The Three You Answer To
HPCSA, SAHPRA and POPIA — all at once.
A medical website isn't marketing with a stethoscope on it. It sits inside three regulatory regimes, and getting any one wrong is a real risk to your registration and your patients.
The HPCSA restricts how practitioners may advertise — no testimonials that create unrealistic expectations, no claims you can't substantiate, no canvassing. SAHPRA becomes directly relevant the moment your practice touches health products, medical devices, medicine information or telehealth workflows that involve prescribing or dispensing — the way products are described and offered online has to respect its rules. And POPIA governs every patient detail your site collects: a booking form, an intake questionnaire, an uploaded result. Build the site as an engineering problem across all three, and it becomes an asset. Build it as a brochure, and it becomes a liability.
What You Get
A patient portal, not a poster.
- A secure patient portal — bookings, forms, results and messages behind proper access control
- Online booking that syncs with how your rooms actually run
- POPIA-compliant intake forms with consent captured and logged correctly
- HPCSA-appropriate content — informative and lawful, never over-claimed
- Telehealth-ready flows where you offer virtual consultations
- Medical billing and practice-management integration where you need it
- Encrypted storage and South African data residency for patient information
Part of our broader Healthcare IT & Compliance practice — and built on the same engineered business-systems methodology, so it's measured on booked patients, not page views.
Common Questions
Straight answers.
Can we show patient testimonials or reviews?
Carefully, and often not the way other businesses do. HPCSA rules restrict advertising that creates unjustified expectations or amounts to canvassing. We build your content and any social proof to stay on the right side of those rules rather than expose you to a complaint.
Where does SAHPRA come in for a practice website?
SAHPRA regulates health products, medical devices and medicines. If your site describes, offers or supports the ordering of health products, or drives telehealth that involves prescribing or dispensing, the way that's presented online must respect SAHPRA's requirements. We flag and structure those areas rather than leave them to chance.
Is a booking form enough for POPIA?
No — a form is where most practices get POPIA wrong. Patient information needs lawful, logged consent, a stated purpose, secure transmission, encrypted storage and a retention position. We build all of that in, and it links to your practice privacy policy.
Do we own the website?
Completely. You receive the code, hosting and data. It's a permanent practice asset — never rented, never held hostage.