Privacy Policy

1. Introduction

Epicentre Research NPC (Registration No. 2007/003117/08) and its subsidiary Epicentre Aids Risk Management (Pty) Ltd (Registration No. 2006/008080/07, VAT No. 4370234918), collectively referred to as "Epicentre", "we", "us", or "our", are committed to protecting and respecting your privacy.

This Privacy Policy explains how we collect, use, store, share, and protect your personal information when you visit our website at epicentre.org.za (the "Website"), use our services, purchase home test kits, book walk-in laboratory appointments, or otherwise interact with us.

We process personal information in accordance with the Protection of Personal Information Act 4 of 2013 ("POPIA"), the Electronic Communications and Transactions Act 25 of 2002 ("ECTA"), and other applicable South African legislation.

By using our Website or services, you acknowledge that you have read, understood, and agree to the collection and use of your information as described in this Privacy Policy. If you do not agree, please discontinue use of our Website and services.

2. Responsible Party and Information Officer

In terms of POPIA, the "responsible party" for the processing of your personal information is:

Our designated Information Officer, appointed in terms of Section 55 of POPIA and registered with the Information Regulator of South Africa, is responsible for ensuring compliance with data protection legislation and for handling all requests related to your personal information:

• Information Officer: Cherie Cawood
• Deputy Information Officer: Aimee Searle
• Email: [email protected]
• Telephone: +27 31 880 2150
• Postal address: 2 Knelsby Avenue, Hillcrest, Durban, KwaZulu-Natal, 3610

Both the Information Officer and Deputy Information Officer have been registered with the Information Regulator of South Africa as required under POPIA.

3. What Personal Information We Collect

We collect different categories of personal information depending on how you interact with us. "Personal information" means any information that identifies or can reasonably identify you, as defined in Section 1 of POPIA.

3.1 Information You Provide Directly

When you place an order, book an appointment, complete a contact form, subscribe to communications, or otherwise interact with us, we may collect:

• Full name and surname
• Email address
• Mobile telephone number
• Physical or delivery address
• Date of birth and gender (where required for test interpretation)
• Medical aid scheme name, plan, and membership number
• Payment information (processed via third-party gateways; we do not store card details)
• Appointment booking preferences and branch selection
• Order history and product preferences
• Communications you send us (emails, WhatsApp messages, contact form submissions)

3.2 Special Personal Information (Health Data)

This includes:

• Biological samples (blood, urine, swabs) submitted for laboratory analysis
• Laboratory test results and biomarker values
• Health questionnaire responses submitted as part of the testing process
• Functional health reports generated through our Optimal DX (ODX) analysis system
• Information about the type of test ordered (which may reveal health concerns)
• Referral information shared with Treatment Partners at your request

We process this special personal information only with your explicit consent (Section 27(1)(a) of POPIA) and/or where processing is necessary for the provision of healthcare services (Section 32 of POPIA). You provide this consent when you place an order, submit a biological sample, or request a referral to a Treatment Partner.

3.3 Information Collected Automatically

When you visit our Website, certain information is collected automatically through cookies and similar technologies (see Section 8 below). This may include:

• IP address and approximate geographic location
• Browser type, version, and operating system
• Device type (desktop, mobile, tablet)
• Pages visited, time spent on pages, and navigation paths
• Referring website or search terms that led you to our site
• Click patterns and scrolling behaviour

3.4 Information from Third Parties

We may receive limited personal information from third parties, including payment confirmation from payment gateways (Netcash, Payflex), appointment booking confirmations from our scheduling platform, medical aid eligibility and claims status from medical scheme administrators, and courier delivery status updates.

4. How We Use Your Personal Information

We use your personal information only for legitimate, specified purposes as permitted under POPIA Section 13.

