Privacy Policy

1. Introduction and Scope

Maatla Healthcare (Pty) Ltd is a company registered with the Companies and Intellectual Property Commission (CIPC) in the Republic of South Africa. In this document, the words we, us, our and Maatla refer to Maatla Healthcare (Pty) Ltd. The words you and your refer to any person who visits our website, uses our services, or receives our messages.

This document applies across everything we operate, which includes our main website at maatlahealthcare.com, the Maatla Academy learning platform at academy.maatlahealthcare.com, the Maatla Facilities dashboard used by clinics, pharmacies and healthcare networks, and our WhatsApp and SMS reminder and check in services, including voice note messages.

This Privacy Policy explains what personal information we collect from you, why we collect it, how we use and store it, who we share it with, how long we keep it, how we protect it, and the rights you have. It covers health related information, which the law treats with special care, and it explains how our WhatsApp and SMS reminders work.

Please read this policy together with our Terms and Conditions, our Cookie Policy, our Data Protection and Security Statement, and our Patient Consent and Rights Notice. Where a topic is covered in more detail in one of those documents, we point you to it.

2. Who We Are and Our Information Officer

Maatla Healthcare (Pty) Ltd is the responsible party for your personal information, which means we decide why and how it is processed. Under the Protection of Personal Information Act, we have an Information Officer who is accountable for how we handle personal information.

3. Key Words Used in This Policy

Personal information. Any information that can identify you, such as your name, contact number, email address, and information about your health.

Special personal information. A category the law protects more strongly. It includes information about your health. Because Maatla helps families manage medication and health, we often work with this kind of information, and we treat it with extra care.

Processing. Anything we do with your information, including collecting, storing, using, sharing and deleting it.

Responsible party and operator. We are the responsible party. An operator is a third party that processes information on our behalf and on our instructions, such as our messaging or hosting providers.

4. The Laws We Follow

Protection of Personal Information Act (POPIA). POPIA is the main South African law that governs how we handle your personal information. It is the primary law that applies to Maatla, and this policy is built around its eight conditions for lawful processing.

General Data Protection Regulation (GDPR). If you access our services from the European Union or European Economic Area, the GDPR may also apply to your information. Where it does, we honour the additional rights it gives you, as set out in section 14.

A note on HIPAA. HIPAA is a United States health privacy law. Maatla is a South African company and is not a HIPAA covered entity, so HIPAA does not directly govern our services. Even so, we have chosen to apply safeguards that are comparable in spirit to good international health data practice, because the trust of the families we serve matters to us.

Other South African laws. Our handling of electronic transactions and communications is also shaped by the Electronic Communications and Transactions Act and the Consumer Protection Act, and our direct marketing is shaped by POPIA. Nothing in this policy limits any right you have under these laws that cannot lawfully be excluded.

5. Information We Collect

5.1 Information you give us. Account and contact details such as your name, phone number and email address. Health and medication information, such as the medication you take, collection dates, reminders you set, and notes relevant to your care. Family or caregiver details where you add another person to your plan, which you must be authorised to share. Payment information needed to process your subscription or purchase, handled through our payment provider. Messages and voice notes you send to us, and your responses to reminders and check ins. Learning information on the Academy, such as courses you enrol in, quiz results, progress and certificates.

5.2 Information we collect automatically. Technical information such as device type, browser, internet protocol address and general location. Usage information about how you interact with our website and platforms. Cookies and similar technologies, explained in our Cookie Policy.

5.3 Information from facilities and partners. Where a clinic, pharmacy or healthcare network uses Maatla Facilities, they may load patient details, including contact numbers and medication collection dates, so that reminders can be sent. In that case the facility is responsible for having the right to share that information and for obtaining the necessary consent, and Maatla acts as an operator processing the information on the facility's instructions.

6. How We Use Your Information

We use your information only for clear purposes, which include the following.

7. Our Lawful Basis for Processing

The law requires us to have a lawful basis for using your information. Depending on the situation, we rely on one or more of the following.

Consent. Consent, which you give when you opt in, for example to receive WhatsApp or SMS reminders. You can withdraw consent at any time.

Contract. Performance of a contract, so that we can deliver the service you signed up for.

Legal duty. Legal obligation, where the law requires us to process information.

Legitimate interest. Legitimate interests, such as keeping our platform secure and preventing fraud, balanced against your rights.

8. Special Care for Health Information

Information about your health is special personal information under POPIA and receives stronger protection. We collect it only where it is needed to deliver the service, we limit who can see it to the people and systems that require it for their role, and we never sell it. We process health information on the basis of your consent or because it is necessary to provide the care service you have asked for. You can withdraw your consent at any time, as explained in section 14.

