Privacy Policy – LensTrac

Last updated: 07 August 2026

1. INTRODUCTION

Envision Africa (“Envision Africa”, “we”, “us” or “our”) operates the LensTrac mobile application (“LensTrac” or the “App”).

LensTrac is a restricted business application made available to authorised doctors and medical practices for specific stock-receipt and lens-invoicing functions connected to Envision Africa’s Microsoft Dynamics 365 environment.

This Privacy Policy explains how information is collected, used, transferred, stored, protected, retained and deleted when LensTrac is used.

For purposes of the Protection of Personal Information Act 4 of 2013 (“POPIA”), Envision Africa acts as the Responsible Party in respect of personal information where Envision Africa determines the purpose and means of processing that information through LensTrac and its connected business systems.

By accessing or using LensTrac, an authorised user acknowledges the information-handling practices described in this Privacy Policy.

This Privacy Policy is intended to provide transparency regarding LensTrac’s processing activities, including the information contemplated by POPIA where personal information is collected or processed.

2. SCOPE OF LENSTRAC

LensTrac is not a public account, patient-management, medical-record or general inventory-management application.

The App allows authorised users to:

Receive stock by processing goods-received transactions;
Receive and process transfer orders made available through Microsoft Dynamics 365; and
Submit lens transactions for invoicing to the relevant doctor or practice account.

Users cannot use LensTrac to review previously submitted invoices, patient-number references, stock receipts, transfer orders or transaction histories after submission.

Submitted transactions are processed through Envision Africa’s connected business systems and may continue to exist in Microsoft Dynamics 365 even though they cannot be viewed again through the App.

3. RESTRICTED ACCESS

LensTrac does not provide public registration, self-service account creation or guest access.

Access is granted directly through Envision Africa’s Microsoft Dynamics 365 system by an authorised Envision Africa employee.

Before access is granted:

The doctor or practice must be registered or approved within Envision Africa’s business systems;
Envision Africa must authorise access to LensTrac; and
The relevant access credentials must be enabled through Microsoft Dynamics 365.

Downloading or installing LensTrac does not:

Create an account;
Register the user with Envision Africa;
Grant access to Microsoft Dynamics 365;
Provide access to doctor, practice or patient information; or
Allow a person to submit transactions.

A person who downloads LensTrac without valid and authorised credentials cannot access the App’s operational functions.

4. AUTHENTICATION INFORMATION

LensTrac access is authenticated using:

A doctor code; and
A practice number.

These credentials are linked to the relevant doctor or practice record within Envision Africa’s Microsoft Dynamics 365 environment.

The credentials are used to:

Confirm that the doctor or practice is authorised;
Associate the user with the correct doctor or practice account;
Retrieve information required to prepopulate specific fields;
Retrieve relevant transfer orders;
Associate submitted transactions with the correct billing account; and
Prevent unauthorised access to LensTrac.

Doctor codes and practice numbers must be kept confidential and must not be disclosed to unauthorised persons.

Envision Africa may suspend or disable access where:

The doctor or practice requests access removal;
The doctor or practice is no longer authorised to use LensTrac;
Credentials are suspected of being compromised;
Unauthorised or suspicious activity is detected;
The relationship between Envision Africa and the doctor or practice ends; or
Suspension is reasonably necessary to protect LensTrac, Envision Africa or affected information.

5. INFORMATION PROCESSED THROUGH LENSTRAC

The information processed through LensTrac may include the following categories.

DOCTOR AND PRACTICE INFORMATION

LensTrac and Envision Africa’s connected systems may process:

Doctor name;
Practice name;
Practice number;
Doctor code;
Customer or account reference;
Business contact details;
Billing information;
Invoice information;
Delivery or practice address;
Transaction history;
Account status;
Product or lens information; and
Communications relating to billing, orders, access, support or account administration.

Doctors or practices are billed for lens transactions submitted through LensTrac.

PATIENT NUMBERS

A patient number may be entered when a lens transaction is submitted for invoicing.

The patient number is used as a reference to label or support the relevant invoice and enables the doctor, practice or medical institution to associate the transaction with its own internal patient record.

Patient numbers:

Are assigned by the relevant doctor, practice or medical institution;
May differ between institutions;
Are not intended to contain a patient’s name;
Cannot ordinarily be used by Envision Africa alone to identify the patient; and
May be linked to an identifiable patient by the institution that assigned the number.

Patient numbers are therefore treated as pseudonymous or potentially personal information.

Envision Africa does not ordinarily hold the separate institutional information required to identify a patient from the patient number alone.

