Privacy notice

1. Who we are

Health Brands SA (Pty) Ltd ("Health Brands SA", "we") is the responsible party for personal information collected through this website and the SUN PROTECT™ platform. You can reach our Information Officer by phone on 082 868 7762 or through the contact form, marked "Attention: Information Officer".

2. What we collect

• Contact and enquiry details: name, work email, company, phone, industry, number of workers, region and your message.
• Risk assessment answers and the report generated from them.
• Consent records: what you agreed to, when, and the wording shown.
• Technical information needed to run and secure the site, such as IP address and security cookies.
• On the SCAN platform (when live, and only with explicit consent): skin images, self-reported information and screening guidance. This is special personal information (health) and is handled under section 32 of POPIA with your explicit consent.

3. Why we use it

• To respond to your request, arrange assessments and send proposals.
• To deliver training, supply and monitoring services to employers.
• To send sun safety updates, only if you opted in. You can unsubscribe at any time.
• To keep the site secure and prevent abuse.

4. Employers never see individual health information

Employers receive aggregated reports only. Any group smaller than 5 workers is suppressed. Individual SCAN guidance, images and referrals stay between the worker and the clinical team.

5. Where your information is stored and who processes it

Website forms are processed in Cape Town (Vercel region cpt1) and stored in a private store in Cape Town. We do not collect any worker's health information in the UV risk assessment.

We share personal information only with operators who process it for us under written agreements: Vercel (hosting, South Africa), Twilio SendGrid (email notifications, United States) and, when our CRM sync is switched on, HighLevel (customer relationship management, United States). Only your name, email, phone, company, the type of request, its reference and your consent choices go to the CRM; assessment answers never do. Payment providers (Stitch or Paystack) process card payments when online payment is switched on; we never see card details.

Transfers outside South Africa happen only under section 72 of POPIA, with adequate protection in place. Clinicians receive information only when a worker chooses a referral, and we share information where the law requires it.

Scans of our QR codes are logged with an anonymised IP address, approximate city and device type to measure campaign reach; data is stored in South Africa.

6. Retention and security

Leads are kept for 24 months after our last contact, assessments for 5 years (they belong in a safety file) and orders and invoices for 5 years (Tax Administration Act). We keep personal information no longer than needed for the purpose or as the law requires. We use access controls, encryption in transit, private storage for images, short-lived access links and audit logging.

7. Your rights

• Ask what personal information we hold about you and request a copy.
• Ask us to correct or delete it.
• Withdraw consent at any time. For SCAN, withdrawal starts an anonymisation process.
• Object to processing for direct marketing.
• Complain to the Information Regulator (South Africa): inforeg.org.za.

8. Preview site notice

This is a preview of the SUN PROTECT™ website. Forms on the preview store submissions for testing only, and the platform demo uses synthetic data. Please do not enter real health information.