9. WhatsApp, SMS and Voice Communications

A core part of Maatla is reaching families where they already are, on WhatsApp and by SMS. This section explains how those messages work.

9.1 Consent before we message you. We capture your opt in consent, with a date and time, before we send you any reminder or check in through WhatsApp or SMS in our live service. If we do not have a valid consent record, we do not send you these messages.

9.2 What we send. Messages may include medication reminders, pharmacy collection reminders, check in questions, confirmations, and voice notes that support your care. Message and data charges from your mobile network may apply, and those charges are between you and your network.

9.3 How to stop messages. You can stop receiving these messages at any time by replying STOP to a message, or by emailing info@maatlahealthcare.com. We will act on your request and stop sending you reminders and check ins.

9.4 Providers we use. To deliver these messages we use trusted communication providers. Messages are carried over the WhatsApp and mobile networks, and voice notes may be produced using a text to speech service. These providers process your information on our behalf and on our instructions.

10. Who We Share Your Information With

We do not sell your personal information. We share it only where needed to run the service, and only with parties that are bound to protect it. Our main categories of operators and sub processors are shown below. This list may change as our providers change, and an up to date list is available on request.

We may also share information where the law requires it, to protect our rights or the safety of a person, or as part of a business transfer such as a merger, in which case we will protect your information as described here.

11. Sending Information Outside South Africa

Some of our providers store or process information in other countries. Where your information is transferred outside South Africa, we take steps required by POPIA to make sure it receives a comparable level of protection, for example through provider commitments and appropriate safeguards.

12. How Long We Keep Your Information

We keep your information only for as long as we need it for the purposes in this policy, or for as long as the law requires. When we no longer need it, we delete it or make it anonymous. If you close your account or withdraw consent, we stop using your information for the service and delete it, unless we must keep certain records to meet a legal duty.

13. How We Protect Your Information

We protect your information using technical and organisational measures, including protecting data in storage and in transit, limiting access by role, and training our team. Our full approach is set out in our Data Protection and Security Statement. No system can be perfectly secure, but we work hard to keep your information safe and to respond quickly if something goes wrong.

14. Your Rights

You have rights over your personal information. Subject to the law, these include the following.

Access. Ask what personal information we hold about you and get a copy.

Correction. Ask us to correct information that is wrong or incomplete.

Deletion. Ask us to delete your information where there is no lawful reason to keep it.

Withdraw consent. Withdraw consent at any time, for example for messaging.

Object. Object to certain processing, including direct marketing.

Complain. Complain to us and to the Information Regulator.

If the GDPR applies to you, you also have rights to restrict processing, to data portability, and not to be subject to certain automated decisions. To exercise any right, email info@maatlahealthcare.com. We may need to verify your identity first.

15. Children and Minors

Our services are intended for adults. Where information about a child is processed, for example a family member on a plan or a patient at a facility, it must be provided and managed by a parent, guardian or authorised person with the legal right to do so. If you believe we hold a child's information without proper authority, contact us and we will address it.

16. Cookies

Our website and platforms use cookies and similar technologies to work properly, to remember your choices, and to help us understand usage. You can control cookies as explained in our Cookie Policy.

17. Links to Other Websites

Our platforms may link to other websites we do not control. We are not responsible for their privacy practices, and we encourage you to read their policies before sharing information with them.

18. Data Breaches

If a security compromise affects your personal information, we will act to contain and assess it, and where the law requires, we will notify the Information Regulator and the affected people as soon as reasonably possible. Our breach process is described in our Data Protection and Security Statement.

19. Changes to This Privacy Policy

We may update, amend or replace this Privacy Policy at any time, at our sole discretion. Because our services and the laws that govern them change, we may make these changes without giving you individual notice or separate communication.

Any change takes effect from the moment the updated version is published on our website or otherwise made available on our platforms. The version shown on our website at any given time is the version that applies. By continuing to visit our website, use our services, or receive our messages after a change has been published, you accept the updated version and are bound by it.

We encourage you to review this Privacy Policy regularly so that you are aware of the current terms. Nothing in this clause removes any right you have under South African law that cannot lawfully be excluded.

20. Complaints and the Information Regulator

If you are unhappy with how we handle your information, please contact us first at info@maatlahealthcare.com so we can try to resolve it. You also have the right to lodge a complaint with the Information Regulator of South Africa, whose current contact details are published on the Regulator's official website.

21. How to Contact Us

If you have any question, request or concern about this document, please contact us using the details below.