Privacy policy
Last updated 24 September 2026
Meduxus is a booking service that medical practices use to take appointments on WhatsApp. It is a product of Ascentitude (Pty) Ltd, a South African company (“we”, “us”). This policy explains what personal information Meduxus handles, why, and the choices you have. It covers patients who message a practice, and practice staff who use the Meduxus dashboard.
Who is responsible
For patients, the practice you message is responsible for your information (the “responsible party” under South Africa’s Protection of Personal Information Act, POPIA). Ascentitude (Pty) Ltd processes it on the practice’s behalf, as its operator, and only to run the practice’s bookings.
For practice staff accounts, and for calendar access a practice grants, Ascentitude (Pty) Ltd is responsible.
Contact: privacy@meduxus.com.
Information about patients
| What | Why |
|---|---|
| Your WhatsApp number | To reply to you and send your appointment reminders. |
| Your name | So the practice knows who the appointment is for. |
| The messages you send and the replies Meduxus sends | To carry on the booking conversation, and so the practice can see what was agreed. |
| Your appointments: service, time, and whether you attended or cancelled | To keep the practice’s diary, send reminders, and apply the practice’s cancellation policy. |
| Whether you agreed to health news from the practice | Only if you tap “yes” when asked. You can stop at any time by replying UNSUBSCRIBE. Appointment messages are not affected. |
| A record that a message looked like an emergency | So the practice can follow up. Meduxus replies with where to get urgent help and does not book. |
Meduxus does not ask for medical history, ID numbers or payment details.
Information about practice staff
Your name, email address, a securely hashed password, and when you signed in — to give you access to your practice’s dashboard and to keep it secure.
Google Calendar and Microsoft Outlook
A practice can connect its calendar so that bookings appear in its own diary. When it does, Meduxus:
- reads free/busy times — only whether a time is taken, not what the other appointments are;
- lists the calendars the account can add events to, so the practice can choose which one bookings go into;
- adds an event for each booking (the service, the patient’s name and a booking reference), and removes it if the appointment is cancelled.
For Google, Meduxus asks only for the calendar.freebusy and calendar.events.owned permissions.
For Outlook, it asks for Calendars.ReadWrite and offline_access.
Meduxus does not read the contents of other events, and does not access email, contacts or files.
The access token the practice grants is stored encrypted and used only for the actions above. The practice can disconnect at any time from the dashboard’s Settings, or by removing Meduxus’s access in its Google or Microsoft account.
Meduxus’s use and transfer to any other app of information received from Google APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements. In particular, information from Google Calendar is used only to provide and improve the booking feature the practice uses, is never sold, is never used for advertising, and is not read by people except where the practice asks for help, for security, or where the law requires it.
Who we share information with
Meduxus does not sell personal information or use it for advertising. It is shared only with the services needed to run bookings:
- Meta (WhatsApp Business Platform), which delivers messages between you and the practice;
- Google or Microsoft, only for the practice that connected its calendar, as described above;
- our hosting provider, which runs the service and its database.
These providers may process information outside South Africa. We use providers that protect it to a standard comparable to POPIA. We may also disclose information where the law requires it.
How long it is kept
Information is kept for as long as the practice uses Meduxus, because it forms part of the practice’s appointment records. When a practice leaves, or asks for information to be deleted, we delete it unless the law requires it to be kept.
Security
Information travels over encrypted connections. Calendar access tokens are encrypted at rest, passwords are stored only as hashes, and each practice sees only its own patients.
Your rights
You may ask to see the information held about you, to have it corrected or deleted, or object to how it is used. Contact the practice you booked with, or privacy@meduxus.com. If you are not satisfied with the response, you may complain to the Information Regulator of South Africa (inforegulator.org.za).
Children
Meduxus is used to book appointments by adults, including on behalf of children in their care. It is not directed at children.
Changes
If this policy changes, the new version will be published here with a new date.