Staff Operational & Customer Information Policy

1. PURPOSE AND SCOPE

This Staff Operational & Customer Information Policy (“Policy”) sets out the standards expected of Health Equilibrium employees when handling customer information and performing customer-facing operational duties.

It applies to all employees and temporary staff who have access to Health Equilibrium customer information, systems, documents, orders, communications, customer profiles or other business information.

This Policy supplements each employee's employment contract and other applicable Health Equilibrium policies. Where an employment contract contains a stricter confidentiality or operational requirement, the stricter requirement applies unless unlawful.

The purpose is to protect customers, protect Health Equilibrium's business information, provide consistent customer service and support compliance with the Protection of Personal Information Act 4 of 2013 (“POPIA”).

2. WHAT COUNTS AS CUSTOMER INFORMATION

Customer information includes information that identifies or relates to a customer or their transaction, whether stored electronically, on paper, verbally or in another form.

3. NEED-TO-KNOW ACCESS

Staff may access customer information only when it is reasonably necessary for an authorized work task.

Access is based on role and operational needs. Having technical access to a system does not mean that a staff member is authorized to browse or use every record.

Staff must not search for, open, copy, photograph, export or discuss customer information simply out of curiosity.

POPIA requires responsible parties to take reasonable technical and organizational measures to protect personal information against loss, damage, unauthorized destruction, access or processing. The Information Regulator also emphasizes staff education, access controls and secure handling of personal information. Customer names and contact details.

• Telephone numbers and email addresses.
• Delivery and collection addresses.
• Order history, invoices, receipts and transaction details.
• Product requests, stock-arrival notifications and customer enquiries.
• Customer complaints and correspondence.
• Marketing preferences and consent records.
• Information provided by a customer in connection with a product recommendation.
• Any other information that can identify a customer or is linked to their customer record.

4. HEALTH-RELATED CUSTOMER INFORMATION

Because Health Equilibrium is a health and wellness retailer, customers may voluntarily share information about symptoms, conditions, medication, allergies, pregnancy, age or other health circumstances when asking for product guidance.

Staff must treat any health-related information shared by a customer as confidential and must not discuss it with colleagues who do not need the information to perform their authorized duties.

Health information can constitute special personal information under POPIA, so staff must take particular care with it. The Information Regulator identifies medical information as special personal information and highlights it as high-risk information requiring appropriate protection.

Staff should collect or record only information reasonably necessary for the customer-service task and should avoid recording unnecessary medical details.

Staff must never use a customer's health information for gossip, entertainment, personal interest or any purpose unrelated to the authorized business purpose.

5. CUSTOMER RECOMMENDATIONS AND STAFF BOUNDARIES

Staff may provide general wellness and product information within the limits set by the Health & Wellness Disclaimer and their training.

Staff must not diagnose a customer, prescribe treatment, guarantee a health outcome or claim that a product will cure a disease.

If a customer presents a situation outside the staff member's knowledge, training or authority, the staff member should refer the customer to an appropriately qualified healthcare professional.

Staff should not make assumptions about a customer's health based on appearance, age or other personal characteristics.

6. CUSTOMER COMMUNICATIONS

Customer communications must be professional, accurate and relevant to the customer's enquiry or transaction.

Staff may contact customers for authorized operational purposes, including notifying a customer that an ordered or requested product has arrived, resolving an order problem, arranging collection, addressing a complaint or dealing with a delivery issue.

Marketing communications may only be sent in accordance with Health Equilibrium's marketing-consent processes and applicable law.

Staff must not use customer contact details to contact customers from personal phones, personal email accounts or personal social-media accounts for private purposes.

Where a business WhatsApp account is used in future, staff must follow the approved business account and access procedures.

7. PERSONAL USE OF CUSTOMER INFORMATION IS PROHIBITED

Staff must never:

•Look up a customer's information without a work-related reason.

•Use customer numbers or email addresses for personal contact.

•Add customers to personal WhatsApp groups or social-media accounts.

•Share customer information with friends, family or other customers.

•Discuss a customer's health, order or complaint with colleagues who do not need the information.

•Take customer information home or store it on personal devices without authorization.

•Copy or export customer lists for personal use.

•Use customer information to solicit private business or promote personal services.

Use customer information for gossip, entertainment or curiosity.

8. SHARING CUSTOMER INFORMATION WITH THIRD PARTIES

Customer information may only be shared with an external party where there is an authorized business reason and the disclosure is permitted by applicable law and Health Equilibrium's privacy procedures.

Examples may include sharing necessary delivery information with the courier, providing necessary information to a payment provider, or sharing information with a supplier where it is necessary to resolve a product or order issue.

Staff must not independently disclose customer information to friends, family, other customers, suppliers or third parties without authorization.

Only the minimum information reasonably necessary for the authorized purpose should be shared.

9. CUSTOMER REQUESTS FOR INFORMATION

If a customer asks a staff member to provide access to, change, delete or disclose personal information held by Health Equilibrium, the staff member should not make the decision independently.

The request should be referred to management or the person responsible for POPIA compliance.

POPIA gives the Information Officer responsibilities including encouraging compliance, dealing with requests made under POPIA and ensuring compliance by the organization.

10. SYSTEM AND PASSWORD SECURITY

Staff must keep system passwords, login credentials and access codes confidential.

Staff must not share their personal login credentials with another person.

Staff should lock or sign out of systems when leaving a workstation unattended where the system contains customer or business information.

