlowFlow uses, and what each does, are published and kept current at glowflow.online/legal/subprocessors. That list forms part of this agreement.

Before adding or replacing a Sub-operator that processes Client Personal Information, GlowFlow will give the Clinic at least thirty (30) days’ notice by email to the address on the Clinic’s account.

If the Clinic reasonably objects on data protection grounds within that period, the Parties will discuss the objection in good faith. If no resolution is reached before the proposed change takes effect, the Clinic may terminate the affected service without penalty and receive a pro-rata refund of any prepaid fees attributable to the period after termination.

GlowFlow imposes on each Sub-operator obligations no less protective than those in this agreement, and remains liable to the Clinic for each Sub-operator’s acts and omissions as if they were its own.

7. Trans-border flows

Client Personal Information is stored in the Republic of Ireland, within the European Union.

GlowFlow relies on section 72(1)(a) of POPIA: the recipient is subject to a law, binding corporate rules or a binding agreement that upholds principles for the reasonable processing of the information substantially similar to the conditions in POPIA, and that includes provisions substantially similar to section 72 relating to onward transfers.

Where processing occurs elsewhere, the Sub-processor list identifies where, and GlowFlow will ensure a lawful basis under section 72 is in place before that processing begins.

8. Records, audit and information rights

GlowFlow will make available to the Clinic, on reasonable written request and no more than once in any twelve-month period unless a compromise has occurred, the information reasonably necessary to demonstrate compliance with this agreement.

Where the Clinic reasonably requires more, the Parties will agree the scope, timing and cost of an audit in advance. Any audit must be conducted during business hours, on reasonable notice, without unreasonably disrupting GlowFlow’s operations, and subject to confidentiality.

The Clinic bears the cost of an audit it initiates, unless the audit reveals a material breach by GlowFlow.

GlowFlow may satisfy an audit request by providing an independent report or certification covering the matters in question.

9. Retention, return and deletion

GlowFlow retains Client Personal Information for as long as the Clinic’s account is open, and thereafter in accordance with the retention schedule published at glowflow.online/legal/privacy.

GlowFlow will not delete Client Personal Information where retention is required by applicable law, professional requirements, or a lawful retention schedule applicable to the Clinic or GlowFlow.

On termination of the Clinic’s account, the Clinic will have sixty (60) days from the effective date of termination to request and retrieve its Client Personal Information in a commonly used machine-readable format.

The sixty (60)-day period is an export and retrieval period only and does not authorise the deletion or destruction of records which GlowFlow or the Clinic is required to retain by law or applicable professional or clinical record-keeping requirements.

Following the expiry of the sixty (60)-day period, GlowFlow will delete Client Personal Information that it is not required or otherwise lawfully entitled to retain, subject to the applicable retention schedule and any legal, regulatory or professional retention requirement.

Where Client Personal Information is retained after termination, GlowFlow will continue to protect it in accordance with this agreement for as long as it is retained.

10. Liability

Each Party’s liability under this agreement is subject to the limitations and exclusions in the GlowFlow Terms of Use, save that nothing in this agreement or in the Terms of Use limits or excludes either Party’s liability for:

• death or personal injury caused by its negligence;
• fraud or fraudulent misrepresentation;
• gross negligence or wilful misconduct; or
• any liability that cannot lawfully be limited or excluded, including under the Consumer Protection Act 68 of 2008.

Each Party remains responsible for its own compliance with POPIA and for any administrative fine or penalty imposed on it in respect of its own acts or omissions.

11. Duration

This agreement takes effect when the Clinic accepts it electronically at sign-up and continues for as long as GlowFlow processes Client Personal Information on the Clinic’s behalf.

Clauses 5.2 (confidentiality), 9 (retention, return and deletion), 10 (liability) and 13 (governing law) survive termination.

12. Contact

GlowFlow’s Information Officer is Dr Sophie Ramsaroop, contactable at admin@glowflow.online.

The Clinic must identify its Information Officer in its GlowFlow account or otherwise keep the relevant contact details available in its Privacy Notice and PAIA Manual.

Each Party must keep the contact details for its Information Officer current and notify the other Party of any material change.

13. General

This agreement is governed by the laws of the Republic of South Africa and is subject to the non-exclusive jurisdiction of the South African courts.

If any provision is found to be invalid or unenforceable, it is severed and the rest continues in force.

No variation is effective unless made in writing and accepted by both Parties, save for changes to the Sub-operator list and related notification process expressly dealt with in clause 6.

No failure to enforce a right is a waiver of it.

Annexure A — Details of the processing

Subject matter. Provision of the GlowFlow clinic management platform to the Clinic.

Duration. For as long as the Clinic’s account is open, plus any retention period described in clause 9.

Nature and purpose. Collection, recording, organisation, storage, updating, retrieval, use, transmission and erasure of Client Personal Information, for the purpose of enabling the Clinic to take bookings, keep client and clinical records, obtain and store consent, record treatments and clinical photographs, manage stock and commissions, take payment where the Clinic has configured it, and send appointment and marketing messages that the Clinic initiates.

