Privacy notice

RosterFlow is staff and theatre rostering software for South African hospital departments. This notice explains what personal information we handle, why, where it is kept, and what rights you have.

We are OPTIMIA (Pty) Ltd (registration number K2026604988), a private company incorporated in the Republic of South Africa, trading as RosterFlow.

Our Information Officer is registered with the Information Regulator and can be contacted at hello@rosterflow.co.za.

Most of the information in RosterFlow is not ours. It belongs to the hospital department that uses the software.

Where your department is our customer, the department is the responsible party and we are the operator. The department decides what staff information goes into RosterFlow and why. We hold and process it on their instruction, under a written agreement required by section 21(2) of POPIA. We do not decide what happens to it, and we do not use it for anything of our own.

If you are a doctor or staff member and you want to see, correct or delete your information, ask your department. They control it. If you ask us directly, we will not act on the request ourselves. We will point you to your department and let them know you have been in touch.

We are a responsible party in our own right for a narrow set of information: the contact details of the people who contract with us, enquiries sent to us, and the technical logs that keep the service running and secure.

Information about your health

Leave recorded as sick or maternity, and any medical certificate or incapacity form (including form ZA1221) uploaded with a leave request, is information about your health. POPIA calls this special personal information and protects it more strictly.

Your department relies on section 32 of POPIA to process it, as an employer giving effect to laws that create rights dependent on health, such as the sick leave provisions of the Basic Conditions of Employment Act.

We handle it with extra care. Leave documents sit in private storage that is not reachable from the public internet, they are released only through a link that expires shortly after it is issued and only after we check that the person asking is entitled to see it, and a doctor can retrieve only their own. Leave types, leave reasons and leave documents are never sent to our roster optimisation service.

What RosterFlow never holds

We want to be direct about this, because it is the question hospitals ask first.

RosterFlow contains no patient information of any kind. It also holds no identity numbers, no passport numbers, no bank or payment details, no salary or remuneration information, no biometric information, and nothing about race, religion, trade union membership, political persuasion, sexual orientation or criminal behaviour.

• From your department, when it sets up its account, either through the staff onboarding workbook or by entering staff directly.
• From you, when you use the doctor app to request leave, mark yourself unavailable, set preferences, choose shifts or send feedback.
• From your use of the service, in the form of authentication records and audit logs.

We do not buy personal information, and we do not collect it from social media, public registers or any other outside source.

We process it for one purpose: to provide the rostering service your department has asked us to provide. In practice that means building and publishing weekly theatre rosters and monthly on-call rosters, handling leave and admin day requests, letting you sign in, sending you an invitation email when your department adds you, and keeping the service secure and working.

We do not use your information to train machine learning models. We do not use it for marketing. We do not sell or rent it. We do not share it with anyone except the service providers listed in section 7.

RosterFlow is hosted in Ireland, in the European Union. The application runs in Dublin and the database, authentication and file storage are in the eu-west-1 region.

This means information leaves South Africa. POPIA permits that under section 72(1)(a) when the recipient is subject to a law that provides substantially similar protection. Our hosting providers are subject to the General Data Protection Regulation and the Irish Data Protection Act 2018, which meet that standard.

We will not move hosting outside the European Economic Area without telling our customers first and obtaining their agreement.

We use a small number of service providers. Each is bound by a written contract to protect the information and to use it only to provide their service to us.

We may also disclose information where the law requires it, or to establish or defend a legal claim. If we are ever compelled to hand over customer data, we will tell the affected department unless we are legally prohibited from doing so.

Sometimes we need to look at a department’s data to fix a fault or help with setup.

That access is read-only by default. To make a change, a member of our team has to deliberately switch on write access for one department, and that act is logged before it takes effect. Every change we then make is recorded in the same audit trail as your department’s own changes, and flagged as ours, so your administrators can always tell what we did and what they did. Your department can ask us for that record at any time.

Your department decides how long its roster records are kept, and we keep them for as long as they instruct.

When a department stops using RosterFlow, we give them a window to export their data, then delete it from our live systems within 30 days. Copies in encrypted backups fall away as those backups expire, within 30 days, and stay protected until they do.

We keep the audit record, and anything we need to meet a legal obligation or defend a claim, for as long as that purpose requires.

Everything you send to and from RosterFlow travels over an encrypted connection, and everything we store is encrypted at rest. Every request is authorised on the server before any data is read or written, and is limited to a single department. If you are a doctor, you can see and change only your own leave, preferences, unavailability and feedback. Sign-in attempts are rate limited. Uploaded files are checked before they are stored. Every change to your data is logged with the account that made it.

If information is ever accessed by someone who should not have it, we notify the affected department immediately, so that they can meet their own obligation to notify you and the Information Regulator under section 22 of POPIA.

Under POPIA you have the right to:

• know whether we hold personal information about you, and to be given a copy of it (section 23);
• ask for it to be corrected or deleted if it is inaccurate, irrelevant, excessive, out of date, incomplete, misleading or unlawfully obtained (section 24);
• object to the processing on reasonable grounds (section 11(3));
• complain to the Information Regulator (section 74); and
• seek civil relief in court (section 99).

How to exercise them. If the information relates to your rostering at a department, ask your department, because they control it. See section 2. For anything we hold as a responsible party in our own right, write to us at hello@rosterflow.co.za and we will respond within 30 days.

You may also request access under the Promotion of Access to Information Act 2 of 2000. Our PAIA manual explains how, and is available on request at hello@rosterflow.co.za.

RosterFlow sets cookies that are strictly necessary to keep you signed in and to protect against cross-site request forgery. Without them the service cannot work, so there is no option to switch them off while using it.

We do not use advertising cookies or third party tracking cookies. Our page analytics are aggregate and do not use cookies or identify individual visitors.

Please raise a concern with us first, at hello@rosterflow.co.za. We would rather fix it.

You may also complain directly to the Information Regulator:

Complaints must be submitted in writing through the Regulator’s eServices portal.

If we change this notice materially, we will tell the departments that use RosterFlow before the change takes effect and update the date at the top. Earlier versions are available on request.