Users must not enter unnecessary patient information into LensTrac, including:

Patient names;
Identity numbers;
Contact details;
Diagnoses;
Medical histories;
Clinical notes; or
Other unrelated personal or health information.

PRODUCT, STOCK AND TRANSACTION INFORMATION

LensTrac may process:

Product or lens codes;
Product descriptions;
Quantities;
Batch, lot, serial or reference numbers;
Transfer-order numbers;
Goods-received information;
Stock-receipt information;
Patient numbers;
Doctor or practice references;
Invoice references;
Transaction dates and times;
Submission status; and
Other information required to process the relevant transaction in Microsoft Dynamics 365.

TECHNICAL AND DIAGNOSTIC INFORMATION

LensTrac may process limited technical information required to operate, secure, support and troubleshoot the App, including:

App version;
Device type or model;
Operating-system type and version;
Error messages;
Crash reports;
Technical stack traces;
Dates and times of errors;
Connection or network information;
Technical event identifiers;
Authentication events;
Performance information; and
Information about the App’s technical state when an error occurs.

6. INFORMATION RETRIEVED BY LENSTRAC

LensTrac makes limited requests to Envision Africa’s connected systems for the purposes of:

Authenticating the doctor and practice;
Confirming that the doctor code and practice number are valid;
Confirming that LensTrac access has been authorised;
Retrieving information required to prepopulate specific fields;
Retrieving relevant doctor, practice, product, stock or account references;
Retrieving transfer orders; and
Providing the information required to complete an authorised stock or invoice transaction.

LensTrac does not provide unrestricted access to the full doctor, practice, customer or Microsoft Dynamics 365 record.

Information retrieved by the App is limited to what is reasonably required for authentication, field prepopulation, transfer-order processing and completion of the available LensTrac functions.

7. INFORMATION SUBMITTED BY LENSTRAC

LensTrac submits information to Envision Africa’s connected systems when an authorised user:

Records the receipt of stock;
Processes or receives a transfer order; or
Submits a lens transaction for invoicing.

Submitted information is associated with the relevant doctor or practice account and is processed in Microsoft Dynamics 365.

Once a transaction has been submitted, it cannot be reviewed again through LensTrac.

8. LOCAL PROCESSING AND STORAGE

LensTrac does not provide users with a locally accessible history of previously submitted transactions.

The App is not intended to maintain a permanent local database of:

Previous invoices;
Previous patient numbers;
Previous goods-received transactions;
Historical transfer orders;
Customer account history; or
Historical lens transactions.

Information may be held temporarily on the device while:

A user completes a transaction;
Specific fields are prepopulated;
Authentication is completed;
Information is submitted to Envision Africa’s systems; or
An interrupted, incomplete or unsuccessful submission is managed.

Temporary information may be stored in memory, application cache or another temporary technical location where required for the App to function.

Clearing or uninstalling LensTrac does not delete information that has already been submitted to Envision Africa’s staging environment, Microsoft Dynamics 365, diagnostic systems, backups or other connected systems.

9. STAGING INFORMATION

Information submitted through LensTrac may first pass through a staging environment before it is processed in Microsoft Dynamics 365.

The staging environment may be used to:

Validate submitted information;
Confirm that required fields have been completed;
Format information for Microsoft Dynamics 365;
Prevent incomplete or invalid transactions from being processed;
Identify unsuccessful submissions;
Retry or troubleshoot failed transfers;
Avoid duplicate transactions;
Confirm that a transaction has been successfully received; and
Maintain a limited operational record of processing.

A staging record may contain:

Doctor information;
Practice information;
Product or lens information;
Patient numbers;
Transfer-order information;
Goods-received information;
Invoice-related information;
Transaction timestamps; and
Submission or processing status.

Staging records are not made available to users as a transaction history through LensTrac.

Staging records will be retained only for as long as reasonably required for processing, troubleshooting, transaction verification, audit, security, billing, legal or operational purposes.

10.MICROSOFT DYNAMICS 365

Information processed through LensTrac is transferred to and stored in Microsoft Dynamics 365 and related Microsoft services used by Envision Africa.

Microsoft Dynamics 365 may be used to:

Authenticate authorised doctors and practices;
Manage doctor and practice records;
Provide information required by LensTrac;
Record stock received;
Process transfer orders;
Record lens transactions;
Generate invoices;
Bill doctors or practices;
Maintain product, transaction and customer records;
Manage account information;
Support product, stock, batch and transaction traceability;
Maintain accounting and audit records;
Resolve billing or stock queries; and
Meet contractual, operational, legal and regulatory obligations.

