Privacy Policy

1. Introduction

• 1.1

  This Privacy Policy is to be read as if specifically incorporated into the Terms of Use, available at: https://corporate.healthwithheart.co.za/wp-content/uploads/2026/07/Terms-of-Use-App-and-Website-1.docx-1.pdf

• 1.2

  This Privacy Policy applies equally to your use of the website (located at www.healthwithheart.co.za and www.corporate.healthwithheart.co.za) and the Health with Heart mobile application, available via the Apple App Store and Google Play Store (the “App”), together the “Platform”. References to the “Website”, “Site”, or “we”, “us”, or “our” in this Policy apply equally to the App unless expressly stated otherwise.

2. Privacy Policy

• 2.1

  For the purposes of this section, Personal Information will be understood in accordance with the definition provided in the Protection of Personal Information Act 4 of 2013 (“the Act”). We also subscribe to the principles for electronically collecting personal information outlined in the Act, and the further legislation referred to therein. We endeavour to ensure the quality, accuracy and confidentiality of Personal Information in our possession.

• 2.2

  In adopting this Privacy Policy, we wish to balance our legitimate business interests and your reasonable expectation of privacy. Accordingly, we will take all reasonable steps to prevent unauthorised access to, or disclosure of your Personal Information. However, it is impossible to guarantee that your Personal Information shall be 100% secure.

• 2.3

  Users will be prompted to register an account with us, whether via the Website or the App. In so doing, users may be asked to provide the following information (Personal Information):

  • 2.3.1

    First Name.

  • 2.3.2

    Surname.

  • 2.3.3

    ID number, or passport number for foreign nationals, used to verify your identity and link your health screening results to your profile.

  • 2.3.4

    Employee number, if applicable.

  • 2.3.5

    Email address.

  • 2.3.6

    Mobile/phone number.

  • 2.3.7

    Preferred contact method (email / SMS / WhatsApp).

  • 2.3.8

    Where you use the App’s digital health screening feature: health-scan-derived wellness data, including an estimated wellbeing score and associated physiological indicators (for example, estimated heart rate or blood pressure). The screening works by briefly capturing video through your device’s camera; this video is processed to extract these indicators and is not itself stored or transmitted to us or our health-screening technology provider — only the resulting encrypted, non-image data is sent and retained.

  • 2.3.9

    Where you access confidential mental health support through the Platform: records of your engagement with that service (for example, that a session took place). The content of your consultations is held by the relevant support provider and is not accessible to Health with Heart.

  • 2.3.10

    Where you access financial wellness coaching through the Platform: records of your engagement with that service (for example, that a session was booked). The information you choose to share with the relevant financial coaching provider is held by the relevant support provider and is not accessible to Health with Heart.

  • 2.3.11

    Learning content engagement and course completion data.

  • 2.3.12

    Where accessed via the App: certain device and technical information collected automatically, including device type, operating system and version, unique device identifiers, and app usage, performance, and crash/diagnostic data.

  Items 2.3.8 to 2.3.11 may constitute special personal information (including information concerning health) as defined in the Act. We only process this information with your explicit consent, given at registration, and solely for the purpose of providing you with the relevant service.

• 2.4

  We will attempt to limit the types of Personal Information we process to only that to which you consent (for example, in the context of online registration, newsletters, message boards, surveys, polls, professional announcements, SMS, MMS and other mobile services), but, to the extent necessary, your agreement to this Privacy Policy constitutes your consent as contemplated in section 69 of the Act.

• 2.5

  We will not collect, use or disclose sensitive information (such as information about racial or ethnic origins or political or religious beliefs, where relevant) except with your specific consent or in the circumstances permitted by law.

