Legal

POPIA Notice

Last updated: 10 July 2026

This notice summarises how PlainAid processes personal information under the Protection of Personal Information Act, 2013 (POPIA). It's a solid starting point, not a final compliance sign-off — have it checked by someone qualified in South African privacy law before launch, and make sure PlainAid has a registered Information Officer as POPIA requires.

1. Responsible party

PlainAid is the responsible party for the personal information described in this notice.
Contact: info@plainaid.co.za
Information Officer: Pienaar le Roux

2. Purpose of processing

We collect and process personal information to:

Respond to your request for medical aid guidance and connect you with an accredited broker or adviser, where you've consented
Understand how the Site is used, in aggregate, so we can improve it
Keep the Site secure and working correctly

3. Categories of personal information we process

Category	Examples
Contact details	Name, phone number, email address
Preferences you tell us	Cover type interest, budget range, preferred contact method
Usage information	Pages viewed, searches, plans compared, hospitals viewed
Approximate location	City/province/country, derived from IP address
Consent records	Whether and when you agreed to be contacted by a broker

We do not knowingly collect special personal information (such as health records or precise medical history) — the Site helps you compare plan benefits, it does not ask about your personal health status.

4. Legal basis for processing

We process your personal information on the basis of your consent (for lead/callback form submissions and broker sharing) and our legitimate interest in operating and improving a free public information service (for aggregate, non-identifying usage data).

5. Recipients of personal information

Accredited brokers and financial advisers you've consented to be contacted by
Supabase, our database and authentication infrastructure provider, acting as an operator on our behalf

We do not sell personal information, and we do not share it with data brokers or advertisers.

6. Cross-border processing

Our infrastructure provider may process and store data outside South Africa, depending on server region. Where this happens, we take reasonable steps to ensure the destination country has adequate data protection safeguards, as required by section 72 of POPIA.

7. Security safeguards

Personal information is stored behind authentication controls that restrict read access to signed-in PlainAid administrators only. All data in transit is encrypted (HTTPS). Row-level access rules on our database ensure visitors can submit information but cannot read other people's data.

8. Retention

We retain lead information for as long as reasonably needed to fulfil your request and a limited period afterwards, and aggregate analytics for longer periods to understand trends. You can request deletion at any time.

9. Your rights as a data subject

Under POPIA, you have the right to:

Be notified that your personal information is being collected
Access the personal information we hold about you
Request correction or deletion of your personal information
Object to the processing of your personal information
Withdraw consent at any time, without affecting processing that already took place
Lodge a complaint with the Information Regulator

10. Lodging a complaint

If you believe we haven't handled your personal information properly, you can contact us directly first, or lodge a complaint with South Africa's Information Regulator:

Website: inforegulator.org.za
Complaints page: inforegulator.org.za/complaints

See also: Privacy Policy · Terms of Use