POPIA Privacy Notice

1. Who we are

Welo Health (Pty) Ltd (Registration number pending)(“Welo”, “we”, “us”) is the responsible party for personal information processed through our platform, website, and services. Our registered address is Cape Town, South Africa.

Our Information Officer is responsible for ensuring compliance with POPIA. You can reach them at support@welo.health.

2. Personal information we collect

We collect personal information that is necessary for providing our services. The categories of information we process include:

2.1 Information you provide directly

• Name, surname, and contact details (email address, phone number)
• Identity number or employee number (where required for healthcare services)
• Employer and employment-related information
• Medical aid membership details
• Health information, including symptoms, diagnoses, medical history, and prescribed medication
• Payment information (processed securely via our payment partners)

2.2 Information collected automatically

• Device information and browser type
• IP address and approximate location data
• Usage data and interaction logs within our platform
• Cookies and similar tracking technologies (see Section 9)

2.3 Information from third parties

• Health and claims data shared by medical aid schemes or employers, with your consent
• Clinical notes and referral information from healthcare providers in our network

3. Why we process your information

We process your personal information for the following purposes:

• To provide and administer healthcare services, including virtual consultations, medicine delivery, and home nurse visits
• To manage your account and the employer health programme you are enrolled in
• To communicate with you about appointments, results, prescriptions, and service updates
• To facilitate billing and payment for services rendered
• To generate anonymised and aggregated health insights for employers (never individual-level data without your consent)
• To comply with our legal and regulatory obligations under South African law
• To improve our platform, services, and clinical protocols
• To detect fraud and ensure the security of our systems

4. Lawful grounds for processing

We process your personal information only where we have a lawful basis under POPIA. Depending on the activity, we rely on one or more of the following grounds:

• Your consent, particularly for the processing of special personal information such as health data
• Performance of a contract, to deliver the services you or your employer has engaged us to provide
• Compliance with a legal obligation, where processing is required by South African law
• Legitimate interests, where our interests or those of a third party do not override your rights and freedoms

Where we rely on consent, you have the right to withdraw it at any time. Withdrawal of consent will not affect the lawfulness of processing carried out before withdrawal, but may affect our ability to continue providing certain services.

5. Special personal information

Health information is classified as special personal information under POPIA and receives heightened protection. We process health information only where:

• You have provided explicit consent
• Processing is necessary for the proper treatment or care of you as the data subject
• Processing is necessary to comply with an obligation of international public law
• The information has deliberately been made public by you

We apply strict access controls and data handling procedures to all health information. Our clinical team members are bound by professional confidentiality obligations in addition to our internal policies.

6. Sharing your information

We do not sell your personal information. We share it only in the following circumstances:

6.1 Within our network of care

• Registered healthcare practitioners conducting your consultation or treatment
• Pharmacies fulfilling your prescription
• Nursing and home-care providers delivering in-home services

6.2 With your employer

We share aggregated, anonymised insights with employers about the health of their workforce. We do not share identifiable clinical or personal health information with your employer without your explicit consent.

6.3 With service providers

We use trusted third-party service providers to operate our platform (such as cloud hosting, payment processing, and communication services). These operators are bound by data processing agreements and may only process your information on our documented instructions.

6.4 Legal requirements

We may disclose personal information if required to do so by law, court order, or a regulatory authority with jurisdiction over Welo.

7. Cross-border transfers

Some of our service providers may process data outside of South Africa. We ensure that any cross-border transfer of personal information is subject to appropriate safeguards, including standard contractual clauses or transfers to countries that provide an adequate level of protection consistent with POPIA.

8. How long we keep your information

We retain personal information for as long as necessary to fulfil the purposes described in this notice, unless a longer retention period is required by law. Our retention periods are guided by the following:

• Health records: a minimum of 6 years from the date of last service, in line with the National Health Act
• Financial records: 5 years, in line with the Companies Act
• Account data: for the duration of your active account plus 2 years after closure
• Marketing preferences: until you unsubscribe or withdraw consent

When personal information is no longer required, we destroy, delete, or de-identify it securely.

9. Cookies

Our website uses cookies and similar technologies to improve your experience and gather analytics. We use:

• Essential cookies, required for the website and platform to function correctly
• Analytics cookies, to understand how visitors use our site (data is anonymised)
• Preference cookies, to remember your settings and choices

You can control cookie settings through your browser. Disabling certain cookies may affect the functionality of the platform.

10. Your rights under POPIA

As a data subject under POPIA, you have the right to:

• Be notified when your personal information is collected and how it is used
• Access the personal information we hold about you
• Request correction of inaccurate, irrelevant, or incomplete information
• Request deletion or destruction of your personal information, subject to legal obligations
• Object to the processing of your personal information on reasonable grounds
• Submit a complaint to the Information Regulator of South Africa
• Withdraw consent where processing is based on consent

To exercise any of these rights, contact our Information Officer at support@welo.health. We will respond within 30 days of receiving your request.

11. Security

We implement appropriate technical and organisational measures to protect your personal information against loss, theft, unauthorised access, disclosure, alteration, or destruction. These measures include:

• Encryption of data in transit (TLS) and at rest
• Role-based access controls limiting who can access personal and health information
• Regular security assessments and penetration testing
• Staff training on data protection and confidentiality obligations
• Incident response procedures for detecting and managing data breaches

In the event of a breach that is likely to affect your rights and freedoms, we will notify the Information Regulator and affected data subjects in accordance with POPIA's requirements.

12. Children's information

Our services are not directed at children under the age of 18. We do not knowingly collect personal information from minors without the consent of a competent person (a parent or legal guardian). If you believe we have inadvertently collected information about a minor, please contact us immediately.

13. Changes to this notice

We may update this notice from time to time to reflect changes in our practices or legal obligations. When we make material changes, we will notify you by email or through a prominent notice on our platform. The effective date at the top of this page indicates when the current version was last updated.

14. Contact us

If you have any questions, concerns, or requests relating to this notice or the way we handle your personal information, please contact our Information Officer:

You also have the right to lodge a complaint with the Information Regulator of South Africa if you believe your personal information rights have been violated: