Privacy Policy

Last updated: 13 July 2026

This Privacy Policy explains how Ambassadex Workforce ("Ambassadex", "we", "us") collects, uses, stores and protects personal information when healthcare professionals, facility owners/managers and administrators use the Platform.

1. Information We Collect

We collect the information needed to operate a regulated workforce platform, including account details, contact details, professional registration information, identity or verification documents, facility licensing information, staff records, roster and shift records, clock-in and clock-out events, leave requests, payroll calculation inputs, messages, audit logs, support requests, device/session security logs, and payment-reference information for subscription administration.

Where location is used for clock-in verification, the Platform records the clock event, the location data supplied by the device, and any reason given when location cannot be shared. Location is used for timesheet and attendance verification, not for continuous tracking.

2. Why We Use It

We process personal information to create and secure accounts, verify professional and facility credentials, manage facility staff records, route rosters, shifts, timesheets and leave, support payroll calculations, provide HR documents and reports, administer subscriptions, send operational notices, detect misuse, keep audit trails, respond to support requests, and comply with legal or regulatory duties.

3. Legal Basis and POPIA

We process information under the Protection of Personal Information Act, 2013 (POPIA), including where processing is necessary to perform the Platform agreement, where a user has consented, where processing is required by law, where it protects a legitimate interest, or where it is necessary for Ambassadex or a facility to pursue a legitimate operational or security interest.

4. Sharing

Information is shared only as needed for the Platform to work: facilities see their own staff, rosters, timesheets, leave and HR documents; healthcare professionals see their own profile and records; Ambassadex administrators see information needed for verification, support, billing, safety, audit and compliance. We may use contracted service providers for hosting, authentication, email, notifications, storage, analytics with consent, error monitoring and payment administration. We do not sell personal information.

5. Security and Retention

We use role-based access controls, authentication controls, audit logging, encrypted transport, restricted storage access and administrative controls designed to protect confidentiality, integrity and availability. No online system is risk-free, but suspected unauthorised access should be reported to info@ambassadex.co.za.

We keep information for as long as needed to operate the Platform, meet legal, accounting, labour, audit and dispute-resolution requirements, and preserve payroll and HR history. Account deletion requests follow the Platform deletion flow, including the stated 30-day grace period where applicable.

6. Your Choices and Rights

You may request access to, correction of, deletion of, or objection to the processing of your personal information where POPIA allows it. Some records may need to be retained where required for legal, payroll, audit, dispute or security reasons. You can manage cookie preferences through the Privacy & cookies controls on the Platform.

Contact: info@ambassadex.co.za.