Pricing research · 20 June 2026 Fresh 2026 South African market data. The short version: R420k AI-accelerated is already the discount on a R600k–R1.8M build, and R100k is a fair activation fee, not a fair price.
SA compliant healthcare/medical app: R500,000–R1,800,000+. Global telemedicine equivalent (e-prescriptions + secure video + scheduling): $70k–$120k (~R1.3M–R2.2M).
“POPIA/HIPAA-style compliance adds ~20–30% to project cost.” New SA health-data regulations are in force since 6 March 2026, penalties up to R10 million.
Naveck (Jun 2026): custom web application R100k–R450k; SaaS platform R200k–R900k; custom e-commerce R40k–R180k. All 2025 benchmarks re-confirmed.
ProCompare (SA’s main quote aggregator): simple CMS site R3,800–R6,300; custom site R38k–R88k. “SME floor R4,500–R8,500” for a professional small-business site.
Among $150k+ agencies, value-based pricing is primary 62% of the time vs hourly 8%. AI-native shops price 20–30% below traditional dev shops, so your number is already the discount.
Cape Town R700–R1,200/hr; Joburg R500–R1,000/hr. Yet OfferZen 2026: senior full-stack salaries fell 6–7% YoY as AI compressed the senior premium.
SA e-commerce retainer R3,500–R10,000+/mo; SaaS rule-of-thumb 15–30% of build cost per year → on a ~R600k–R1.2M build that’s R7,500–R30,000/mo.
50% deposit on approval / 50% on delivery is the SA standard; 50/25/25 milestones for larger builds. SA shops decline financing: “does not grant credit facilities whatsoever.”
WaaS minimum terms are 12–24 months, with ownership transfer after the term. ProCompare warns total over 24–36 months exceeds the once-off cost, which is what protects the builder.
We're the “operator” (processor); Revéra is the “responsible party.” The primary statutory liability is the client's, but we are exposed via contract and negligence, and hosting raises that. Not zero. Contractually controllable.
“A data subject or… the Regulator may institute a civil action for damages against a responsible party.” The R10m fines and s99 claims name the responsible party, not the operator.
POPIA s99 ↗The operator must keep data confidential and “establish and maintain the security measures referred to in section 19,” and notify the client “immediately” on a breach (s22). Hosting puts us in control of exactly those safeguards.
POPIA s21 ↗“Any right of recourse that the responsible party may have… will rest in the contract between the parties.” The client pays the Regulator, then claims back from us under the operator agreement, and a negligence (delict) claim can route liability to us directly.
VDT Attorneys ↗Written operator agreement with liability cap + indemnity, cyber/PI insurance, a “client owns regulatory compliance” carve-out and a wired-in s22 breach-notification flow. The proposal already does the first and third.
Fasken ↗Pricing read-through: we carry operator risk and host medical data, another reason the fee can't sit at the SME-website floor.
Pin the platform at R420k (M1 R280k + M2 R140k), keep the R880k market anchor visible to re-frame the client off the website floor and lead the cost-sensitive conversation with the Platform-as-a-Service option: ~R100k to activate + R19,500/mo over a 36-month term (≈R802k all-in), with IP transferring at end of term. It’s the one low-upfront structure the market says won’t expose us. Don’t discount further, and don’t let “R100k” become the spoken headline price.