CPD LedgerBack to home

YOUR INFORMATION

App privacy policy

CPD Ledger is a private record of your continuing professional development. This notice explains how personal information is handled in the Android app and its account and backend services.

Who is responsible for your information

CPD Ledger is operated by NAPPYCARE (Pty) Ltd, trading as CPD Ledger, the responsible party for the processing described in this notice.

Information we process

Account information. We process your email address, account identifier and information needed to authenticate you and manage your sessions. Email verification codes are handled by Clerk, our authentication provider. If you choose Google sign-in, the connection also processes the Google account identifier, verified email, name and profile image Google supplies. Authentication providers process the tokens needed to establish and maintain that connection.

Your CPD record. We store your Registration Category and its history, your optional HPCSA Registration Number, and the CPD Activities you enter. An Activity includes its name, Earned Date, Clinical and Ethics Points, and any optional provider name, accreditation reference or Activity reference. We also store record identifiers, timestamps and revision information needed to keep your record consistent. The app uses your entries and the applicable Requirement Policies to produce its CPD views.

Operational information. Account and infrastructure services may process IP addresses, device or browser details, connection information, sign-in events and security logs. The app’s own audit records contain the operation type, outcome, a request identifier and time; they exclude Activity contents, email addresses and registration numbers. Deletion also uses the limited recovery and security information described below.

Messages you send us. If you contact us, we process the contact details and information you provide to respond to your request.

An email address and an authenticated account are necessary to use the private ledger. A Registration Category is needed for the ledger’s CPD calculations. Your HPCSA Registration Number and the optional Activity references are voluntary. We do not verify your registration number against the HPCSA register.

Record your own professional learning. Do not enter patient or client names, clinical case details, or other people’s sensitive information in Activity names or references. The app does not offer certificate uploads.

Why we use your information

We use information to create and secure your account, maintain your private ledger, calculate the app’s CPD views, keep changes consistent across devices, provide exports, carry out deletion, respond to support requests and investigate service or security problems.

Depending on the purpose, processing relies on providing the service you request, consent where required, legitimate security or administrative interests, or a legal obligation. [CONFIRM THE APPLICABLE POPIA JUSTIFICATIONS BEFORE PUBLICATION.]

The Android app does not implement advertising, app-usage analytics or session replay. We do not sell your personal information, use your ledger or Google information for advertising, or use that information to train AI models.

Google sign-in

Google sign-in is optional; you can use email verification codes instead. The Google connection requests basic identity, email and profile permissions. It does not request access to your Gmail messages, Google Drive files, contacts or calendar.

We use Google information to identify your account and provide and secure sign-in. We do not send your CPD Activities or registration number to Google as part of sign-in. Our use and transfer of Google information follows the Google API Services User Data Policy, including its Limited Use requirements where applicable.

You can review or revoke the connection in your Google Account connections settings. Revoking Google access does not itself delete your CPD Ledger account, stored ledger or existing app sessions. Use the account-deletion process to remove your CPD Ledger account.

Who receives information

Your ledger is not publicly visible. The services supporting it include:

  • Clerk, for account identity, email verification, Google sign-in and session management. Clerk’s delivery services, including Svix, carry the signed account-deletion events used by our backend.
  • Convex, for the app’s database, authenticated backend functions and operational processing, using its hosting infrastructure.
  • Google, when you choose Google sign-in, under its own privacy policy.
  • Website infrastructure providers, including Vercel for the public website and Cloudflare for domain and DNS services. The native ledger backend is hosted on Convex.

Authorised operator and provider personnel may access information when needed for support, security, maintenance or a legal requirement. We limit access to those purposes. We may disclose information when legally required or necessary to address fraud or a security incident.

The app does not submit your ledger to the HPCSA, an employer or an accrediting body. If you export and share it, you choose the recipient.

Where information is processed

The Production ledger database is hosted in the United States, in Convex’s US East region. Sign-in, support and operational information may also be processed outside South Africa by Google, Clerk and their service providers. The ledger’s selected region does not determine every provider’s processing location.

[CONFIRM AND DESCRIBE THE CONTRACTUAL AND OTHER SAFEGUARDS FOR INTERNATIONAL TRANSFERS BEFORE PUBLICATION.]

Retention and account deletion

We retain your account and ledger until you remove them or request their removal, subject to the limited operational retention described here. Activities whose Points have expired remain in your history until you delete them. Signing out, uninstalling the app or revoking Google access does not delete the server record.

You can delete an Activity in the app. To delete the whole account, open Account → Delete account, complete identity verification and confirm the request. Export first if you want a copy. The process removes the Clerk identity and your Practitioner record, registration history and Activities from the app’s active database. The app confirms completion only after the removal steps succeed. If it shows removal as pending or unconfirmed, retry as directed or contact us; do not assume deletion has completed.

Some operational information has a separate schedule:

  • App audit events older than 90 days are removed by scheduled daily cleanup. These events do not contain your ledger contents.
  • Account-deletion recovery records expire after 24 hours and are removed by hourly cleanup. Account identifiers needed for a retry are cleared when removal completes.
  • A hashed account identifier prevents old sessions from recreating a deleted record. It remains while removal is pending and for 24 hours after removal completes, then becomes eligible for hourly cleanup. It is pseudonymous security information, not an anonymous record.

The 90-day audit schedule does not describe all provider logs or backups. Removal from the active database does not establish that every provider backup or security record has been erased at the same instant.

[INSERT VERIFIED PROVIDER LOG AND BACKUP RETENTION, DELETION PERIODS AND SUPPORT-CORRESPONDENCE RETENTION BEFORE PUBLICATION.]

Your device and exports

The app holds ledger screens and unsaved drafts in memory and does not maintain its own offline ledger database. Authentication components and your browser may retain protected session information or cookies to support sign-in. Android app backup is disabled.

Account → Export my data prepares your record as a JSON file for sharing. The app’s temporary export access expires after ten minutes and is cleared on sign-out or a session change. An app or person you share with can retain its own copy; deleting your CPD Ledger account does not delete that copy.

Security

The app uses encrypted network connections and authenticates access to each private ledger. Sensitive backend credentials are kept out of the Android app. Authorised service and administrative access is still possible as described above. Protect your device and sign-in accounts, and contact us if you suspect unauthorised access.

Your privacy choices and rights

You can inspect and correct your ledger, export it or request deletion through the app. Contact the privacy address above for other access, correction, deletion or objection requests. Where processing relies on consent, you can withdraw that consent; this does not undo earlier lawful processing. We may need to verify your identity before acting and will explain any lawful restriction on a request.

You can also complain to South Africa’s Information Regulator. Its complaints page provides the current submission process and eServices portal.

Children and other people’s information

CPD Ledger is intended for professional CPD recordkeeping. Do not enter personal information about children or patients. If you believe such information has been submitted, contact us so we can investigate and address it.

The public website

The public website provides product information. Website and sign-in hosting services may process request logs and browser information separately from your CPD ledger. This notice does not mean that those providers collect no operational data.

Changes to this notice

We will publish updates at the app’s privacy-policy link and update the effective date. Material changes will be communicated through the app or an account communication, as appropriate.