Data & Privacy
Data handling, retention, privacy rights, export, deletion, and compliance (GDPR, HIPAA, POPIA, NDPR).
Data & Privacy
How AfricaOS handles your data, your privacy rights, and how to exercise them.
Quick links
- Submit a privacy request → Settings → Privacy → Submit request - Email → privacy@africaos.dev - Data Processing Agreement → Included in Terms of Service - Download compliance docs → Settings → Security → Compliance
Data we collect
Organization data
- Profile (name, address, contact, industry, branding)
- Billing information (payment methods, invoices, usage)
- Configuration (modules, settings, custom fields, workflows)
- Audit logs (all admin actions, access, changes)
User data
- Account (name, email, role, avatar, preferences)
- Authentication (password hash, 2FA secret, SSO linkage)
- Activity (login, module access, record views, exports)
- Sessions (device, IP, location, duration)
Module data (varies by module)
| Module | Data types |
|---|---|
| Patients | Health records, demographics, appointments, clinical notes, prescriptions, insurance |
| Payments | Invoices, transactions, payment methods, customer records, subscriptions |
| Stock | Inventory levels, suppliers, purchase orders, transfers, adjustments |
| Bookings | Resources, schedules, reservations, customer details, payments |
| Workflows | Process definitions, instances, approvals, audit trails |
| HR | Employee records, leave, performance, contracts |
| Finance | Accounts, journals, expenses, reports |
Data storage & security
| Aspect | Details |
|---|---|
| Primary region | South Africa (af-south-1) |
| Encryption at rest | AES-256 |
| Encryption in transit | TLS 1.3 |
| Backups | Daily encrypted, 30-day rolling retention |
| Replication | Cross-region for disaster recovery |
| Key management | AWS KMS (customer-managed keys on Enterprise) |
Your privacy rights
Under GDPR, POPIA, NDPR, and other applicable laws:
Right of access
Request a complete copy of all data we hold about your organization and users.
- How: Settings → Privacy → Submit request → "Data access"
- Format: JSON (complete) or PDF (summary)
- Timeline: 30 days (GDPR), 40 days (POPIA/NDPR)
Right to rectification
Correct inaccurate or incomplete data.
- How: Edit directly in Settings, or submit request for bulk corrections
- Timeline: Immediate for self-service, 15 days for requests
Right to erasure ("Right to be forgotten")
Request deletion of your data.
- Scope: All personal data, unless legal retention applies
- Exceptions: Audit logs, billing records (legal requirements), backup retention
- How: Settings → Privacy → Submit request → "Data deletion"
- Timeline: 30 days after verification
Right to data portability
Export your data in standard, machine-readable formats.
- Formats: JSON (complete), CSV (tabular), PDF (human-readable)
- How: Settings → Privacy → Export data, or submit request
- Timeline: 15 days
Right to restriction
Limit processing of your data (e.g., pause analytics, stop automated decisions).
- How: Submit request with specific processing to restrict
- Timeline: 15 days
Right to object
Object to processing for direct marketing or legitimate interests.
- Marketing: Unsubscribe in Settings → Notifications
- Other: Submit request with justification
- Timeline: 15 days
Data Processing Agreement (DPA)
Standard DPA included in Terms of Service. Covers:
- Processor obligations - AfricaOS as data processor
- Sub-processor list - Current and notification of changes
- International transfers - SCCs, adequacy decisions
- Security measures - Encryption, access controls, incident response
- Breach notification - Within 72 hours of awareness
- Data subject rights - Assistance with your compliance
- Return/destruction - On contract termination
Download DPA: Settings → Privacy → Download DPA (PDF)
Sub-processors
| Sub-processor | Purpose | Location | Safeguards |
|---|---|---|---|
| AWS | Hosting, database, storage | Cape Town, South Africa | ISO 27001, SOC 2 |
| Cloudflare | CDN, WAF, DNS, DDoS | Global (edge) | SOC 2, ISO 27001 |
| Postmark | Transactional email | US | EU SCCs, ISO 27001 |
| Stripe | Payment processing | US | PCI DSS Level 1, EU SCCs |
| Sentry | Error tracking, performance | US | EU SCCs, SOC 2 |
| WorkOS | SSO, directory sync | US | SOC 2, EU SCCs |
Sub-processor list updated quarterly. 30-day notice for new sub-processors.
Data retention
| Data type | Retention period | After expiry |
|---|---|---|
| Active organization data | Contract duration + 90 days | Archive → purge |
| Deactivated organization | 90 days | Purge |
| Audit logs | 1 year (7 years Enterprise) | Purge |
| Backups | 30 days rolling | Overwrite |
| Analytics (anonymized) | 2 years | Aggregate → purge |
| Exported reports | 90 days | Purge |
| Session data | 30 days after logout | Purge |
Custom retention (Enterprise)
Set per-module retention policies in Settings → Privacy → Retention policies.
Making a privacy request
Settings → Privacy → Submit request
- Choose request type - Access, Rectification, Erasure, Portability, Restriction, Objection
- Scope - Organization data, specific users, specific modules
- Format - JSON, CSV, PDF
- Verify identity - Email confirmation + 2FA
- Submit - Receive tracking ID
Response times:
- GDPR: 30 days (extendable to 60 for complex)
- POPIA: 40 days
- NDPR: 30 days
Status tracking: Settings → Privacy → Requests
Data subject requests (for your customers/patients)
If your organization processes personal data of others (patients, customers, employees), AfricaOS helps you comply:
| Feature | Module | Description |
|---|---|---|
| Subject access | All | Search and export all data for a person |
| Rectification | All | Edit or bulk-update records |
| Erasure | All | Anonymize or delete with audit trail |
| Portability | All | Export in JSON/CSV/PDF |
| Consent tracking | Patients, HR | Record, view, withdraw consent |
| Breach notification | Security | 72-hour breach alert workflow |
Compliance frameworks
| Framework | Region | AfricaOS support |
|---|---|---|
| GDPR | EU | Full - DPA, SCCs, rights workflows, DPIA templates |
| HIPAA | US Healthcare | BAA available, PHI encryption, audit logs, BAA |
| POPIA | South Africa | Full - rights, breach notification, information officer |
| NDPR | Nigeria | Full - rights, breach notification, DPO support |