Privacy Notice

1. Introduction

PepUp respects your privacy and is committed to processing personal information lawfully, reasonably and securely.

This Privacy Policy explains:

• What personal information PepUp collects;
• Where that information comes from;
• Why PepUp processes it;
• Who PepUp may share it with;
• How long it may be retained;
• How PepUp protects it; and
• Your rights under the Protection of Personal Information Act 4 of 2013, commonly referred to as POPIA.

This policy applies to the PepUp website, applications, questionnaires, metabolic-health programmes, administrative services, the PepUp Shop and related communications.

It should be read together with PepUp’s:

• Terms and Conditions;
• Medical Disclaimer;
• Patient Consent documentation;
• Practitioner terms
• Pharmacy and medicine-supplier terms
• Laboratory terms
• PepUp Shop Terms and Returns Policy

2. Responsible Party

For the personal information processed for PepUp’s own platform, administrative, programme-management, payment and business purposes, the responsible party is:

Legal entity: PepUp (Pty) Ltd

Trading name: PepUp

Company registration number: K2026467043

Registered and physical address: 12 Bordeaux Ave, Constantia, 7806, Cape Town, SA

Email: security@pepup.co.za

PepUp’s registered Information Officer is:

Name: Peter Martin

Email: pete@pepup.co.za

PepUp may act as an operator for an independent healthcare practitioner or other service provider in limited circumstances where it processes information solely on that provider’s documented instructions.

3. Independent Service Providers

PepUp is a technology and care-coordination platform.

PepUp connects patients with independent healthcare practitioners participating in PepUp’s partner doctor network. PepUp may also facilitate communication with independent laboratories, pharmacies and other authorised medicine suppliers.

Independent providers are responsible for their own professional or regulated services.

Depending on the service, an independent doctor, laboratory, pharmacy, pharmacist, manufacturer or other authorised supplier may be a separate responsible party under POPIA. Their processing of your information will also be governed by their own privacy notices, professional duties and legal obligations.

PepUp does not control an independent practitioner’s clinical records, professional decisions or statutory record-retention obligations merely because the practitioner uses PepUp’s platform.

4. Information We Collect

PepUp may collect the following categories of personal information.

4.1 Identity and contact information

This may include:

• Full name;
• Identity number or other identity-verification information;
• Date of birth;
• Age;
• Sex or gender information where relevant to the programme;
• Email address;
• Telephone or WhatsApp number;
• Physical or delivery address;
• Preferred language; and
• Account login information.

4.2 Health and wellness information

This may include information you provide through questionnaires, uploaded documents, communications and programme tracking, such as:

• Height and weight;
• Body measurements;
• Health and wellness goals;
• Symptoms;
• Medical history;
• Existing health conditions;
• Surgical history;
• Allergies;
• Current and previous medicines;
• Supplements;
• Family medical history;
• Nutrition and eating patterns;
• Exercise and activity;
• Sleep;
• Alcohol, smoking or substance-use information;
• Reproductive or pregnancy-related information where relevant;
• Mental-health information where relevant;
• Blood-test and laboratory results;
• Uploaded health records;
• Side effects;
• Programme progress; and
• Information relevant to contraindications, clinical risk or emergency escalation.

Health information is special personal information under POPIA and is subject to additional safeguards.

4.3 Consultation and care-coordination information

PepUp may process information relating to:

• Practitioner selection or matching;
• Appointment bookings;
• Consultation dates and attendance;
• Practitioner communications;
• Laboratory requests and bookings;
• Prescription-routing instructions;
• The pharmacy or medicine supplier selected or authorised by you;
• Programme enrolment;
• Programme completion;
• Follow-up requirements; and
• Administrative status updates.

PepUp may store copies or records of prescriptions, laboratory results or clinical communications where this is necessary to operate the platform, facilitate the patient journey, comply with law or act on the documented instructions of an independent provider.

4.4 Payment and transaction information

PepUp may process payments for:

• PepUp platform, membership, subscription, programme or administrative fees;
• The purchase price and delivery charges for products sold through the PepUp Shop; and
• Professional fees that PepUp is authorised to collect as a disclosed payment-collection agent for an independent healthcare practitioner.

Where PepUp collects a practitioner fee, PepUp may process and share with that practitioner information including the patient’s identity, consultation reference, amount charged, payment status, refund status, chargeback status and settlement information.

The practitioner remains the supplier of the professional healthcare service. PepUp does not become the provider of that professional service merely because it collects the fee.

