Mobile app privacy policy

1 · What this covers

This policy covers the MedicalBytes member app, distributed through Google Play and the Apple App Store. It is written to meet the disclosure requirements both stores place on apps handling health and biometric data, and it sits alongside the main privacy notice, which covers the platform as a whole.

The app is issued to members of a scheme, insurer or employer benefit that uses MedicalBytes. It is not a general consumer app and cannot be used without a membership issued by one of those organisations.

2 · What the app collects

Data	Why	Linked to you
Name, membership number, dependant details	To show your digital card and your cover	Yes
Biometric template	To unlock the app and prove entitlement at the point of service	Yes
Benefit balances and claims history	To show what you have used and what remains	Yes
Authorisation requests and outcomes	To show the status of a request	Yes
Device identifier and app version	To register the device, deliver notifications and support you	Yes
Crash and performance diagnostics	To find and fix faults	No

The app does not collect your location, your contacts, your photo library, your calendar, your browsing activity, or anything about your use of other apps.

3 · Permissions the app asks for

Biometric sensor, to unlock the app and verify you. The comparison runs against the encrypted template; your device's own fingerprint or face data is never read by the app.
Camera, only when you choose facial verification or photograph a document. Nothing is captured in the background.
Notifications, to tell you about an authorisation outcome or a claim. You can turn these off.
Network access, to reach the platform.

Each permission is requested at the point it is first needed, with an explanation. Declining one disables only the feature that needs it.

4 · How biometric data is handled in the app

What is stored is an encrypted mathematical template, not a fingerprint image or a photograph.
A template cannot be reversed into a usable image and is not portable to another system.
Verification can run offline against the locally stored template, so the app works where connectivity does not. The encounter synchronises when the connection returns.
Biometric data is used only to verify that you are entitled to the benefit being claimed. It is never used for advertising or profiling, and never sold or shared outside the parties named in section 6.

5 · Tracking and advertising

The app contains no advertising, no third-party analytics and no tracking SDKs. It does not track you across apps or websites, and it does not ask for permission to do so under Apple's App Tracking Transparency framework, because there is nothing to track.

6 · Who your data is shared with

Your scheme, insurer, administrator or employer benefit provider, which is the responsible party for your membership and claims. Healthcare providers involved in your care, limited to what they need to treat you and be paid. Our infrastructure providers, under written operator agreements. Nobody else, except where the law or a court requires it.

7 · Where data is held

In South Africa, with cloud infrastructure and backup that may involve facilities outside the Republic. Transfers out of the Republic are made on a basis permitted by section 72 of POPIA, as described in the main privacy notice.

8 · Deleting your data

You can ask for your account and the data in it to be deleted:

In the app, under Settings, then Account, then Delete account.
By email, to info@med-bytes.com, with your name and membership number.

Deleting your account removes your biometric template and your app profile. It does not delete the claims and payment records your scheme is required by law to keep, and it does not end your membership. Your scheme decides how long those records are retained, and the main privacy notice sets out how retention works. We confirm in writing what was deleted and what was retained, and why.

9 · Children

The app is not directed at children and is not offered to them directly. A child dependant's information is accessed through the principal member's account, under the authority of a competent person.

10 · Security

Traffic between the app and the platform is encrypted. Data at rest on the device is encrypted, and the biometric template is encrypted separately. The app locks itself after inactivity and requires verification to reopen. If you lose your device, tell your scheme or write to the address below and the device registration will be revoked.

11 · Your rights

You may ask what we hold about you, ask for it to be corrected or deleted, object to processing, and withdraw consent. Write to info@med-bytes.com. If you are not satisfied with the answer you may complain to the Information Regulator (South Africa), at inforegulator.org.za.

12 · Changes

Material changes are notified in the app before they take effect, and the effective date at the foot of this page is updated. The store listing links to this page, so the version here is always the current one.

13 · Contact

The developer of this app is SeptiBytes Solutions. Privacy questions and data requests go to info@med-bytes.com, marked for the attention of the Information Officer.