1. Who We Are
Ahava Healthcare (Pty) Ltd (“Ahava”, “we”, “us”) operates a digital health platform connecting patients with nurses and doctors in South Africa. Our registered address is in South Africa.
2. Information We Collect
We collect the following categories of personal information:
- Account information: Name, email address, phone number, date of birth, gender.
- Health data: Biometric readings (heart rate, blood pressure, oxygen saturation, temperature), wearable device data synced via Terra API, AI triage responses.
- Location data: Approximate location used to match you with nearby nurses (nurses only, collected during active availability).
- Device data: IP address, browser/app type, usage logs for security and debugging.
3. Why We Process Your Data (POPIA Lawful Basis)
Under the Protection of Personal Information Act (POPIA), we process your personal information on the following bases:
- Performance of a contract: To provide you with healthcare coordination services.
- Legitimate interest: To improve platform safety, detect fraud, and send service notifications.
- Consent: For health data processing and wearable device integration. You may withdraw consent at any time.
4. How We Use Your Data
- Providing and improving our healthcare coordination services.
- Generating AI-assisted health insights and early-warning alerts.
- Facilitating nurse and doctor visits.
- Sending you appointment reminders, health alerts, and service updates.
- Complying with legal and regulatory obligations.
5. Data Sharing
We do not sell your personal information. We share data only with:
- Healthcare professionals: Nurses and doctors on our platform who are treating you.
- Terra API: Our wearable integration partner, governed by their own privacy policy, used only when you explicitly connect a device.
- Infrastructure providers: Railway (hosting), Cloudflare R2 (file storage) — both under data processing agreements.
- Legal authorities: When required by South African law.
6. Data Retention
We retain your personal information for as long as your account is active or as required by law. Health records are retained for a minimum of 5 years as required by the National Health Act. You may request deletion of non-mandatory data by contacting us.
7. Your Rights Under POPIA
You have the right to:
- Access your personal information held by us.
- Request correction of inaccurate information.
- Request deletion of personal information (subject to legal retention requirements).
- Object to the processing of your personal information.
- Lodge a complaint with the Information Regulator of South Africa.
8. Security
We implement industry-standard security measures including encryption of sensitive fields at rest, TLS in transit, JWT-based authentication, and rate limiting. No system is perfectly secure; we will notify you promptly in the event of a breach affecting your data.
9. Cookies
We use essential cookies for authentication sessions. We do not use tracking or advertising cookies.
10. Contact Us
For privacy-related queries or to exercise your POPIA rights, contact our Information Officer at: privacy@ahavahealthcare.co.za