Privacy Notice

1. Introduction

Oriva OS (Pty) Ltd ("we", "us" or "our") operates Oriva OS ("the App"), a digital platform through which registered healthcare professionals, dieticians, personal trainers, coaches and other authorised professionals may create, provide and monitor meal plans and nutrition programmes for their patients or clients.

The App may process personal information and special personal information, including information concerning the health, wellbeing, nutritional status and dietary habits of users.

We recognise the importance of protecting personal information and process personal information in accordance with the Protection of Personal Information Act 4 of 2013 ("POPIA"), applicable healthcare legislation, applicable professional rules and guidelines, and other applicable South African law.

2. Personal information we collect

Depending on the manner in which you use the App, we may process:

• Your name and surname;
• Contact details;
• Date of birth and age;
• Account and login information;
• Information concerning your healthcare professional or service provider;
• Meal plans and nutritional information;
• Calorie and food-consumption information;
• Weight and other health-related measurements, including body-composition scans;
• Dietary preferences, restrictions and allergies;
• Medical and health information supplied by you or your healthcare professional, including medical conditions, medication and supplements, symptoms, menstrual cycle, sleep, stress and other wellness information;
• Information concerning your progress and adherence to a meal plan;
• Messages with your professional and conversations with Ori, the App's AI coach;
• Technical information such as IP address, device information, browser information and application logs;
• A record of the consents you give in the App, with the date, version and the device and IP address used;
• Subscription and account information; and
• Payment and transaction information required to administer your subscription.

Photos, voice and recordings. Progress photos and body-composition scan photos you choose to keep are stored in private storage that only you and your professional can open. When you log a meal, food label or supplement by photo, or speak to Ori or log by voice, the image or audio is sent to our AI service providers to be read and is then discarded; only the result is stored. A video consultation is recorded only after you agree at the start of the session, and a recording may be transcribed and summarised by our AI service providers for your professional's notes.

We do not ordinarily collect or store your full payment-card details. Payments are processed through our third-party payment provider, PayFast, in accordance with its applicable terms and privacy policies.

3. Special personal information

Information concerning a person's physical or mental health, wellbeing and medical history constitutes special personal information under POPIA.

We process health information only where we have a lawful basis to do so and only for identified and legitimate purposes.

Where health information is processed in connection with a professional healthcare relationship, the relevant healthcare professional remains responsible for the lawful clinical use and management of the patient's health information, while we process information as necessary to provide and operate the App and, where applicable, as an operator on behalf of the healthcare professional.

4. Purposes of processing

We process personal information for purposes including:

• Creating and administering user accounts;
• Providing the App and its functionality;
• Allowing authorised professionals to create and monitor meal plans;
• Enabling users to access and follow meal plans;
• Recording nutritional and calorie information;
• Monitoring progress;
• Facilitating communication between professionals and their patients/clients through the App;
• Booking and conducting consultations, and sending the reminders and notifications you choose;
• Maintaining appropriate healthcare and professional records;
• Administering subscriptions and payments;
• Providing technical support;
• Maintaining security and preventing fraud or misuse;
• Complying with legal, regulatory and professional obligations;
• Responding to complaints, requests and legal proceedings; and
• Improving the App using information that has been appropriately aggregated or anonymised.

We will not use identifiable health information for unrelated commercial purposes without an appropriate lawful basis.

5. Lawful processing

We process personal information only where permitted by POPIA and other applicable law.

Depending on the circumstances, the lawful basis may include:

• The conclusion or performance of a contract;
• Compliance with a legal obligation;
• The protection of a legitimate interest;
• The exercise or defence of legal rights;
• Consent, where consent is required; and
• Processing permitted in connection with the provision of healthcare services.

Where consent is relied upon, consent will be voluntary, specific and informed and may be withdrawn subject to applicable legal and contractual limitations. You give each consent separately in the App, and you can see and change them under Account → Privacy & consent.

6. Healthcare professionals

Healthcare professionals and other authorised professionals using the App are responsible for ensuring that:

• They have the necessary professional authority to provide the relevant services;
• Information supplied to the App has been lawfully obtained;
• Appropriate patient/client consent has been obtained where required;
• Information is accurate and appropriately maintained; and
• The App is used in accordance with applicable professional rules and legislation.

