POPIA Notice

What is POPIA?

The Protection of Personal Information Act 4 of 2013 (POPIA) is South Africa's primary data protection legislation. It regulates how organisations collect, store, use, and share personal information about South African residents.

POPIA gives you rights over your personal information and places obligations on organisations like PetVet to handle that information responsibly and lawfully.

Lawful basis for processing

PetVet processes your personal information on the following lawful grounds under POPIA:

• Contract: Processing necessary to provide the services you have signed up for
• Consent: Where you have given us explicit consent (e.g. sharing records with a vet)
• Legitimate interest: Platform security, fraud prevention, and service improvement
• Legal obligation: Where required by South African law

Categories of personal information processed

General personal information

• Name and email address
• Account credentials (passwords stored in encrypted form)
• Payment information (processed by our payment provider — not stored by PetVet directly)
• Device and usage information

Pet health information

Pet health records are personal information under POPIA to the extent that they are associated with an identifiable owner. This includes vaccination records, treatment history, vet visit notes, and uploaded documents.

We treat pet health data with the same care as personal health information and apply appropriate security controls.

Transborder information flows

PetVet uses Supabase (hosted on AWS infrastructure) for data storage. Some data may be processed outside of South Africa. Where this occurs, we ensure that adequate levels of protection are in place in accordance with section 72 of POPIA.

Our cloud infrastructure partners are contractually bound to process data only in accordance with our instructions and applicable data protection law.

Your rights under POPIA

As a data subject under POPIA, you have the following rights. You may exercise any of these rights by contacting us at privacy@petvet.org.za.

We will acknowledge your request within 5 business days and provide a full response within 30 days. In complex cases, we may extend this period by a further 30 days with notice to you.

Direct marketing

We may from time to time send you information about PetVet features, updates, or offers that may be of interest to you. You have the right to opt out of direct marketing at any time by:

• Clicking the unsubscribe link in any marketing email
• Updating your notification preferences in your account settings
• Emailing us at privacy@petvet.org.za

Opting out of marketing does not affect transactional communications such as reminder notifications, which are core to the service you have requested.

Security measures

In accordance with section 19 of POPIA, PetVet implements appropriate technical and organisational measures to protect your personal information, including:

• TLS encryption for all data in transit
• Encrypted storage of passwords using industry-standard hashing
• Row-level security policies on all database tables
• Role-based access controls for internal systems
• Regular security assessments of our platform

Data breach notification

In the event of a security compromise that is likely to affect you, we will notify you and the Information Regulator as soon as reasonably possible, in accordance with section 22 of POPIA.

Our breach notification will include the nature of the compromise, the personal information affected, and steps we are taking to address it.

Information Regulator

If you are not satisfied with how we have handled your personal information or your POPIA rights request, you have the right to lodge a complaint with the Information Regulator of South Africa:

Contact our Information Officer