Microsoft may process information as a cloud, software and infrastructure service provider supporting Envision Africa’s use of Microsoft Dynamics 365.

11.ERROR MONITORING AND SENTRY

Where enabled in the production version of LensTrac, Envision Africa may use Sentry or a similar error-monitoring service to identify application crashes, errors and performance problems.

Depending on the configuration and the circumstances of an error, diagnostic information may include:

Error messages;
Technical stack traces;
App version;
Device and operating-system information;
Date and time of the error;
Technical event identifiers;
Connection information; and
Information about the App’s technical state when the error occurred.

Sentry is used for error monitoring, troubleshooting and technical support.

It is not used for:

Patient identification;
Billing;
Advertising;
Behavioral profiling; or

Envision Africa takes reasonable steps to prevent patient numbers, doctor codes, practice numbers, billing details and other confidential business information from being intentionally transmitted to Sentry.

Where diagnostic information is collected, it will be retained only for as long as reasonably required to investigate technical issues, maintain security, improve reliability or comply with applicable obligations.

12.PURPOSES FOR PROCESSING INFORMATION

Envision Africa may process information through LensTrac to:

Authenticate doctors and practices;
Grant and manage access to LensTrac;
Associate users with the correct doctor or practice;
Retrieve transfer orders;
Prepopulate required transaction fields;
Record stock receipts;
Process transfer orders;
Record lens transactions;
Generate and label invoices;
Bill doctors or practices;
Maintain transaction and account records;
Manage product and stock information;
Support product and transaction traceability;
Provide customer and technical support;
Troubleshoot unsuccessful submissions;
Diagnose application errors;
Protect LensTrac against unauthorised use;
Maintain audit and security records;
Meet financial, tax, contractual and regulatory obligations;
Resolve disputes;
Establish, exercise or defend legal rights; and
Improve the security, performance and reliability of LensTrac.

Envision Africa does not sell LensTrac information or use patient numbers for advertising or marketing.

13.LAWFUL PROCESSING

Envision Africa processes personal information in accordance with applicable data-protection laws, including the Protection of Personal Information Act 4 of 2013 (“POPIA”), where applicable.

Information may be processed where:

Processing is necessary to perform an agreement;
Processing is required to provide LensTrac and related services;
Processing is necessary for billing, stock management or transaction processing;
The relevant person has consented;
Processing is required by law;
Processing protects a legitimate interest of Envision Africa, a doctor, a practice, an institution or another person;
Processing is necessary for security, fraud prevention or system administration; or
Another lawful basis permitted by applicable law applies.

14.RESPONSIBILITIES OF DOCTORS AND PRACTICES

Doctors and practices are responsible for ensuring that information entered into LensTrac is lawful, accurate, relevant and limited to what is reasonably necessary.

Doctors and practices must:

Use the patient number assigned by the relevant institution;
Avoid entering patient names or unrelated patient information;
Ensure that they have a lawful basis for processing the patient number;
Protect doctor codes and practice numbers;
Restrict access to authorised personnel;
Notify Envision Africa if credentials may have been compromised;
Ensure that incorrect information is corrected promptly; and
Comply with their own privacy, professional, medical-record and information-security obligations.

The relevant doctor, practice or medical institution remains responsible for its internal patient records and for the information that connects a patient number to an identifiable patient.

15.SHARING AND DISCLOSURE

Information may be accessed by or disclosed to:

Authorised Envision Africa employees and representatives;
The doctor or practice associated with the information;
Authorised personnel at the relevant medical institution;
Microsoft, as a provider of Microsoft Dynamics 365 and related services;
Sentry or another diagnostic-service provider, where enabled;
Hosting, infrastructure, technical support and security providers;
Accountants, auditors, legal advisers, insurers and other professional advisers;
Regulators, courts, law-enforcement authorities or government bodies where disclosure is required by law; and
A successor or related entity as part of a lawful merger, restructuring, sale or transfer of the relevant business.

Service providers may only process information for authorised purposes and are expected to maintain appropriate confidentiality, privacy and security safeguards.

Envision Africa does not disclose LensTrac information to unrelated third parties for their own marketing purposes.

16.CROSS-BORDER PROCESSING

Microsoft, Sentry and other service providers may process or store information outside South Africa, depending on the location and configuration of the relevant service.

Where information is transferred across national borders, Envision Africa will take reasonable steps to ensure that the transfer is lawful and that appropriate contractual, organisational and technical safeguards are applied.