7. Sharing of information

Personal information may be disclosed to:

• The healthcare professional or authorised professional responsible for your care or programme (this includes your menstrual cycle information unless you switch sharing off in Account);
• Service providers necessary to operate the App;
• Our hosting and infrastructure providers;
• Our payment service provider;
• Professional advisers;
• Regulators, law-enforcement authorities or courts where legally required; and
• Other persons where disclosure is authorised by law or by the data subject.

Service providers processing information on our behalf will be contractually required to maintain appropriate confidentiality and security safeguards.

8. Hosting and service providers

The App uses third-party technology and infrastructure providers:

• Supabase — database, sign-in and file storage, hosted in Ireland (European Union).
• Vercel — application hosting, in Cape Town.
• PayFast — payment processing.
• Anthropic (United States) — Ori, reading food, label, supplement and body-composition scan photos, and consultation summaries.
• OpenAI (United States) — turning voice into text.
• Daily.co — video consultations and, if you agree, recordings.
• Resend — account, booking and reminder emails.
• Google and Microsoft — only if your professional connects their calendar: your name and appointment time appear in it.
• Apple, Google and Mozilla push services — delivering notifications you turn on.
• FatSecret — food database look-ups (no personal information is sent).
• Shopify — only if you buy from your professional's shop.

AI services. What you log, photograph, say or type for the AI features is sent to Anthropic or OpenAI to be processed. Under their business terms they do not use it to train their models. Anthropic deletes it within 30 days, and OpenAI keeps it in abuse-monitoring logs for up to 30 days, unless the law requires longer or it is flagged for breaking their usage policies (Anthropic keeps flagged content for up to 2 years). We ask for your separate consent to this processing.

Personal information may therefore be processed or stored outside South Africa, including in the European Union and the United States. Where personal information is transferred outside South Africa, we will ensure that the transfer complies with applicable legal requirements, including section 72 of POPIA.

9. Security

We implement appropriate technical and organisational measures designed to protect personal information against loss, damage, unauthorised access, unlawful processing, alteration or disclosure.

These measures include, where appropriate:

• encryption;
• authentication and access controls;
• role-based permissions;
• database security;
• audit logging;
• backups;
• security monitoring;
• vulnerability management; and
• incident-response procedures.

10. Retention

Personal information will not be retained for longer than necessary unless retention is required or permitted by law.

Where information forms part of a healthcare professional's patient health record, applicable professional and statutory retention requirements will apply.

Patient health records will generally be retained for at least six years after the record becomes dormant, or longer where required by applicable law, professional rules, litigation, regulatory requirements or the nature of the patient.

Records concerning minors or persons who are mentally incapacitated may be retained for longer periods as required by applicable law and professional guidelines.

11. Your rights

Subject to applicable law, you may request:

• confirmation that we hold personal information concerning you;
• access to your personal information;
• correction of inaccurate information;
• deletion where legally permissible;
• information regarding the purposes for which your information is processed;
• information concerning third parties to whom your information has been disclosed;
• withdrawal of consent where consent is the lawful basis for processing; and
• objection to processing where permitted by law.

Requests may be submitted to the Information Officer at melissa@orivaos.com. You can also export your information, change your consents or request deletion yourself on your Account page.

12. Security compromises

If we become aware of a security compromise involving personal information, we will deal with the incident in accordance with POPIA and our incident-response procedures and will make any notifications required by law.

13. Marketing

We will not use your personal information for direct marketing in circumstances prohibited by POPIA.

Where consent is required for electronic direct marketing, appropriate consent will be obtained separately. You can switch marketing on or off at any time in Account.

14. Children

A person under 18 may only use the App with the consent of a parent or legal guardian, who gives the consents in the App on the child's behalf and whose name we record. A professional who adds a child confirms that they have the parent or guardian's consent.

15. Complaints

You may contact our Information Officer with any privacy complaint.

You may also lodge a complaint with the Information Regulator of South Africa (inforegulator.org.za, complaints.IR@inforegulator.org.za).

16. Changes to this Privacy Notice

We may amend this Privacy Notice from time to time. Material amendments will be communicated through the App or other appropriate means, and where your consent is needed you will be asked to give it again.