Staff must not install unauthorized software, copy customer databases to personal devices or connect unauthorized storage devices to systems used for customer information.

Any suspected unauthorized access, lost device, stolen device, compromised password or other security incident must be reported to management immediately.

11. PAPER RECORDS AND PHYSICAL SECURITY

Printed customer information must be kept secure and must not be left unattended where unauthorized persons can view it.

Customer documents should not be left on counters, in public areas, in vehicles or in other unsecured locations.

Where customer information is no longer required and may lawfully be destroyed, it should be disposed of securely rather than placed intact in ordinary public waste.

The Information Regulator's security guidance recommends secure storage, controlled physical access, clear-desk practices and secure disposal of paper and electronic records.

12. SCREENS, PHOTOGRAPHS AND RECORDINGS

Staff must not photograph customer records, screens, order information or personal documents using personal phones unless expressly authorized for a legitimate business purpose.

Staff must not take screenshots of customer records and send them to personal WhatsApp groups, social-media accounts or other unauthorized channels.

Customer information must not be displayed in photographs, videos or social-media content unless the required consent and authorization have been obtained.

13. SOCIAL MEDIA AND PUBLIC DISCUSSION

Staff must never post or discuss identifiable customer information on social media.

Staff must not mention customer names, orders, health information, complaints, addresses, phone numbers or other identifying details in personal posts or group chats.

Staff must not use a customer's story, testimonial, photograph or message for marketing without the appropriate consent and authorization.

Customer disputes or complaints must be handled through the approved Health Equilibrium process rather than argued about publicly online.

14. CUSTOMER DISCOUNTS AND STAFF PURCHASING

Staff may use employee discounts only in accordance with the rules communicated by management.

Staff are only permitted to use their employee discount where the item they wish to purchase is not the last unit on the shelf.

Staff must not reserve, hide, manipulate stock records or otherwise interfere with stock availability in order to obtain an employee purchase or discount.

Staff purchases must be processed honestly and through the approved POS procedure.

15. CUSTOMER COMPLAINTS AND SENSITIVE INTERACTIONS

Staff must handle complaints professionally and must not disclose the details of one customer's complaint to another customer or unauthorized person.

Where a complaint involves personal information, health information, serious staff conduct, a safety issue, suspected fraud or a privacy incident, the matter should be escalated to management.

Staff must not delete, alter or conceal records because a customer has complained.

16. DATA BREACHES AND SECURITY INCIDENTS

A security incident may include accidental disclosure, sending information to the wrong person, loss or theft of a device or document, unauthorized system access, a compromised password, or unauthorized use of customer information.

Staff must report suspected incidents to management immediately and must not attempt to conceal the incident.

Staff should preserve relevant evidence where safe to do so and follow management's incident-response instructions.

The Information Regulator advises organizations to have incident-management procedures and to educate staff on recognizing and reporting personal-information security breaches.

17. LEAVING EMPLOYMENT OR CHANGING ROLES

Confidentiality obligations continue after employment ends to the extent required by the employment contract, applicable law and the nature of the information.

When a staff member changes roles or leaves Health Equilibrium, all business records, customer information, documents, devices, keys, passwords and other company property must be returned or access removed as directed.

Staff must not retain customer lists, customer phone numbers, order histories, screenshots, photographs or other business information for personal use after leaving.

18. TRAINING AND RESPONSIBILITY

Health Equilibrium will provide appropriate instruction on this Policy and relevant customer-information procedures.

Staff are expected to understand their responsibilities and ask management when they are uncertain whether they may access, record, disclose or use particular information.

The Information Regulator's current security guidance recommends staff awareness and training on security responsibilities, business systems, phishing, malware and reporting of personal-information breaches.

19. FAILURE TO COMPLY

Failure to comply with this Policy may expose customers and Health Equilibrium to unnecessary privacy, security and operational risks.

Depending on the seriousness of conduct, a breach may result in counselling, retraining, withdrawal of system access or disciplinary action in accordance with the employee's contract, company procedures and applicable employment law.

Nothing in this Policy creates an automatic disciplinary outcome for a particular incident; each matter will be considered on its facts.

20. OPERATIONAL CUSTOMER-SERVICE STANDARDS

Staff should:

•Use only the customer information needed for the task.

•Keep customer conversations private.

•Use professional language and do not make promises outside your authority.

•Confirm important order details before making changes.

•Escalate uncertain, sensitive or high-risk situations to management.

•Follow the Returns, Refunds & Exchanges Policy, Delivery & Collection Policy, Customer Complaints Policy and Health & Wellness Disclaimer where applicable.

21. MANAGEMENT RESPONSIBILITIES

Management should maintain reasonable controls over access to customer information; ensure staff understand their responsibilities and review procedures when operational systems change.

Management should ensure that customer-information incidents are escalated and assessed appropriately.

Where a POPIA matter requires the involvement of the Information Officer, management should refer the matter accordingly.

22. CONTACT AND ESCALATION

For operational questions, staff should first speak to management.

For suspected privacy breaches or unauthorized disclosure, report the matter to management immediately.

Customer privacy requests or formal POPIA matters should be escalated to the designated Health Equilibrium Information Officer/POPIA responsible person once that role is formally confirmed.

Health Equilibrium contact: info@health-equilibrium.co.za • 012 548 0933

23. POLICY DETAILS

Health Equilibrium SA (Pty) Ltd

Registration No. 2026/267330/07

Effective date: 21 September 2026

Applies to: All staff with authorized access to customer information