Steady privacy policy #

Last updated 30 October 2026, for Steady 1.0.

Steady is a check-in app that connects you with your psychology practice between sessions. This policy explains what the app collects, where it goes and who can see it. It applies to the Steady app on iPhone and Android and to the Steady web app.

Who is responsible #

Your practice decides why and how your information is used. Under the Protection of Personal Information Act (POPIA) it is the responsible party. Its consent statement, which you read and accept when you join, sets out how it uses your information for your care.
OpenWorks IT (Pty) Ltd makes Steady and runs the practice’s server on its behalf. Under POPIA it is an operator: it handles your information only on the practice’s instructions and keeps it secure and confidential.

What Steady collects #

Your account: your name, email address and password. Your password is stored scrambled (hashed), never as text.
What you share: your check-in ratings, anything you choose to write, your questionnaire answers and exercises you complete.
Watch data, only if you turn it on: a daily summary from Apple Health (iPhone) or Health Connect (Android) of your heart rate, sleep, steps and blood oxygen. The summary is worked out on your phone, and only the summary is sent. Steady never writes anything to Apple Health or Health Connect.
A notification address for your phone, so the app can tell you when your psychologist sends you something.
When you agreed: the version and time you accepted the privacy notice, the practice’s consent statement and, if you turn it on, watch data sharing.

Steady does not collect your location, contacts, photos or advertising identifiers. It has no adverts, no analytics and no tracking.

Where it is kept #

On your practice’s own Steady server, in South Africa. It isn’t stored in the app’s makers’ own systems or in any cloud service abroad. The connection is always encrypted (HTTPS), and backups are encrypted before they are stored.

Who can see it #

You can see your own check-ins and results.
Your psychologist can see what you share. If they share your record with a colleague at the practice, you can see who in the app’s settings.
The practice’s master clinician and administrator see your name and whether your app is set up and connected (for example whether notifications and watch sharing work), not what you share.
OpenWorks IT support looks after the server and the practice’s staff accounts. It does not see patients’ information, not even names.
Your psychologist may add what you share to your clinical record at the practice, for example in the practice’s note-taking tools.

Every time a psychologist opens a patient’s information, it is logged, and the practice can show you who looked at your information.

Your information is never sold and never used for advertising. Data from Apple Health is never shared with anyone except your practice, and only because you chose to share it.

Notifications and email #

Notifications are delivered through Apple (iPhone) or a notification service of your choice (Android). They never contain your name, scores, answers or anything you wrote, only a prompt to open the app.

Steady sends email only to practice staff, about their own account (for example a code to link a new phone), from steadyapp.co.za. Nothing about patients is ever sent by email.

How staff access is protected #

Practice staff sign in with a password, a code from an authenticator app and a device they have linked with a code sent to their email. On phones the app locks with the phone’s own screen lock. Sensitive actions, such as exports and password resets, ask staff to confirm it’s them first. A lost phone can be locked from any device.

How long it is kept #

Your check-ins and results become part of your clinical record, which your practice keeps for as long as health record laws and HPCSA guidelines require. In-app notifications are deleted after 90 days.

Your choices and rights #

You can stop sharing watch data at any time in the app’s settings. Nothing more is sent from then on.
You can ask to delete your account in the app: Settings, then Delete my account. No longer have the app? Ask your practice, or email info@openworks.co.za from the address you signed up with and we’ll pass your request on. Your request goes to your practice, which deletes your Steady account and everything Steady holds about you within 30 days and emails you when it’s done. South African law requires your psychologist to keep your clinical records (for at least six years after your last contact, until your 21st birthday if you were under 18, and for life in some cases; HPCSA Booklet 9), so your practice first copies what belongs in your clinical file. A log of who opened your record, and when, is also kept.
Under POPIA you can ask to see the information held about you, ask for it to be corrected, or object to how it is used. Ask your practice first. You can also contact us below.
You can complain to the Information Regulator at inforegulator.org.za.

Not an emergency service #

Steady is not a medical device. It doesn’t diagnose, predict or raise alerts, and it isn’t monitored around the clock. If you need help urgently, use the crisis numbers shown in the app or contact emergency services.

Contact #

OpenWorks IT (Pty) Ltd, Gqeberha, South Africa · info@openworks.co.za

If this policy changes, the new version will be posted on this page with a new date.