• 2.6

  By agreeing to the terms contained in this Privacy Policy, you consent to the use of your Personal Information in relation to:

  • 2.6.1

    The provision and performance of the services, including the physical health screening, confidential mental health support, financial wellness, and learning features of the Platform;

  • 2.6.2

    Informing you of changes made to the Website or App;

  • 2.6.3

    The provision of marketing related services to you by us;

  • 2.6.4

    Responding to any queries or requests you may have;

  • 2.6.5

    Developing a more direct and substantial relationship with users for the purposes described in this clause;

  • 2.6.6

    Developing an online user profile;

  • 2.6.7

    Understanding general user trends and patterns so that we can develop and support existing and ongoing marketing strategies;

  • 2.6.8

    For security, administrative and legal purposes; and

  • 2.6.9

    The creation and development of market data profiles which may provide insight into market norms, practices and trends to help us improve our offering to you. Such information will be compiled and retained in aggregated form, but shall not be used in any way which may compromise the identity of a user. Where you access the Platform through your employer, only anonymised, aggregated data of this kind is ever shared with your employer — your individual Personal Information, including your health, mental health, financial wellness, and learning activity information, is not disclosed to your employer.

• 2.9

  Although absolute security cannot be guaranteed on the internet, we have in place up-to-date, reasonable technical and organisational security measures to protect your Personal Information against accidental or intentional manipulation, loss, misuse, destruction or against unauthorised disclosure or access to the information we process online.

• 2.10

  While we cannot ensure or warrant the security of any Personal Information you provide us, we will continue to maintain and improve these security measures over time in line with legal and technological developments.

• 2.11

  We store your Personal Information directly, or alternatively, store your Personal Information on, and transfer your Personal Information to, a central database. If the location of the central database is located in a country that does not have substantially similar laws which provide for the protection of Personal Information, we will take the necessary steps to ensure that your Personal Information is adequately protected in that jurisdiction. Information generated through the physical health screening feature is stored within the Republic of South Africa by our health-screening technology provider.

• 2.12

  Your information will not be stored for longer than is necessary for the purposes described in these Terms or as required by applicable legislation. See Clause 7 below for how to request deletion of your Personal Information.

• 2.13

  The Personal Information we collect from users shall only be accessed by our employees, representatives and consultants on a need-to-know basis, and subject to reasonable confidentiality obligations binding such persons.

• 2.14

  We shall have the right, but shall not be obliged, to monitor or examine any information and materials including any website link that you publish or submit to us for publishing on the Site. You shall be solely responsible for the contents of all material published by yourself.

• 2.15

  We constantly review our systems and data to ensure the best possible service to our users. We do not accept any users, or representatives of users, under 18 years of age or who otherwise does not have the relevant capacity to be bound by this Privacy Policy.

• 2.16

  We will not sell or rent your Personal Information to any third party. We do share your Personal Information with carefully selected third-party service providers who help us deliver the Platform’s services — for example, health screening technology providers, confidential mental health support providers, financial wellness coaching providers, and learning content providers — but only to the extent necessary to provide you with the relevant service, and always subject to appropriate confidentiality and data protection obligations. We do not use your e-mail address for unsolicited mail; any emails sent by us will only be in connection with the provision of our services and/or the marketing thereof.

• 2.17

  Operators: We may engage operators, as that term is used in the Act, to process Personal Information on our behalf — including our health-screening, mental health support, financial wellness, and learning content providers described in this Policy. All operators are contractually required to process Personal Information only on our instructions, and to maintain confidentiality and security safeguards at least equivalent to those required of us under the Act.

• 2.18

  Business Transfers: In the event of a merger, acquisition, restructuring, or other business transfer involving Health with Heart, your Personal Information may be disclosed as part of that process and transferred to a successor entity, subject to the same protections described in this Policy. Where such a transfer would result in your information being used in a materially different way, we will notify you and give you the opportunity to close your account beforehand.

• 2.19

  Legal Requirements: We may disclose Personal Information where required or permitted by law, including to comply with a legal process, a request from a regulator, or a law enforcement request, or where necessary to protect our rights, property, or the safety of our users.

• 2.20

  Data Breach Notification: If a security compromise occurs that has, or that we reasonably believe has, compromised your Personal Information, we will notify the Information Regulator and affected users as soon as reasonably possible, in accordance with the Act, together with information on the steps we recommend you take in response.

• 2.21

  Automated Processing: If you choose to connect a wearable device or third-party health app to your profile, we may use the data it shares to automatically update your wellbeing score and related insights, with your consent. You remain in control of this connection and can disconnect it, or stop this automatic updating, at any time through your profile settings.

