Privacy notice

This policy explains what personal information LumeWellness collects, why we collect it, who sees it and the rights you have over it.

LUMEWELLNESS (PTY) LTD (2026/320084/07), with its registered office at Medispa, 99 Kloof Street, Gardens, Cape Town, 8001 ("LumeWellness", "we", "us") is the responsible party for personal information processed through our website at https://lumelife.co.za, booking platform and virtual consultations. This policy explains how we handle your personal information under the Protection of Personal Information Act 4 of 2013 ("POPIA").

In this policy:

• "Website" means lumelife.co.za and any booking platform or app we operate.
• "Practitioner" means an HPCSA-registered medical practitioner, or other registered health professional, who consults with you remotely through the Website.
• "Services" means the virtual consultations, assessments, programmes and related support offered through the Website.
• "Telehealth" means healthcare delivered remotely by video, audio or secure messaging.

Privacy questions and requests can be sent to our Information Officer at [email protected].

Practitioners are independent and are not employed by LumeWellness. They work under their own HPCSA registration and practice numbers. Each Practitioner is a separate responsible party for the clinical records they keep about you and is bound by POPIA and HPCSA confidentiality rules. LumeWellness processes clinical information on the Practitioner's behalf only to support your care, such as hosting records, facilitating virtual consultations and arranging prescriptions.

• Identity and contact: name, ID or passport number, date of birth, sex, email, phone, physical and delivery address.
• Health information (special personal information): medical history, conditions, medication, allergies, assessment answers, body measurements, blood pressure, test results, photographs for aesthetic or progress tracking, consultation notes, messages and images exchanged during virtual consultations, recordings (only with your consent), prescriptions.
• Medical aid: scheme name, membership number, main member details.
• Payment: billing details and transaction records. Card details are held by our payment provider, not by us.
• Account and communication: login details, messages, call and email records, feedback, testimonials you agree to share.
• Technical: IP address, device and browser type, pages visited, dates and times of access, cookie data (see clause 9).

Our Services are only available to people aged 18 and older. We do not knowingly collect personal information about anyone under 18.

• Directly from you, when you register, complete an assessment, book, attend a virtual consultation or contact us.
• From your care team, including Practitioners, laboratories and pharmacies involved in your care.
• From third parties with your consent, such as your own doctor or medical scheme.
• Automatically, through cookies and similar technologies when you use our website.

Providing health information is voluntary, but without it your Practitioner may not be able to treat you safely.

• Assessing, treating and following up your care. Legal basis: your consent, and processing by or for healthcare providers for proper treatment (s32).
• Issuing prescriptions and arranging dispensing. Legal basis: your consent; performing our agreement with you.
• Booking, billing, payments and medical aid invoices. Legal basis: performing our agreement with you.
• Communicating about your appointments and care. Legal basis: performing our agreement; our legitimate interest in safe care.
• Improving our services, safety monitoring and fraud prevention. Legal basis: our legitimate interests, using de-identified data where possible.
• Marketing. Legal basis: your opt-in consent (see clause 10).
• Meeting legal and regulatory duties. Legal basis: compliance with law.

We will not use your health information for any purpose unrelated to your care without your specific consent. We do not sell personal information.

We keep your information confidential. We do not sell, rent or share it with anyone for marketing, research or any other commercial purpose. It is disclosed only where your care or the law requires it, and only to the extent each party needs:

• Your Practitioner, who consults with you and is bound by professional confidentiality.
• Your chosen pharmacy, only when you ask us to send your prescription there. The pharmacy receives the prescription with your name, ID number and the details the prescription must contain, plus your delivery address and phone number if the medicine is to be posted or delivered.
• Laboratories, radiology practices and other diagnostic providers, only when your Practitioner refers you for tests, scans or X-rays. They receive what they need to carry out the test, contact you and bill your medical aid where relevant, such as your name, ID number, contact details, medical aid details and the clinical information on the referral. Results are sent back to your Practitioner.
• Operators that store or process information on our behalf so the Services can run, such as e-prescribing, clinical note-taking or transcription, video consultation, booking, website and data hosting, email and messaging, and payment providers. They may not use your information for their own purposes and are bound by written agreements requiring confidentiality and security under POPIA s21.
• Your own doctor, only if you ask us to share information with them.
• Authorities, only where the law requires it, such as a court order.

Virtual consultations. Consultations take place by secure video, audio or messaging. Practitioners conduct them from a private setting. Your Practitioner or LumeWellness may use secure recording, transcription or note-taking tools to help prepare accurate clinical notes, but only with your consent, which will be asked for at the start of the consultation. You may decline without it affecting your care. Please use a private space and a secure device on your side.

If LumeWellness is sold or restructured, personal information may transfer to the new owner, who must continue to protect it under this policy. We will notify you before this happens.

We may use information that has been de-identified so that it cannot reasonably be linked back to you, for internal service improvement only. We do not share it with third parties. We do not attempt to re-identify it.

Because our Services are delivered online, your health information is stored electronically and shared securely between you, your Practitioner and others involved in your care. Online records and communication carry privacy risks that a paper-based practice does not. Clause 11 sets out how we reduce them.

Some of our operators, such as cloud hosting and software providers, may store data on servers outside South Africa. We only transfer information where the recipient is subject to laws or binding agreements that give protection substantially similar to POPIA, as required by s72.

We use:

• Essential cookies, needed for login, booking and security. These are always on.
• Analytics cookies, to understand how the website is used. Off unless you opt in.
• Marketing cookies, to measure campaigns. Off unless you opt in, and never placed on assessment, booking, account or clinical pages.

You can change your choice at any time through the cookie settings link in the footer or your browser settings.

We will only send you marketing by email, SMS or WhatsApp if you have opted in, or if you are a client and the message relates to similar services, as permitted by POPIA s69. Every message includes an easy way to unsubscribe. Unsubscribing does not affect messages about your care or appointments.

We protect your information with encryption in transit and at rest, role-based access so staff see only what their work requires, secure authentication, audit logs and staff confidentiality agreements. No system is completely secure. If a breach affects your information, we will notify you and the Information Regulator as soon as reasonably possible, as required by POPIA s22.

• Clinical records: at least 6 years after your last consultation, in line with HPCSA guidance, or longer where the law requires.
• Financial and billing records: 5 years, as required by tax law.
• Marketing preferences: until you unsubscribe or close your account.
• Website analytics: 14 months.

After these periods we securely delete or de-identify the information.

Under POPIA and the Promotion of Access to Information Act 2 of 2000 (PAIA) you may:

• ask whether we hold your information and request a copy;
• ask us to correct or update it;
• ask us to delete it, subject to the legal retention periods above;
• object to processing based on our legitimate interests, or to direct marketing;
• withdraw consent at any time, which does not affect processing already done; and
• complain to the Information Regulator.

To make a request, contact our Information Officer at [email protected]. We will verify your identity and respond within 30 days. Our PAIA manual is available on request from our Information Officer.

We will notify you by email or on our website before any material change takes effect. The date at the end shows the latest version.

• Responsible party: LUMEWELLNESS (PTY) LTD (2026/320084/07)
• Email: [email protected]
• Registered office: Medispa, 99 Kloof Street, Gardens, Cape Town, 8001
• Information Regulator: inforegulator.org.za