PepUp does not accept or process payment from patients for prescription medicines. Medicine costs, compounding fees, dispensing fees and related prescription-medicine delivery charges are invoiced directly by the independent pharmacy, pharmacist, manufacturer or other authorised medicine supplier.

Payments may be processed through PayStack or another payment processor identified to you at checkout. PepUp may receive limited transaction information from its payment processor, including:

• Payer name;
• Transaction reference;
• Payment amount;
• Payment date;
• Payment status;
• Refund and chargeback information; and
• Limited payment-method information.

PepUp does not intentionally store complete payment-card numbers or card security codes where these are processed directly by the payment provider.

4.5 Pepup Shop, order and delivery information

When you use the PepUp Shop, PepUp may process information relating to:

• Products viewed, added to a cart or purchased;
• Order number and purchase history;
• Delivery recipient, address and instructions;
• Courier, fulfilment and tracking information;
• Returns, refunds and exchanges;
• Product complaints, warranty claims and adverse reactions;
• Product batch, lot or expiry information where relevant;
• Product-safety notices and recalls; and
• Discount, affiliate, promotional and referral codes.

4.6 Technical and usage information

When you use PepUp’s website or platform, PepUp may collect:

• Internet Protocol address;
• Browser and device type;
• Operating system;
• Login activity;
• Pages and features used;
• Date, time and duration of activity;
• Referral source;
• Cookie identifiers;
• Approximate location derived from your device or IP address;
• Error and performance information; and
• Security and audit logs.

4.7 Communications

PepUp may retain information contained in:

• Emails;
• Support requests;
• Telephone calls, where lawfully recorded;
• WhatsApp or SMS communications;
• Platform messages;
• Complaints;
• Feedback;
• Survey responses; and
• Consent and communication-preference records.

You will be informed where a telephone call is recorded.

4.8 Marketing and affiliate information

PepUp may process:

• Marketing consent;
• Communication preferences;
• Advertisement interactions;
• Campaign source;
• Affiliate or referral code;
• Referral date;
• Conversion status; and
• Information needed to prevent duplicate or fraudulent referrals.

PepUp does not provide affiliates or advertising platforms with detailed questionnaire responses, prescriptions, diagnoses, laboratory results, identifiable clinical information or identifiable PepUp Shop purchase histories.

5. Sources of Information

PepUp may collect information:

• Directly from you;
• From an authorised representative or competent person acting for you;
• From an independent practitioner with your authority;
• From a laboratory;
• From a pharmacy or authorised medicine supplier;
• From PepUp’s payment processor;
• From identity-verification providers;
• From website cookies and similar technologies;
• From affiliates or referral partners;
• From publicly available sources where lawful; and
• From product suppliers, warehouses, fulfilment providers and couriers;
• From service providers operating the platform on PepUp’s behalf.

Where information is obtained from another provider, that provider must have authority to share it with PepUp.

6. Information You Must Provide

Certain information is required for PepUp to:

• Create your account;
• Verify your identity;
• Assess whether a programme is administratively suitable;
• Connect you with an independent practitioner;
• Facilitate consultations;
• Process PepUp fees, practitioner fees collected as agent or PepUp Shop orders;
• Route information securely;
• Respond to safety concerns; or
• Comply with legal obligations.

Other information is optional and will be identified as such.

You are not legally required to join PepUp. However, if you do not provide information required for a particular service, PepUp or an independent practitioner may be unable to provide that service safely or effectively.

Providing information to PepUp does not guarantee that a practitioner will consider you clinically suitable for treatment or issue a prescription.

7. How PepUp Uses Personal Information

PepUp may process personal information to:

• Register and administer your account;
• Verify your identity;
• Provide access to a selected programme;
• Present and administer health questionnaires;
• Generate a structured metabolic-health profile;
• Connect you with independent practitioners;
• Facilitate appointment bookings and telehealth consultations;
• Facilitate laboratory bookings and information exchange;
• Securely transmit information or prescriptions at the direction of a practitioner and with your authority;
• Facilitate communication with a selected pharmacy or authorised medicine supplier;
• Track programme participation and progress;
• Send service, safety, appointment and programme reminders;
• Provide customer and technical support;
• Process PepUp’s platform or programme fees, practitioner fees collected as agent, and PepUp Shop payments;
• Process and fulfil PepUp Shop orders;
• Manage stock, deliveries, returns, refunds and exchanges;
• Provide product-safety communications and manage product complaints or recalls;
• Prevent fraud and misuse;
• Maintain security and audit records;
• Investigate complaints and incidents;
• Improve platform functionality and patient experience;
• Produce aggregated or de-identified analytics;
• Meet tax, accounting and legal obligations;
• Establish, exercise or defend legal rights;
• Respond to regulators, courts or law-enforcement authorities; and
• Send marketing communications where permitted.