3. The Health with Heart App

• 3.1

  The App may request permission to access your device’s camera, which is required to perform the digital health scan feature. We do not access your camera at any other time. You can withdraw camera access at any time through your device settings, though this will prevent you from using the health screening feature.

• 3.2

  The App may request permission to send you push notifications — for example, reminders to complete a scan or to engage with learning content. You can disable these at any time through your device settings.

• 3.3

  The App automatically collects certain technical and device information, including device type, operating system and version, unique device identifiers, and app usage and crash/diagnostic data, to help us maintain, secure, and improve the App.

• 3.4

  The App may use analytics or crash-reporting tools provided by third parties to help us understand app performance and diagnose issues. Where used, these providers process data on our behalf and are contractually bound to appropriate confidentiality and security obligations.

• 3.5

  Data collected through the App is stored and processed in accordance with this Privacy Policy on the same basis as data collected through the Website.

• 3.6

  If you connect a wearable device or fitness app to the App, you control which data is shared with your Health with Heart profile, and can disconnect it at any time through your profile settings. Deleting your Health with Heart account does not delete data held on the wearable device or its own app — you’ll need to manage or delete that separately, directly with the device manufacturer or app provider.

4. Log Files

• 4.1

  When you visit the website/tool, even if you do not create an account, we may collect information, such as your IP address, the name of your ISP (Internet Service Provider), your browser, the website from which you visit us, the pages on our website that you visit and in what sequence, the date and length of your visit, and other information concerning your computer’s operating system, language settings, and broad demographic information. This information is aggregated and anonymous data and does not identify you specifically. However, you acknowledge that this data may be able to be used to identify you if it is aggregated with other Personal Information that you supply to us. This information is not shared with third parties and is used only within the company on a need-to-know basis. Any individually identifiable information related to this data will never be used in any way different to that stated above, without your explicit permission.

5. Cookies

• 5.1

  We use cookies. A cookie is a small piece of information stored on your computer or smart phone by the web browser. The two types of cookies used on the Website are described below:

  • 5.1.1

    “Session cookies”: These are used to maintain a so-called ‘session state’ and only last for the duration of your use of the Website. A session cookie expires when you close your browser, or if you have not visited the server for a certain period of time. Session cookies are required for the Platform to function optimally, but are not used in any way to identify you personally.

  • 5.1.2

    “Permanent cookies”: These cookies permanently store a unique code on your computer or smart device hard drive in order to identify you as an individual user. No Personal Information is stored in permanent cookies. You can view permanent cookies by looking in the cookies directory of your browser installation. These permanent cookies are not required for the website to work, but may enhance your browsing experience.

• 5.2

  The App uses equivalent technologies — such as mobile device identifiers and local on-device storage — to maintain your session and preferences within the App. These serve the same function as the cookies described above and are treated in the same way under this Policy.

6. Links from the Website and App

• 6.1

  The services available through the Platform may contain links to other third party websites, including (without limitation) social media platforms, payment gateways, appointment scheduling and/or live chat platforms (“Third Party Websites”). If you select a link to any Third Party Website, you may be subject to such Third Party Website’s terms and conditions and/or other policies, which are not under our control, nor are we responsible therefor.

• 6.2

  Hyperlinks to Third Party Websites are provided “as is”, and we do not necessarily agree with, edit or sponsor the content on Third Party Websites.

• 6.3

  We do not monitor or review the content of any Third Party Website. Opinions expressed or material appearing on such websites are not necessarily shared or endorsed by us and we should not be regarded as the publisher of such opinions or material. Please be aware that we are not responsible for the privacy practices, or content, of other websites, either.

• 6.4

  Users should evaluate the security and trustworthiness of any Third Party Website before disclosing any personal information to them. We do not accept any responsibility for any loss or damage in whatever manner, howsoever caused, resulting from your disclosure to third parties of personal information.

7. Data Retention & Your Right to Deletion

• 7.1

  In addition to your rights under Clause 2, you may request the deletion of your Personal Information and/or your Platform account at any time, whether or not you still have the App installed on your device.

• 7.2

  To request deletion, please email dpo@healthwithheart.co.za with the subject line “Data Deletion Request”, using the email address associated with your Platform profile so we can locate your account.

