Privacy notice.

Your health is personal. This notice explains what we collect, why, who sees it and what you can ask us to do with it, under the Protection of Personal Information Act (POPIA).

Who we are

PRICK is the responsible party for your personal information. Our Information Officer is Norwyn K, on 082 401 6066. Our clinical lead is Dr Kylee Montgomerie, on 082 457 1926.

What we collect

• Your account: email address and a password (we never see or store your password ourselves).
• Your details: name, date of birth, South African ID or passport number, mobile number, province and city.
• Your health: your screening answers, including medical history, medicines, allergies, lifestyle, sleep, mood, reproductive and sexual health, height, weight and anything else you choose to tell us.
• Your pens: the pens you ask about and your clinician's decisions, plans, check-ins and messages.
• A delivery address, if you save one.

Your health answers are special personal information under POPIA. We only process them with your consent and for your care.

Why we use it

• So a registered clinician can decide, safely and lawfully, whether a pen is right for you.
• To run your care: plans, reminders, check-ins and messages with your care team.
• To arrange supply and delivery of anything your clinician approves.
• To meet our legal and professional record-keeping duties.
• To send news and offers, only if you said yes. You can stop these at any time.

We do not sell your information, and we never use your health answers for advertising.

Who sees it

• Your clinician sees your screening and health information.
• Our support team sees only what they need to help you, such as your name and where you are in the process. Not your health answers.
• Anyone preparing a delivery sees only your delivery details.
• Google Cloud (Firebase) stores our data and signs you in, as our operator under a written agreement. Your information is stored in Google's Johannesburg data centre in South Africa.

Every time staff open or change a record, it is logged.

How we protect it

Information is encrypted in transit and at rest, access is limited by role, staff sign in with two-step verification, and only your own clinician can open your clinical record.

How long we keep it

We keep health records for as long as the law and professional rules require (generally at least six years after your last contact with us), then delete or anonymise them.

Your rights

You can ask to see the information we hold about you, ask us to correct or delete it, object to how we use it, or withdraw your consent. You can withdraw consent in your account under My health, or contact our Information Officer. Withdrawing consent stops new processing, but we may need to keep some records by law.

If you are unhappy with how we handle your information, please tell us first. You may also complain to the Information Regulator (South Africa) at inforegulator.org.za.

Changes

If we change this notice in a way that matters, we'll tell you and, where needed, ask for your consent again.