PepUp does not use questionnaire results to guarantee a diagnosis, prescription or treatment.

8. Lawful Grounds for Processing

PepUp may process personal information on one or more of the following grounds:

• You have given voluntary, specific and informed consent;
• Processing is necessary to enter into or perform PepUp’s agreement with you;
• Processing is required to comply with a legal obligation;
• Processing protects your legitimate interests;
• Processing protects PepUp’s or another person’s legitimate interests, where those interests do not unjustifiably interfere with your privacy;
• Processing is necessary for the establishment, exercise or defence of a right or obligation in law; or
• Another lawful authorisation for processing special personal information applies.

PepUp will seek express consent where appropriate for health information, information sharing, prescription routing and other sensitive processing.

Consent to process health information is obtained separately from consent to receive marketing communications.

9. Withdrawal of Consent

You may withdraw consent by contacting security@pepup.co.za.

Withdrawal of consent:

• Does not affect processing that occurred lawfully before withdrawal;
• Does not necessarily require deletion of information that PepUp or an independent provider must retain by law;
• Does not prevent processing based on another lawful ground; and
• May mean that PepUp can no longer provide some or all platform services.

Withdrawal of consent from PepUp does not automatically withdraw consent previously given to an independent doctor, laboratory, pharmacy or other service provider. You may need to contact that provider separately.

10. Questionnaires, Profiling and Automated Processing

PepUp uses questionnaire answers and other information to generate structured metabolic-health profiles, programme suggestions, reminders and administrative prompts.

These outputs may involve automated processing.

PepUp’s automated outputs are intended to:

• Organise information;
• Identify possible risk indicators;
• Highlight matters for discussion;
• Assist with programme administration; and
• Support an independent practitioner’s review.

An automated profile does not independently:

• Make a medical diagnosis;
• Determine clinical eligibility;
• Issue a prescription;
• Select a medicine or dose; or
• Replace the independent judgment of a registered healthcare practitioner.

A practitioner remains responsible for clinical decisions.

Where a decision may have a legal or substantial effect on you, PepUp will not rely solely on automated processing where doing so would be prohibited by law.

11. Sharing Personal Information

PepUp may share relevant personal information with the following recipients where necessary, lawful and appropriately protected.

11.1 Independent healthcare practitioners

Information may be shared with participating independent practitioners for:

• Consultation;
• Clinical assessment;
• Treatment decisions;
• Testing;
• Prescribing;
• Monitoring; and
• Follow-up.

11.2 Laboratories

Information may be shared with an independent laboratory to:

• Arrange tests;
• Identify the patient;
• Deliver test requests; and
• Return results to the appropriate practitioner or patient.

11.3 Pharmacies and authorised medicine suppliers

With your authority or at the direction of the prescribing practitioner, relevant information may be shared with:

• A pharmacy registered with the South African Pharmacy Council;
• A pharmacist or person lawfully authorised to dispense;
• A SAHPRA-licensed manufacturer or establishment acting within the scope of its licence and any additional authority required to supply a medicine to a patient; or
• Another lawful medicine supplier.

Such information may include identity information, contact information, the prescription and information required to dispense, supply or deliver the prescribed medicine safely.

PepUp does not receive payment from patients for prescription medicines.

11.4 Shop suppliers, fulfilment and courier providers

PepUp may share the minimum information necessary to process and fulfil a PepUp Shop order with a product supplier, manufacturer, warehouse, fulfilment provider, courier, returns processor or product-safety service provider.

This information may include the customer’s name, contact information, delivery address, order contents, delivery instructions, tracking information, return details and product batch or lot information where relevant.

11.5 Technology and operational service providers

PepUp may use providers for:

• Cloud hosting;
• Database management;
• Identity verification;
• Video consultations;
• Messaging;
• Email and SMS;
• Customer support;
• Analytics;
• Cybersecurity;
• Software development;
• Data backup;
• Accounting; and
• Payment processing.

These providers may process information only for authorised purposes and must be subject to appropriate confidentiality, security and data-processing obligations.

11.6 Professional advisers and insurers

PepUp may disclose information to its:

• Attorneys;
• Accountants;
• Auditors;
• Compliance advisers;
• Insurers; and
• Other professional advisers.

Only information reasonably necessary for the relevant purpose should be disclosed.