• 7.3

  We will process your deletion request within a reasonable time, and in any event within 30 days, and will confirm once your Personal Information and account have been deleted.

• 7.4

  We may need to retain certain information after a deletion request, where required to do so by law or for a legitimate business purpose, including:

  • 7.4.1

    health-related records generated through the digital health screening feature, which our health-screening technology provider retains for 24 (twenty-four) months from your last scan, in line with their data retention policy. Separately, any clinical medical records held directly by Health with Heart in connection with Clause 9 (for example, for the FirstRand Group) may be subject to longer retention periods required of healthcare practitioners under Health Professions Council of South Africa guidelines;

  • 7.4.2

    information reasonably required to comply with our obligations under agreements with your employer or a relevant funder (for example, the FirstRand Group, as described in Clause 9), including for audit, legal, or regulatory purposes; and

  • 7.4.3

    information we are required to retain to comply with tax, financial, or other applicable law.

• 7.5

  Where we retain information for the reasons set out in Clause 7.4, we will restrict its use to only the purpose for which it is retained, and will delete it once the applicable retention period has ended.

• 7.6

  Deleting your account will not affect anonymised, aggregated data that no longer identifies you, which we may continue to use as described in Clause 2.7.9.

• 7.7

  Before actioning a request under this Clause 7, we may need to verify your identity, to ensure we do not disclose or delete information at the request of someone other than the data subject.

• 7.8

  You may also request a copy (export) of your Personal Information at any time by emailing dpo@healthwithheart.co.za.

• 7.9

  Deleting your Personal Information will not undo any sharing of that information that lawfully took place before we received and were able to act on your request. If you have connected a wearable device or third-party app to your profile, deleting your Health with Heart account will not delete any information held by that device or app itself — see Clause 3.6.

8. Application of the Electronic Communications and Transactions Act 25 of 2002 (“ECT Act”)

• 8.1

  Data Messages (as defined in the ECT Act) will be deemed to have been received by us if and when we respond to the Data Messages.

• 8.2

  Data Messages sent by us to a user will be deemed to have been received by such user in terms of the provisions specified in section 23(b) of the ECT Act.

• 8.3

  Users acknowledge that electronic signatures, encryption and/or authentication are not required for valid electronic communications between us and users.

• 8.4

  Information to be provided in terms of section 43(1) of the ECT Act:

  • 8.4.1

    Users warrant that Data Messages sent to us from any electronic device, used by such user, from time to time or owned by such user, were sent and or authorised by such user, personally.

  • 8.4.2

    This Website and the App are owned and operated by Health with Heart Trust.

• 8.5

  Address for service of legal documents: 1 Fredman Drive, Sandton 2196.

• 8.6

  Contact Number: 011 685 5021.

• 8.7

  Website – located at www.corporate.healthwithheart.co.za

• 8.8

  App – the Health with Heart App, available via the Apple App Store and Google Play Store.

• 8.9

  Email address: dpo@healthwithheart.co.za

9. FirstRand Group Data Protection Policy for Suppliers and Business Partners

• 9.1

  Openness
  In instances where HwH is acting on behalf of the FirstRand Group or any of its subsidiaries, we shall collect Personal Information, Medical Information and Employment Details in order to perform requested medical services. The collection, processing and storage of this information will be done purely to provide the necessary medical services and within the controls provided by the Protection of Personal Information Act, the Health Professions Council of South Africa Guidelines and the HwH Privacy Policy. Information provided is voluntary unless contractually obligated or required by law. Failure to provide the required information may affect the quality and efficacy of the medical services. The Responsible Party is Dr Melinda Whitfield and may be contacted on (011) 685 5021 or via email at workwell@healthwithheart.co.za. Information may be stored digitally or physically. While the data may be stored locally in South Africa, backed up data may be stored on cross border servers. All Data shall be encrypted and protected by either one or a combination of POPIA, GDPR or HIPAA regulations.

10. Changes to this Privacy Policy

• 10.1

  We may update this Privacy Policy from time to time. Where we do, we will post the updated version on the Website and App, together with its effective date. Your continued use of the Platform after an update takes effect constitutes your acceptance of the revised Policy. If you do not agree with a change, you may close your account as described in Clause 7.