4.1 To Provide Our Services

• Processing and fulfilling orders for home test kits
• Booking and managing walk-in laboratory appointments
• Performing laboratory analysis on your biological samples
• Generating and delivering your test results and functional health reports
• Processing payments and issuing invoices or receipts
• Submitting medical aid claims on your behalf
• Facilitating referrals to Treatment Partners at your request
• Providing customer support via email, telephone, or WhatsApp

4.2 To Improve Our Services

• Analysing website traffic and user behaviour to improve the user experience
• Conducting internal quality assurance and audit processes
• Developing new tests, packages, and service offerings

4.3 To Communicate With You

• Sending order confirmations, dispatch notifications, and result delivery alerts (transactional)
• Responding to your enquiries and support requests
• Sending marketing communications, health education content, and promotional offers (only with your separate opt-in consent)

4.4 To Comply With Legal Obligations

• Fulfilling tax, financial, and regulatory reporting requirements
• Responding to lawful requests from regulatory authorities, law enforcement, or courts
• Maintaining records as required by the National Health Act, POPIA, and other applicable legislation

5. Legal Bases for Processing

Under POPIA, we rely on the following legal bases for processing your personal information:

6. Who We Share Your Information With

6.1 Service Providers

We use trusted third-party service providers who process personal information on our behalf and under our instruction. These include:

• Accredited partner laboratories that analyse your biological samples
• Payment gateways (Netcash, Payflex) for processing transactions
• Courier services for delivering and collecting home test kits
• Website hosting and cloud infrastructure providers
• Email and communication platforms for transactional and marketing messages
• Our appointment booking platform

All service providers are contractually bound to protect your personal information and to process it only for the purposes we specify, in accordance with POPIA Section 21.

6.2 Treatment Partners

If you request a referral to a Treatment Partner (an independent healthcare practitioner), we will share relevant test results and contact details with that practitioner only with your explicit consent. Treatment Partners are independent data controllers and are responsible for their own privacy practices.

6.3 Medical Aid Schemes

Where you request that we submit a claim to your medical aid, we share the minimum information necessary to process the claim, including your membership details, the tests performed, and the associated costs.

6.4 Legal and Regulatory Disclosures

We may disclose your personal information where required by law, regulation, or court order, or where necessary to protect the rights, property, or safety of Epicentre, our patients, or the public.

7. Cross-Border Transfers of Personal Information

Some of our service providers (such as website hosting, email platforms, and analytics tools) may store or process data on servers located outside of South Africa. Where this occurs, we take reasonable steps to ensure that:

• The recipient country has adequate data protection laws, or
• The recipient is bound by binding corporate rules or a contractual agreement that provides equivalent protection, or
• You have provided explicit consent to the transfer

In accordance with POPIA Section 72, we will not transfer your personal information to a foreign country unless one of the above conditions is met. We currently use services that may process data in the European Union, the United States, and the United Kingdom, all of which maintain data protection frameworks recognised by the Information Regulator.

8. Cookies, Tracking Technologies, and Analytics

Our Website uses cookies and similar tracking technologies to improve your browsing experience, analyse website performance, and deliver targeted content. A "cookie" is a small text file stored on your device when you visit a website.

8.1 Types of Cookies We Use

8.2 Cookie Consent

When you first visit our Website, a cookie consent banner (powered by CookieYes) will appear, allowing you to accept or decline non-essential cookies. Essential cookies (required for the Website to function) are loaded automatically. Analytics and marketing cookies are only activated after you provide explicit consent. You may change your cookie preferences at any time by clicking the "Cookie Settings" link in the website footer.

8.3 How to Manage Cookies in Your Browser

In addition to our cookie consent mechanism, you can control cookies through your browser settings. Most browsers allow you to block or delete cookies. However, blocking essential cookies may impair the functionality of our Website, including the shopping cart and checkout process.

8.4 Do Not Track

Our Website does not currently respond to "Do Not Track" (DNT) browser signals. However, you can control tracking through the cookie consent mechanism described above.

9. How Long We Keep Your Information

We retain your personal information only for as long as necessary to fulfil the purposes for which it was collected, or as required by law.

When personal information is no longer required, we will securely delete or anonymise it so that it can no longer be associated with you.