11.7 Authorities and legal recipients

PepUp may disclose information where required or permitted by law, including to:

• Courts;
• The Information Regulator;
• Health regulators;
• Law-enforcement authorities;
• Tax authorities; and
• Other competent regulatory bodies.

PepUp may also disclose information where reasonably necessary to protect a person from serious harm, subject to applicable law.

12. Payments and Independent Provider Billing

PepUp processes payments for its own platform, programme, administrative and PepUp Shop services.

A participating practitioner may appoint PepUp as a limited payment-collection agent for the practitioner’s professional fees. Where this applies, PepUp may display and collect the practitioner fee, provide payment confirmation, record the payment against the consultation, administer an authorised refund or chargeback and settle the amount with the practitioner under PepUp’s agreement with that practitioner.

Payment received by PepUp as the practitioner’s authorised collection agent satisfies the patient’s corresponding payment obligation to the practitioner to the extent of the amount successfully received and not reversed.

The practitioner remains responsible for the professional service and for any professional or tax invoice required by law. PepUp’s role in collecting the fee does not give PepUp authority to control clinical decisions or require a prescription.

PepUp may process the purchase price and delivery charge for products sold through the PepUp Shop. Prescription medicine charges remain separate and are processed directly by the relevant pharmacy or other lawfully authorised medicine supplier.

13. Selling Personal Information

PepUp does not sell identifiable personal or health information.

PepUp does not provide affiliates with access to patient medical records or prescriptions.

PepUp may use aggregated or properly de-identified information for:

• Business planning;
• Service improvement;
• Statistical analysis;
• Clinical-governance analysis; and
• Reporting.

PepUp will take reasonable steps to prevent de-identified information from being reconstructed into identifiable information.

14. Direct Marketing

PepUp may send marketing communications by email, SMS, WhatsApp, telephone or push notification where:

• You have given the required consent;
• The communication is otherwise permitted by POPIA; or
• You are an existing customer and the communication relates to similar PepUp services, subject to applicable requirements.

You may opt out at any time by:

• Using the unsubscribe mechanism in the communication;
• Changing your communication preferences; or
• Contacting support@pepup.co.za.

Opting out of marketing does not prevent PepUp from sending necessary service, security, consultation, payment or safety communications.

PepUp will retain an appropriate suppression record after an opt-out so that it can respect your preference.

15. Cookies and Browser Storage

PepUp does not currently use advertising, analytics or cross-site tracking cookies.

PepUp uses limited first-party cookies and browser storage only where required for essential website functions, account authentication, security, preferences, assessment continuity and user-requested shopping-basket functionality.

These technologies, their purposes and retention periods are disclosed through this Privacy Notice and relevant platform information. Because the current technologies are necessary to provide functions requested by the user or to protect the platform, PepUp does not currently display a non-essential cookie-consent tool.

PepUp will introduce an appropriate consent mechanism before enabling any non-essential analytics, advertising or cross-site tracking technology.

PepUp will not transmit questionnaire answers, laboratory results, prescriptions, diagnoses, identifiable clinical information or identifiable Shop purchase histories to social-media or advertising platforms.

16. International Processing and Cloud Services

Some of PepUp’s technology, hosting, support, communication or analytics providers may process information outside South Africa.

PepUp will transfer personal information outside South Africa only where the transfer complies with section 72 of POPIA and appropriate safeguards are in place.

These safeguards may include:

• An applicable law providing adequate protection;
• A binding agreement requiring POPIA-equivalent protection;
• Your consent;
• A transfer necessary to perform a contract; or
• Another permitted ground under POPIA.

Further information about relevant service-provider locations and safeguards may be requested from security@pepup.co.za.

Certain international transfers of special personal information or children’s information may require prior authorisation from the Information Regulator.

17. Retention

PepUp retains personal information only for as long as reasonably necessary for the purpose for which it was collected or subsequently lawfully processed, unless:

• A law requires a longer period;
• PepUp reasonably needs the record for a lawful function;
• Retention is required by contract;
• The information is required for legal proceedings or the defence of a claim; or
• You have consented to an appropriate longer period.

Retention periods differ according to the record type.

PepUp may retain:

• Account and programme records for the duration of the relationship and an appropriate period thereafter;
• Consent and privacy records for as long as required to demonstrate compliance;
• Payment and tax records for the legally required financial-retention period;
• PepUp Shop order, delivery, return and refund records for the period required for transaction administration, consumer rights, tax and legal purposes;
• Product complaint, adverse-reaction, warranty and recall records for as long as reasonably required for safety, legal and regulatory purposes;
• Security and audit logs for a risk-based period;
• Complaint and incident records for as long as required to resolve and document the matter;
• Marketing opt-out records for as long as necessary to honour the opt-out; and
• Health-related information for the period required for care coordination, legal compliance, safety, contractual obligations and legitimate legal purposes.

