Data Privacy
Data handling, privacy rights, and compliance
Data Privacy
How AfricaOS handles your data and your users' privacy rights.
Data We Collect
Organization Data
- Organization details (name, address, contact)
- Billing information
- Usage analytics (anonymized)
- Audit logs
User Data
- Account info (name, email, role)
- Activity logs
- Preferences
- Session data
Module Data
Varies by module:
- Patients - Health records, appointments, notes
- Payments - Transaction records, payment methods
- Stock - Inventory levels, supplier info
- Bookings - Reservations, customer details
Data Storage
- Primary Region - South Africa (af-south-1)
- Encryption - AES-256 at rest, TLS 1.3 in transit
- Backups - Daily encrypted backups, 30-day retention
- Replication - Cross-region for disaster recovery
Your Rights
Access
Request a copy of all data we hold about your organization.
Rectification
Correct inaccurate or incomplete data.
Erasure
Request deletion (subject to legal retention requirements).
Portability
Export data in standard formats (JSON, CSV, PDF).
Restriction
Limit processing of your data.
Objection
Object to processing for direct marketing.
Data Processing Agreement (DPA)
Standard DPA included in Terms of Service. Covers:
- Processor obligations
- Sub-processor list
- International transfers
- Security measures
- Breach notification (72 hours)
Sub-Processors
| Sub-Processor | Purpose | Location |
|---|---|---|
| AWS | Hosting, storage | Cape Town, South Africa |
| Cloudflare | CDN, WAF, DNS | Global |
| Postmark | Transactional email | US (EU SCCs) |
| Stripe | Payment processing | US (EU SCCs) |
| Sentry | Error tracking | US (EU SCCs) |
Data Retention
| Data Type | Retention |
|---|---|
| Active organization data | Duration of contract + 90 days |
| Deactivated organization | 90 days (then purged) |
| Audit logs | 1 year (7 years Enterprise) |
| Backups | 30 days rolling |
| Analytics | 2 years anonymized |
Requests
Submit privacy requests at Settings → Privacy → Submit Request or email privacy@africaos.dev.
Response time: 30 days (GDPR), 40 days (POPIA).