17.INFORMATION SECURITY

Envision Africa applies reasonable technical and organisational safeguards designed to protect information against:

Unauthorised access;
Loss;
Misuse;
Unlawful disclosure;
Accidental alteration;
Destruction; and
Other unlawful processing.

Safeguards may include:

Controlled access provisioning;
Doctor and practice authentication;
Access restrictions;
Secure network transmission;
Microsoft Dynamics 365 security controls;
Logging and monitoring;
Restricted administrative access;
Application and infrastructure maintenance;
Error monitoring;
Backup procedures; and
Internal confidentiality and security measures.

Users are responsible for:

Keeping doctor codes and practice numbers confidential;
Preventing unauthorised use of their devices;
Not sharing credentials;
Reporting suspected unauthorised access;
Using LensTrac only for authorised business purposes; and
Ensuring that submitted information is accurate.

No electronic system can be guaranteed to be completely secure. Envision Africa will nevertheless take reasonable steps appropriate to the nature of the information being processed.

18.DATA RERENRION

Information is retained only for as long as reasonably necessary for the purpose for which it was collected or as required by applicable law, contractual obligations, operational requirements or legitimate business needs.

Different retention periods may apply to different categories of information.

For example:

Temporary device information may be removed after a transaction is completed or the App’s temporary storage is cleared;
Staging records may be retained while submissions are processed, verified or investigated;
Diagnostic records may be retained for a limited troubleshooting and security period;
Doctor and practice information may be retained for the duration of the business relationship;
Access records may be retained while access remains authorised;
Invoice, billing, tax and accounting records may be retained for legally required periods;
Stock, transfer-order and goods-received records may be retained for audit and transaction-verification purposes;
Product, batch and lens records may be retained for traceability, warranty, complaint or recall purposes; and
Security records may be retained where required to investigate unauthorised access or misuse.

When information is no longer required or authorised to be retained, it will be deleted, destroyed, overwritten, de-identified or archived with restricted access, as appropriate.

19.ACCESS REMOVAL AND DATA DELETION REQUESTS

A doctor or authorised practice representative may request:

Deactivation of LensTrac access;
Removal of access associated with a doctor code or practice number;
Correction of inaccurate personal information;
Deletion of eligible doctor or practice information;
Deletion of eligible temporary staging information;
Deletion of eligible diagnostic information; or
Information about personal information held by Envision Africa.

Requests may be submitted to:

Email: informationofficer@envisionafrica.co.za

Please use the subject line:

LensTrac Access and Data Deletion Request

The request should include:

The doctor’s full name;
The practice name;
The practice number;
The doctor code, where appropriate;
A description of the access or information to be removed or corrected; and
Sufficient information to verify the requester’s identity and authority.

Requesters should avoid sending unnecessary confidential information through email.

20.VERIFICATION OF REQUEST

Before acting on an access-removal, correction or deletion request, Envision Africa may:

Verify the requester’s identity;
Confirm the requester’s relationship with the doctor or practice;
Confirm the request against the relevant Microsoft Dynamics 365 record;
Contact the relevant doctor, practice or institution;
Request supporting information;
Confirm that the requester has authority to act for the practice; and
Determine whether the requested information is subject to a legal, contractual or operational retention obligation.

Verification is required to prevent unauthorised persons from deleting or altering doctor, billing, stock or transaction records.

21.INFORMATION THAT MAY BE DELETED

Subject to successful verification and applicable retention requirements, Envision Africa may delete, mask or de-identify:

Obsolete doctor or practice contact information;
Access credentials or credential mappings that are no longer required;
LensTrac access permissions;
Temporary staging records that are no longer required;
Duplicate, incomplete or unsuccessful submissions with no continuing purpose;
Support information that is no longer required;
Eligible diagnostic information; and
Other personal information that Envision Africa is no longer authorised or required to retain.

Disabling access does not necessarily require deletion of the underlying doctor, practice, customer, invoice or transaction record.

22.INFORMATION THAT MAY BE RETAINED

Envision Africa may retain information where it is reasonably required for:

Issued invoices;
Billing and account records;
Financial, tax or accounting obligations;
Goods-received transactions;
Transfer-order records;
Proof of stock movement;
Product, lens, batch or transaction traceability;
Product complaints, warranties, recalls or safety investigations;
Audit requirements;
Security investigations;
Dispute resolution;
Enforcement of agreements;
Establishing, exercising or defending legal claims;
Compliance with a court order or legal obligation; or
Protecting the rights of Envision Africa, a doctor, a practice, a patient or another person.

Where a record must be retained, Envision Africa may restrict access to it or remove information that is not required for the applicable retention purpose.

