Customer Data Protection Policy

1. Purpose

Health Equilibrium collects and stores customer information only for legitimate business, service, health, ordering, support, communication, and legal purposes. This policy explains how customer data must be collected, used, stored, accessed, protected, retained, and disclosed in line with the Protection of Personal Information Act, 4 of 2013, known as POPIA.

2. Our Commitment

Health Equilibrium will never knowingly sell, rent, trade, share, or give personal customer data to any person, business, organisation, or third party for marketing, commercial gain, or unrelated purposes.

Customer personal information may only be disclosed where:

• the customer has given clear consent;
• disclosure is necessary to provide a service requested by the customer;
• disclosure is required by law, court order, regulator, SARS, law enforcement, or another legally authorised body;
• disclosure is necessary to protect Health Equilibrium's legal rights;
• disclosure is necessary to prevent fraud, abuse, security threats, or harm;
• a contracted service provider processes the information on Health Equilibrium's behalf under confidentiality and data protection obligations.

3. Information We May Collect

Health Equilibrium may collect and store customer information such as:

• name and surname;
• contact details;
• delivery or billing address;
• order history;
• payment-related records, excluding full card details unless handled by an authorised payment provider;
• health-related preferences or information voluntarily supplied by the customer;
• communication history;
• account, invoice, or support information.

Only information that is necessary, relevant, and not excessive may be collected.

4. Lawful Processing

Health Equilibrium processes customer data only where there is a lawful reason to do so, including:

• customer consent;
• performance of a sale, order, delivery, consultation, or service;
• compliance with legal or accounting obligations;
• legitimate business purposes that do not unfairly infringe the customer's privacy;
• protection of the customer, Health Equilibrium, or another person's rights or safety.

5. Access Control

Customer data stored in Health Equilibrium's internal database may only be accessed by authorised staff or service providers who need access for a legitimate work purpose.

Staff may not browse, copy, export, photograph, share, download, or use customer data for private purposes or for any purpose unrelated to their duties.

Access must be limited by role wherever possible.

6. Security Safeguards

Health Equilibrium must take reasonable technical and organisational steps to protect customer data against loss, unauthorised access, misuse, disclosure, alteration, or destruction.

These safeguards should include, where practical:

• password-protected systems;
• restricted admin access;
• secure hosting and database permissions;
• regular backups;
• malware and firewall protection;
• encrypted connections where possible;
• staff confidentiality obligations;
• secure disposal of old records;
• regular review of who has access to customer data.

7. Sharing With Service Providers

Where Health Equilibrium uses third-party providers such as couriers, payment processors, IT support providers, email systems, hosting providers, accountants, or legal advisers, only the minimum necessary customer information may be shared.

Any provider handling personal information on behalf of Health Equilibrium must be required to keep it confidential and protect it appropriately.

8. Retention

Customer data must not be kept longer than necessary for the purpose for which it was collected, unless retention is required for legal, tax, accounting, warranty, dispute, fraud-prevention, or regulatory reasons.

When information is no longer required, it must be securely deleted, anonymised, or destroyed in a way that prevents reconstruction.

9. Customer Rights

Customers may request:

• confirmation of whether Health Equilibrium holds their personal information;
• access to their personal information;
• correction of inaccurate or outdated information;
• deletion of information where Health Equilibrium is no longer legally entitled or required to keep it;
• objection to certain processing;
• withdrawal of consent where processing is based on consent.

Requests should be directed to Health Equilibrium's Information Officer or appointed privacy contact.

10. Direct Marketing

Health Equilibrium may only send marketing messages where permitted by POPIA and applicable electronic communications laws.

Customers must be able to opt out of marketing communications, and opt-out requests must be honoured.

11. Data Breaches

If Health Equilibrium becomes aware of a data breach or suspected unauthorised access to customer information, it must:

• investigate the incident promptly;
• take steps to contain and fix the issue;
• assess what information was affected;
• notify the Information Regulator and affected customers where required by POPIA;
• keep records of the incident and corrective action taken.

12. Staff Responsibility

All staff, contractors, and administrators who access customer data must treat it as confidential. Any misuse, unauthorised disclosure, or negligent handling of customer data may result in disciplinary action, termination of access, or legal action.

13. Review

This policy should be reviewed at least once a year, or whenever Health Equilibrium changes how customer data is collected, stored, shared, or processed.

Recommended Internal Statement

Health Equilibrium respects and protects the privacy of its customers. We do not sell or give away customer personal information. We only collect and use personal information for legitimate business, service, legal, and customer-care purposes, and we take reasonable steps to protect that information in accordance with POPIA.