Effective 10 August 2026
Privacy Notice
SAHPRA Guide is an independent application-preparation service. This notice explains how information is handled when you create an account and prepare a medical-device establishment licence application.
Information we process
We store account details, application answers, product information, uploaded evidence, generated documents and limited security/audit records. Do not upload patient records, health information unrelated to the establishment application, passwords, payment-card details or bulk exports from the GMDN database.
Where information is stored
Application records are held in a managed database and uploaded evidence is held in private object storage. Access is restricted to the signed-in account and every document download is checked against application ownership.
How AI is used
Long-form guided answers and files selected for “AI review uploaded evidence” are sent to the OpenAI API to structure wording and extract supported facts. The app requests that Responses API outputs are not stored as application state. OpenAI states that API data is not used to train its models unless the customer opts in; default abuse-monitoring logs may be retained for up to 30 days. Do not use the AI review for material you are not authorised to send to a third-party processor.
OpenAI API data controls ↗Service providers
The service uses Vercel for application hosting and private file storage, Neon for the application database, and OpenAI for the AI functions described above. These providers process data to operate the service.
Retention and deletion
Application data is kept while you use the workspace. You can delete individual files, an application, or all application data from the dashboard. Deleting application data removes the database records and private stored files associated with it. Limited account and audit records may remain for security, fraud prevention and legal compliance.
Your responsibilities and rights
Only upload information you are authorised to process. Use the dashboard deletion controls if information is no longer needed. Additional access, correction or account-deletion requests can be directed to the service operator who provided access to SAHPRA Guide.