Categories of data subjects. The Clinic’s clients and prospective clients; the Clinic’s owner, therapists, receptionists and other staff.

Categories of personal information.

• Identifying and contact information — name, email address, mobile number, date of birth where provided, physical address where provided.
• Appointment and transaction information — bookings, treatments, prices, deposits, payment references, vouchers, products purchased.
• Message records — the content and delivery status of emails and SMS messages sent through the platform, and marketing consent and unsubscribe records.
• Staff information — name, contact details, role, working hours, and commission rates.
• Technical information — access logs, IP addresses and user agents associated with account activity and with acceptance of legal documents.

Special personal information. Information concerning health, within the meaning of section 26 read with section 32 of POPIA — including clinical consultation notes, treatment histories, contraindications and medical history recorded by the Clinic, clinical photographs, and signed consent forms.

Children’s information. Where the Clinic treats a person under the age of 18, the platform records that the client is a minor and captures the identity of, and consent given by, the competent person. Section 34 applies.

Annexure B — Security measures

The measures below are those GlowFlow has in place. They are described honestly, including where a measure is still being implemented, so that the Clinic can make its own assessment.

Access control. Each user authenticates individually. Access to Clinic data is restricted by role, and enforced at the database level by row-level security policies rather than only in the application, so that a request that bypasses the interface is still refused. Staff of one clinic cannot reach another clinic’s records.

GlowFlow’s own access. GlowFlow’s platform administrators cannot read the Clinic’s client records, clinical consultation notes, clinical photographs, consent signatures or intake submissions. This is enforced in two independent layers. In the application, the platform-administrator role no longer satisfies any authorisation check that gates client or clinical data. In the database, the permission functions governing the relevant tables are scoped to a role held at that specific clinic, so a direct query by a platform administrator returns nothing. The platform-administrator role retains access only to clinic-level metadata — the clinic’s name, subscription plan, billing status, account status and aggregate booking counts — which contains no personal information about any client.

Where a person holds both a platform-administrator role and a role at a particular clinic, they have normal access to that clinic and no other.

There is at present no mechanism by which a Clinic can grant GlowFlow temporary access to its records for support purposes. Support requiring sight of Clinic records is therefore not currently possible.

Encryption. All traffic between users and the platform is encrypted in transit using TLS. Data is encrypted at rest by the hosting provider. Payment gateway credentials that a Clinic stores are held encrypted, and are never displayed back in full.

Segregation. The platform is multi-tenant. Records carry the identifying key of the clinic that owns them, and every access path is scoped by that key.

Clinical photographs. Photographs are stored in a private bucket, are not publicly addressable, and are served only through short-lived signed links. Image metadata, including any GPS coordinates recorded by the capturing device, is stripped before storage.

Backups. The database is backed up by the hosting provider on a rolling basis.

Monitoring. Platform health is captured automatically and reviewed. Failures of scheduled processes are recorded.

Payments. Card details are never collected, transmitted or stored by GlowFlow. Payments are handled by the payment gateway. Notifications received from the gateway are signature-verified before being acted upon.

Separation of funds. GlowFlow’s own payment gateway account is used solely to collect subscription fees from clinics. It cannot be used to collect a client’s booking deposit or gift voucher payment for any clinic. A clinic that has not configured its own gateway credentials cannot take card payments at all, and the platform records such bookings as payable at the clinic rather than creating a charge that would settle into GlowFlow’s account.

Children’s information. A booking cannot be completed without a date of birth. Age is calculated on the server from that date and is never accepted from the browser. Where the client is under 18, the booking cannot proceed until the name, relationship and contact number of a parent or legal guardian have been provided and that person has given express consent. Marketing consent options are disabled and forced to negative for a client under 18, and marketing sends to a client whose date of birth indicates they are under 18 are suppressed.

Message consent. Marketing messages carry an unsubscribe mechanism, and an unsubscribe suppresses further marketing to that recipient. Patient messages are subject to the applicable messaging allowances and hard-stop rules in the Terms of Use. GlowFlow's own account, billing and security communications to the Clinic are not affected by those patient messaging allowances.

Acceptance records. Acceptance of this agreement and of the other GlowFlow legal documents is recorded with the document, its version, the person who accepted, the time, and the originating IP address.

Known implementation limitations. Audit logging of individual access to clinical records is not yet in place. The platform records who may access a record, but does not yet record who did. Automated enforcement of the retention schedule is not yet in place. The age and guardian-consent controls described above apply to bookings made by a client through the public booking page and are not yet applied to records created by clinic staff directly or to bulk imports of an existing client list.

Annexure C — Sub-operators

The current list of Sub-operators, what each does, and where each processes personal information, is published at glowflow.online/legal/subprocessors and is incorporated into this agreement by reference.

Execution

The Parties accept and agree to the terms of this Operator Agreement.

This Agreement is accepted electronically in accordance with the "Acceptance at sign-up" clause above.