10. How We Protect Your Information

We implement appropriate technical and organisational measures to protect your personal information against unauthorised access, alteration, disclosure, destruction, or loss. These measures include:

• SSL/TLS encryption (HTTPS) across the entire Website, including all checkout and payment pages
• PCI DSS-compliant third-party payment processing (we never store credit card details on our servers)
• Role-based access controls limiting employee access to personal information on a need-to-know basis
• Secure, password-protected systems for storing laboratory results and patient records
• Regular security assessments and software updates to our WordPress/WooCommerce platform
• Staff training on data protection obligations and confidentiality requirements
• Secure destruction protocols for biological samples after analysis

While we take all reasonable precautions, no method of electronic storage or transmission is 100% secure. We cannot guarantee absolute security but will notify you and the Information Regulator of any data breach in accordance with POPIA Section 22.

11. Your Rights Under POPIA

As a data subject under POPIA, you have the following rights in relation to your personal information:

• Right to access (Section 23): You may request confirmation of whether we hold personal information about you, and request a copy of that information.
• Right to correction (Section 24): You may request that we correct or update any personal information that is inaccurate, incomplete, or misleading.
• Right to deletion (Section 24): You may request that we delete your personal information where it is no longer necessary for the purpose for which it was collected, subject to legal retention requirements.
• Right to object (Section 11(3)): You may object to the processing of your personal information on reasonable grounds, unless legislation permits such processing.
• Right to withdraw consent: Where processing is based on your consent, you may withdraw that consent at any time. Withdrawal does not affect the lawfulness of processing carried out before withdrawal.
• Right not to be subject to automated decisions (Section 71): You have the right not to be subject to a decision based solely on automated processing that significantly affects you.
• Right to lodge a complaint: You have the right to lodge a complaint with the Information Regulator if you believe your personal information has been mishandled.

To exercise any of these rights, please contact our Information Officer at [email protected]. We will respond to your request within 30 days as required by POPIA. We may request proof of identity before processing your request to protect your information from unauthorised access.

12. Marketing Communications

We will only send you marketing communications (promotional emails, health education newsletters, special offers) if you have given us your explicit, opt-in consent to do so. We do not purchase third-party marketing lists or send unsolicited commercial communications.

You can withdraw your consent to marketing communications at any time by:

• Clicking the "Unsubscribe" link at the bottom of any marketing email
• Replying "STOP" to any marketing SMS or WhatsApp message
• Contacting us at [email protected] or [email protected]

Unsubscribing from marketing communications will not affect transactional messages related to your orders, appointments, or test results, which are necessary for the provision of our services.

13. Children's Personal Information

Our services are primarily intended for individuals aged 18 years and older. We do not knowingly collect personal information from children under the age of 18 without the consent of a parent or legal guardian, as required by POPIA Section 35.

If you are a parent or guardian and believe your child has provided personal information to us without your consent, please contact our Information Officer immediately. We will take steps to delete the information.

Where a minor requires diagnostic testing, a parent or legal guardian must place the order, provide consent for processing, and be the primary contact for result delivery.

14. Third-Party Websites and Services

Our Website may contain links to third-party websites, including payment gateways, medical aid portals, appointment booking platforms, Treatment Partner websites, and external health information resources. These third-party sites have their own privacy policies, which we encourage you to review.

We are not responsible for the privacy practices or content of any third-party website. A link from our Website does not constitute an endorsement of that third party's privacy practices.

15. Changes to This Privacy Policy

We may update this Privacy Policy from time to time to reflect changes in our practices, legal requirements, or service offerings. The "Last updated" date at the top of this page indicates when the most recent changes were published.

We encourage you to review this Privacy Policy periodically. If we make material changes that significantly affect how we process your personal information, we will notify you by email or by prominent notice on our Website prior to the change taking effect.

16. Complaints

If you are not satisfied with how we have handled your personal information or responded to a request, you are entitled to lodge a complaint with the Information Regulator of South Africa:

• Email: [email protected]
• Telephone: +27 10 023 5207
• Website: www.inforegulator.org.za
• Physical address: JD House, 27 Stiemens Street, Braamfontein, Johannesburg, 2001

We encourage you to contact our Information Officer first so that we have the opportunity to resolve your concern directly.