23.PATEINT-NUMBER DELETION REQUESTS

A doctor or authorised practice representative may request deletion or correction of a patient number associated with a LensTrac transaction.

The request may need to be coordinated with the relevant doctor, practice or medical institution because:

The institution assigned the patient number;
The institution can link the number to the relevant patient;
The transaction may form part of the institution’s own records; and
The transaction may be linked to an invoice, stock record or traceability record that must be retained.

Where the transaction record must be retained, Envision Africa may mask, replace or de-identify the patient number where reasonably and technically possible without compromising the integrity of the required invoice, audit, stock or transaction record.

24.BACKUPS

Deleted information may remain temporarily in secure backups until the relevant backups are overwritten or expire in accordance with ordinary backup schedules.

Information retained only in backups will not be used for ordinary operational purposes.

Where a backup is restored, applicable deletion requests will be reapplied where reasonably practicable.

25.UNINSTALLING LENSTRAC

Uninstalling LensTrac, clearing the App’s cache or removing the App from a device does not automatically delete information that has already been submitted to:

The staging environment;
Microsoft Dynamics 365;
Sentry or another diagnostic system;
Envision Africa’s backups; or
Other connected business systems.

A separate access-removal, correction, objection or data-deletion request must be submitted using the process described in this Privacy Policy where the user wishes Envision Africa to take action regarding information already submitted.

26.DATA-SUBJECT RIGHTS

Subject to POPIA and other applicable law, a person may have the right to:

Ask whether Envision Africa holds personal information about them;
Request access to their personal information;
Request correction of inaccurate, incomplete, outdated, excessive or misleading information;
Request deletion or destruction of information that Envision Africa is no longer authorised to retain;
Object to certain processing;
Withdraw consent where processing is based on consent; and
Lodge a complaint with the Information Regulator of South Africa.

These rights may be limited where information must be retained for lawful billing, accounting, stock, audit, security, traceability or legal purposes.

27.SECURITY INCIDENTS

A doctor, practice or authorised user should notify Envision Africa promptly if:

A doctor code or practice number has been disclosed;
Credentials may have been compromised;
A device used to access LensTrac has been lost or stolen;
An unauthorised person may have accessed LensTrac;
An unexpected transaction has occurred; or
A suspected security or privacy incident has taken place.

Envision Africa will investigate suspected security incidents and take reasonable steps to:

Contain the incident;
Protect affected information;
Determine the nature and scope of the incident;
Reduce the risk of further unauthorised access;
Preserve appropriate investigation records; and
Take corrective action where necessary.

Where there are reasonable grounds to believe that personal information has been accessed or acquired by an unauthorised person and notification is required under POPIA, Envision Africa will notify the Information Regulator and affected data subjects in accordance with applicable legal requirements.

28.CHILDREN’S INFORMATION

LensTrac is intended for use by authorised doctors, practice personnel and other approved adult users.

Children cannot create or hold LensTrac access credentials.

Where a patient number relates to a child, the relevant doctor, practice or medical institution is responsible for ensuring that the information is processed lawfully and that any required consent, authorisation or safeguard is in place.

29.THIRD-PARTY SERVICES

LensTrac may rely on third-party services, including Microsoft Dynamics 365, Microsoft cloud services, hosting providers and diagnostic providers such as Sentry.

These providers may process information on behalf of Envision Africa for authorised operational, hosting, security, diagnostic or support purposes.

Envision Africa is not responsible for independent services that are accessed outside LensTrac and are not controlled by Envision Africa.

30.NO SALE OF PERSONAL INFORMATION OR ADVERTISING PROFILING

Envision Africa does not sell or rent personal information collected through LensTrac.

LensTrac is not intended to use:

Patient numbers;
Doctor information;
Practice information;
Billing information; or
Lens transaction information

for third-party behavioural advertising or unrelated advertising profiling.

Information collected through LensTrac is used for the business, transactional, security, support, legal and regulatory purposes described in this Privacy Policy.

31.CHANGES TO THIS PRIVACY POLICY

Envision Africa may update this Privacy Policy periodically to reflect:

Changes to LensTrac;
Changes to the information processed;
Changes to Microsoft Dynamics 365 or supporting services;
Changes to legal or regulatory requirements; or
Changes to Envision Africa’s operational or security practices.

The updated version will be published with a revised “Last updated” date.

Material changes may also be communicated through LensTrac, the Envision Africa website or directly to affected doctors and practices where appropriate.

32.CONTACT DETAILS

For privacy enquiries, access requests, correction requests, access-removal requests or data-deletion requests, contact:

Envision Africa: