Privacy Policy

Practice Genius is operated by AOL Holdings (Pty) Ltd t/a Practice Genius (registration number 2026/641341/07), 5 Lurgan Road, Parkview, Johannesburg, 2193, South Africa.

Two kinds of personal information pass through Practice Genius, and the Protection of Personal Information Act (POPIA) treats them differently:

• Information about a practice's prospects and clients. The practice decides what to record and why. The practice is the responsible party; we are its operator, and handle this information only to provide the service to that practice, on its instructions.
• Information about the practice's own people — the names, email addresses and sign-in details of its team, and its billing details. For this, we are the responsible party.

If you are a client or a prospect of a financial advisory practice that uses Practice Genius, that practice is the right place to ask about your information. We will pass on any request that reaches us.

• From a practice's team: name, email address, role, and sign-in details.
• About a practice: its name, regulatory details, settings, and subscription and payment history.
• What a practice records about its prospects and clients: names, contact details, identity or registration numbers, dates of birth, addresses, assets under management, meeting notes, recommendations, action items, and the history of each.
• What we do not collect: we do not hold card numbers, we run no advertising or analytics trackers, and we do not buy information about anyone from third parties.

To provide the service to the practice that entered it, to bill that practice, and to keep the service secure and working. Nothing else.

We do not sell personal information. We do not use it for marketing to a practice's clients. We do not use it to train artificial-intelligence models, and no client or prospect information is sent to any artificial-intelligence service.

We use the following companies to run the service. Each handles personal information only to do the job described, under its own terms with us.

• The database. Where every practice's records are stored. Everything a practice enters — prospects, clients, reviews, notes, action items — and its team's names and email addresses. Location: Supabase. Frankfurt, Germany (European Union), on Amazon Web Services.
• Clerk. Sign-in: accounts, passwords, sessions and invitation emails. Each user's name, email address and sign-in credentials. No client or prospect information. Location: United States.
• Vercel. Runs the website and the application. Information passes through it on the way to and from the database. It is not where records are stored. Location: United States.
• Paystack. Takes subscription payments. The paying principal's email address and the card they pay with. Card details are entered on Paystack's own page and never reach Practice Genius. No client or prospect information. Location: South Africa and other countries in which Paystack operates.
• Xero. Our own accounting: an invoice for each subscription payment. The practice's name and its billing email address. No client or prospect information. Location: Xero's international data centres.
• Sentry. Tells us when something in the service breaks. Technical details of the error: what failed and where. Names, email addresses and client information are removed before anything is sent. Location: Frankfurt, Germany (European Union).

We will update this list before we start using any other company to handle personal information.

Practice records are stored in data centres in Frankfurt, Germany, in the European Union. Sign-in details are held by our sign-in provider in the United States. This means personal information is transferred outside South Africa. It is transferred only to the companies listed above, for the purposes listed above.

• Every record belongs to exactly one practice, and every request is checked against that practice before anything is returned. One practice cannot see another's records.
• Within a practice, what a person can see and change depends on their role. An adviser sees their own clients; support staff see the clients they have been given access to.
• Information is encrypted in transit, and the database is encrypted at rest by our database provider. Identity numbers are stored within that encrypted database; they are not separately encrypted field by field.
• Records that form part of a client's history — reviews, action items, locked meeting notes — cannot be deleted or rewritten through the application.
• Changes to a client's details are recorded: who changed what, and when.

For as long as a practice subscribes, its records are kept. How long a practice must keep records about its own clients is a matter for that practice and the laws that apply to it; Practice Genius does not delete a practice's records on a timer.

After a practice cancels, its records remain available to it to view and export. They are deleted 90 days after cancellation, but only once the practice has taken a full export. If no export has been taken, the records are kept rather than lost. Deletion is approved by a person at Practice Genius; it is never automatic. A practice may also ask us in writing to delete its records sooner.

Under POPIA you may ask what personal information is held about you, ask for it to be corrected, and in some circumstances ask for it to be deleted or object to its use.

• If you are a client or prospect of a practice, ask that practice. The service gives the practice the means to act: it can export everything held about a client, correct it, and erase it.
• If you are a member of a practice's team, ask your practice's principal, or write to us.

You also have the right to complain to the Information Regulator (South Africa): inforegulator.org.za.

If we have reasonable grounds to believe that personal information has been accessed or acquired by someone not authorised to have it, we will tell the affected practice's principal as soon as reasonably possible, with what we know, so that the practice can meet its own duty to notify its clients and the Information Regulator. Where we are the responsible party, we will notify the Information Regulator and the people affected ourselves.

We use only the cookies needed to keep you signed in, set by our sign-in provider. We use no advertising cookies and no analytics cookies, so there is nothing to opt out of.

When this policy changes, the date at the top changes with it. If a change affects how a practice's records are handled, we will tell the practice's principal before it takes effect.

Information Officer: Andrew Lawson — support@practicegenius.ai

Privacy questions or requests: support@practicegenius.ai