Independent practitioners, laboratories, pharmacies and medicine suppliers determine the retention periods for the clinical, laboratory, dispensing and pharmaceutical records for which they are responsible.

Deleting a PepUp account does not automatically delete records held independently by a doctor, laboratory, pharmacy or medicine supplier.

Once PepUp is no longer authorised to retain information, it will delete, destroy or de-identify it in a manner that reasonably prevents reconstruction.

18. Security

PepUp uses appropriate and reasonable technical and organisational measures designed to protect personal information against:

• Loss;
• Damage;
• Unauthorised destruction;
• Unlawful access;
• Unauthorised disclosure;
• Alteration; and
• Other unlawful processing.

Measures may include:

• Encryption in transit;
• Appropriate encryption at rest;
• Role-based access controls;
• Multi-factor authentication;
• Database access restrictions;
• Security logging and monitoring;
• Backup and recovery procedures;
• Secure software-development practices;
• Staff confidentiality obligations;
• Security training;
• Vendor due diligence;
• Incident-response procedures; and
• Periodic security assessments.

No electronic platform can guarantee absolute security. Users must protect their account credentials and notify PepUp promptly of suspected unauthorised access.

19. Security Compromises

Where there are reasonable grounds to believe that personal information has been accessed or acquired by an unauthorised person, PepUp will investigate and take reasonable steps to contain and mitigate the incident.

Where required under POPIA, PepUp will notify:

• The Information Regulator; and
• Affected data subjects.

Notifications may include:

• What happened;
• The possible consequences;
• Measures PepUp has taken;
• Recommended protective steps; and
• Available contact information.

An operator processing information for PepUp is required to notify PepUp immediately of a relevant security compromise.

20. Your Rights

Subject to POPIA and other applicable law, you may have the right to:

• Ask whether PepUp holds personal information about you;
• Request access to your personal information;
• Request correction of inaccurate, incomplete, misleading or outdated information;
• Request deletion or destruction where PepUp is no longer authorised to retain the information;
• Object to certain processing;
• Withdraw consent;
• Object to direct marketing;
• Request information about the identity of third parties that have had access to your information where applicable;
• Complain to PepUp;
• Lodge a complaint with the Information Regulator; and
• Challenge certain decisions based solely on automated processing.

These rights are not absolute. PepUp may refuse or limit a request where permitted or required by law.

PepUp may require reasonable identity verification before responding to a request.

Requests may be submitted to security@pepup.co.za. Prescribed POPIA forms may also be used where applicable.

Requests relating to records controlled by an independent doctor, laboratory, pharmacy or medicine supplier should also be directed to that provider.

21. Children’s Information

Adult-only platform

PepUp’s services are intended for persons aged 18 years or older.

PepUp does not knowingly offer its programmes directly to children. If PepUp becomes aware that a child’s information has been collected without appropriate authority, it will take reasonable steps to restrict or delete that information, subject to applicable legal obligations.

22. External Websites and Services

PepUp may provide links or integrations to websites and systems operated by independent practitioners, laboratories, pharmacies, payment processors, product suppliers, manufacturers, fulfilment providers, couriers or other providers.

PepUp is not responsible for the privacy practices of an independent provider acting as a separate responsible party.

You should review that provider’s privacy notice before supplying information directly to it.

23. Changes to This Policy

PepUp may update this Privacy Policy to reflect changes in:

• Its services;
• Technology;
• Providers;
• Processing activities;
• Law; or
• Regulatory guidance.

The updated policy will be published with a revised “last updated” date.

Where a change materially affects how PepUp uses health information or other sensitive information, PepUp will provide an appropriate additional notice and seek consent where required.

24. Contacting PepUp

Privacy questions, complaints and rights requests may be sent to:

Information Officer

PepUp (Pty) Ltd

Email: security@pepup.co.za

PepUp will acknowledge and address requests within the periods required by applicable law.

25. Complaints to the Information Regulator

You may lodge a complaint with the Information Regulator if you believe PepUp has processed your personal information unlawfully or has not dealt appropriately with a privacy request.

Complaints may be submitted through the Information Regulator’s official eServices portal or using the prescribed POPIA complaint process.

PepUp encourages you to contact security@pepup.co.za first so that PepUp has an opportunity to investigate and address your concern.