Privacy notice
OnCall is a directory that helps clinicians reach the doctor currently on call at the hospitals it covers. This notice explains what personal information the site holds, why, who can see it, and your rights under the Protection of Personal Information Act (POPIA).
Who is responsible
OnCall is run by Dr A Kolia. For any privacy question or request, email cmjahoncall@gmail.com.
What we hold about doctors on the roster
- Name, department, role and shift times, taken from the department on-call roster.
- Mobile phone number, taken from the same roster.
No patient information is collected or shown.
Why, and on what basis
The purpose is to let colleagues reach the doctor on call quickly during patient care. We rely on legitimate interest (POPIA section 11(1)(f)): being reachable is the reason an on-call roster exists. We show only the doctor currently on call for each department, and phone numbers are released only when someone opens a department or taps a call button, through a rate-limited server request. They are not part of the data a browser can download in bulk.
Who can see it
Anyone who opens the site can see names and shift times. Phone numbers are released only to doctors who have signed up and been verified (see below), one request at a time, and are limited per account per day. We do not sell personal information.
What we hold about visitors
| Item | What it is |
|---|---|
| Usage events | Which page or department was opened, whether a call, WhatsApp, share or report button was tapped, device type (mobile or desktop) and hospital. Used to see how the site is used. |
| Anonymous visitor ID | A random code stored in your browser (local storage) so we can count repeat visits. It does not contain your name or number. You can clear it in your browser settings. |
| Last hospital opened | On the home page, your browser remembers which hospital you opened last so it can show it first. It is kept only in your browser and is never sent to us. |
| Feedback form | Star rating, and optionally a comment, your name and role, if you choose to enter them. Comments may be quoted on this website with your role only, never your name. |
| Request-a-hospital form | Hospital name, city, your role, optionally your name, and an email or cell number so we can reply. Used only to follow up on your request, and kept until it is dealt with. |
| Report-a-change form | The details you write are sent from your own WhatsApp or email app to us. We do not receive them until you press send there. |
We do not use advertising trackers or sell visitor data.
If you create an account (doctors)
To see phone numbers you create an account. We hold:
- Your full name, HPCSA registration number and email address, which you enter when signing up.
- Your password, stored only in scrambled (hashed) form by our authentication provider. We cannot read it.
- The result of checking your registration number against the HPCSA public register where that check is switched on: the name, category, city and status the register shows, and when we checked.
- Whether you were approved, how (automatically or by an administrator) and when.
We use these only to confirm you are a registered practitioner and to run your account. Your details are never shown to other users. A registration match shows that the number exists and the name fits; an administrator can review or remove any account. You can ask us to delete your account and these details at any time by emailing cmjahoncall@gmail.com.
Where it is stored and who processes it
- Supabase: database, file storage, and sign-in (account email, password hash).
- Vercel: website hosting and server functions.
- Anthropic: used by the site administrator to read uploaded rosters. Only the administrator can do this.
These providers may store data outside South Africa. We use them under their standard data protection terms.
How long we keep it
Roster records are kept for the service's history and usage statistics. If you ask for your details to be removed, we remove them (see below).
Your rights
- Ask what we hold about you, and ask us to correct it.
- Object to your details being shown, or ask us to delete them. Use the objection page or email us. We act on a valid request promptly.
- Complain to the Information Regulator: POPIAComplaints@inforegulator.org.za.
Changes
We will update this notice when what we collect or how we use it changes, and change the date above.