Security and Privacy
Last updated: October 2026
A summary for practice managers and partners of how Dokk looks after your practice's information. The full detail is in our Privacy Policy.
POPIA: who is responsible for what
Under the Protection of Personal Information Act (POPIA), your practice is the responsible party for the information about its team, and Dokk is your operator. That means we:
- process your information only to run the service for your practice;
- never sell it or use it for advertising;
- keep it secure and confidential, as set out below;
- tell you without delay if we become aware of a security compromise affecting it.
If your practice needs a written operator agreement for its records, contact us at hello@dokk.app.
Where your data is stored
Dokk runs on Amazon Web Services data centres in the United States: the database is hosted by Neon and the application by Vercel. Your information is encrypted in transit and at rest.
Sending information outside South Africa is permitted by section 72 of POPIA where the recipient is bound by protections substantially similar to POPIA's. Our providers process your information under their data processing terms, which bind them to protect it and use it only on our instructions.
How it is protected
- Encryption: all traffic uses TLS, and data is encrypted at rest. Uploaded theatre slates and connected calendar credentials are encrypted again by Dokk before they are stored.
- Separation between practices: every practice's records are isolated in the database itself, with row-level security that refuses any query not scoped to that practice.
- Role-based access: admins, coordinators, practitioners and viewers each see and change only what their role allows.
- Sign-in: handled by Clerk, a dedicated authentication provider. Dokk never stores passwords.
- Activity log: roster changes, requests and data exports are recorded, and administrators are notified whenever a full practice export is downloaded.
Payments
Subscriptions are processed by Paystack, a Stripe company and a PCI DSS compliant payment provider. You enter your card on Paystack's secure page, so your card details never reach Dokk. We keep only the billing details needed for your invoices.
Patient information
On Call holds no patient information. Theatre Lists works at procedure level and does not create patient records. An uploaded theatre slate may contain patient details: the original is stored encrypted, removed once it has been imported, and made inaccessible after 24 hours if it is not. Reading a slate with AI is optional and chosen for each upload; see theatre slates and optional AI extraction.
Your data, your control
- An administrator can download a complete copy of the practice's data at any time from Settings.
- Closing the practice stops billing and makes it read-only. Nothing is deleted for 30 days, so it can be reopened. After that the data is permanently deleted, apart from invoice records that tax law requires us to keep.
Service providers
We share information only with the providers needed to run Dokk:
- Neon: database hosting.
- Vercel: application hosting.
- Clerk: sign-in and user accounts.
- Resend: email delivery.
- Sentry: error monitoring.
- Paystack: payment processing.
- Google and Microsoft: only when a practitioner connects their own calendar, to add their shifts to it.
- OpenAI: only when AI reading is selected for a theatre slate upload.
These providers may process information in the United States and other countries, under their own data processing terms.
POPIA and PAIA requests
To access, correct or delete personal information, or to request records under the Promotion of Access to Information Act (PAIA), contact our Information Officer at hello@dokk.app. You can also lodge a complaint with the Information Regulator.