Privacy Policy

1. Who we are

Welo Health (Pty) Ltd(“Welo”, “we”, “us”, “our”) operates the Welo platform, which provides employer-sponsored healthcare services including virtual consultations, medicine delivery, home nurse visits, and workforce health reporting. We are incorporated and registered in South Africa with our principal place of business in Cape Town.

We are the responsible party for personal information processed through our services. If you have any questions about this policy, please contact us at support@welo.health.

2. Information we collect

2.1 Information you provide

• Name, surname, and contact details (email address, phone number)
• Identity or employee number where required for healthcare services
• Employer and employment-related details
• Medical aid membership information
• Health information including symptoms, diagnoses, medical history, and prescribed medication
• Payment information, processed securely via our payment partners

2.2 Information collected automatically

• Device type, operating system, and browser
• IP address and approximate location
• Pages visited, features used, and time spent on the platform
• Cookies and similar tracking technologies (see Section 9)

2.3 Information from third parties

• Health and claims data shared by medical aid schemes or your employer, with your consent
• Clinical notes and referral information from healthcare providers in our network

3. How we use your information

We use the information we collect to:

• Provide and administer healthcare services, including virtual consultations, medicine delivery, and home nursing visits
• Manage your account and the employer health programme you are enrolled in
• Communicate with you about appointments, test results, prescriptions, and service updates
• Process payments and maintain financial records
• Generate anonymised, aggregated workforce health insights for employers (never individual-level data without your explicit consent)
• Improve and develop our platform, services, and clinical protocols
• Comply with our legal and regulatory obligations
• Detect fraud and maintain the security of our systems

4. Legal basis for processing

We process your personal information only where we have a lawful basis to do so. Depending on the activity, we rely on one or more of the following:

• Your consent, particularly for the processing of health information
• Performance of a contract, to deliver the services you or your employer has engaged us to provide
• Compliance with a legal obligation under South African law
• Our legitimate interests, where those interests do not override your rights and freedoms

Where we rely on consent, you may withdraw it at any time by contacting us. Withdrawal will not affect processing that took place before the withdrawal, but may affect our ability to continue providing certain services.

5. Health information

Health information receives heightened protection under South African law. We process it only where:

• You have given us explicit consent
• Processing is necessary for your proper treatment or care
• Processing is required to comply with a legal obligation
• You have deliberately made the information public

All health information is subject to strict access controls. Our clinical team members are bound by professional confidentiality obligations in addition to our internal data-handling policies.

6. Sharing your information

We do not sell your personal information. We share it only in the following circumstances:

6.1 Within our network of care

• Registered healthcare practitioners conducting your consultation or treatment
• Pharmacies fulfilling your prescription
• Nursing and home-care providers delivering in-home services

6.2 With your employer

We share only anonymised and aggregated insights with employers about the health of their workforce. We do not share identifiable clinical or personal health information with your employer without your explicit consent.

6.3 With service providers

We use trusted third-party service providers to operate our platform, including cloud hosting, payment processing, and communication services. These providers are bound by data processing agreements and may only process your information on our documented instructions.

6.4 Legal requirements

We may disclose personal information if required by law, court order, or a regulatory authority with jurisdiction over Welo.

7. Cross-border transfers

Some of our service providers operate outside South Africa. When we transfer personal information across borders, we ensure that appropriate safeguards are in place, such as standard contractual clauses or transfers to countries that offer a comparable level of data protection.

8. Data retention

We retain personal information for as long as necessary to fulfil the purposes set out in this policy, or as required by law. Our main retention periods are:

• Health records: a minimum of 6 years from the date of last service, in line with the National Health Act
• Financial records: 5 years, in line with the Companies Act
• Account data: for the duration of your active account plus 2 years after closure
• Marketing preferences: until you unsubscribe or withdraw consent

When information is no longer needed, we delete, destroy, or de-identify it securely.

9. Cookies

Our website uses cookies and similar technologies to improve your experience and gather analytics. We use:

• Essential cookies required for the website and platform to function correctly
• Analytics cookies to understand how visitors use our site (data is anonymised)
• Preference cookies to remember your settings and choices

You can manage cookie settings through your browser at any time. Disabling certain cookies may affect the functionality of the platform.

10. Security

We implement appropriate technical and organisational measures to protect your information against loss, theft, unauthorised access, disclosure, alteration, or destruction. These measures include:

• Encryption of data in transit (TLS) and at rest
• Role-based access controls limiting who can view personal and health information
• Regular security assessments and penetration testing
• Staff training on data protection and confidentiality obligations
• Incident response procedures for detecting and managing data breaches

In the event of a breach that is likely to affect your rights, we will notify the relevant regulator and affected individuals in accordance with applicable law.

11. Your rights

You have the right to:

• Know what personal information we hold about you and how we use it
• Access a copy of your personal information
• Request correction of inaccurate or incomplete information
• Request deletion of your personal information, subject to legal retention obligations
• Object to or restrict certain types of processing
• Withdraw consent where processing is based on consent
• Lodge a complaint with the Information Regulator of South Africa

To exercise any of these rights, contact us at support@welo.health. We will respond within 30 days of receiving your request.

12. Children

Our services are not directed at children under the age of 18. We do not knowingly collect personal information from minors without the consent of a parent or legal guardian. If you believe we have inadvertently collected information about a minor, please contact us immediately so we can address it.

13. South African residents

If you are based in South Africa, your personal information is also protected by the Protection of Personal Information Act, 4 of 2013 (“POPIA”). Our POPIA Privacy Notice provides additional detail on how we comply with that Act, including the role of our Information Officer and your right to complain to the Information Regulator.

14. Changes to this policy

We may update this policy from time to time to reflect changes in our practices or legal obligations. When we make material changes, we will notify you by email or through a prominent notice on our platform. The effective date at the top of this page shows when the current version was last updated.

15. Contact us

If you have any questions or concerns about this policy or how we handle your information, please contact us:

South African residents may also contact the Information Regulator of South Africa: