Privacy Notice

SimplyMed is the responsible party for personal information processed through this website. Contact us on WhatsApp via the About page (currently +27 82 975 9342).

1. What we collect

• Order details: name, email, university, expected graduation year, optional notes, package chosen, amount paid, PayFast / order identifiers.
• Account: name, email, password hash (held by our auth provider), sign-in timestamps.
• Usage that stays on your device: podcast progress, Disease of the Day streak/profile, similar items in localStorage.
• Technical: IP address, browser type, and standard server logs when you hit our host (needed to run and secure the site).
• Messages: whatever you send us on WhatsApp or email.

We do not ask for medical records, ID numbers, or patient information. Do not send us patient-identifiable data.

2. Why we process it (POPIA)

We process information to:

• take payment and deliver digital content (contract);
• create and secure your account (contract / legitimate interest in security);
• send order and access emails (contract);
• fix bugs and prevent abuse (legitimate interest);
• answer support messages (contract / legitimate interest);
• meet tax and accounting duties (legal obligation).

We do not use your data for third-party advertising. We may email you about your purchase or service changes. If we ever send optional marketing, we will only do so where POPIA allows (including opt-out).

3. Who we share with

Operators who help us run the product, under their own terms:

• PayFast — payments;
• Supabase — database, auth, file storage;
• Hosting — currently the app host (for example Heroku) and related infrastructure;
• Google — if we use Apps Script, Sheets, or Gmail to complete delivery;
• WhatsApp / Meta — if you message us there.

We may disclose information if the law requires it, or to protect the site, users, or our legal rights.

4. Cross-border transfer

Some processors store or process data outside South Africa. Where POPIA section 72 applies, we rely on the operator’s contractual / adequacy arrangements and your use of an international web service. If that is not acceptable, do not create an account or buy.

5. Retention

Order and account records are kept as long as the account exists and for a reasonable period after (including tax record-keeping). Device-only data lasts until you clear it. Support chats follow the messaging app’s retention.

6. Security

We use ordinary industry measures (HTTPS, hashed passwords via the auth provider, access controls). No method is perfect. You must keep your password and inbox safe.

7. Your rights

Subject to POPIA, you may request access, correction, deletion, or restriction, and you may object to processing in certain cases. Use WhatsApp/About to ask. We may need to verify it is you.

You may complain to the Information Regulator (South Africa): inforegulator.org.za.

Deleting an account does not always delete payment records we must keep by law.

8. Children

The site is aimed at university students. If you are under 18, a competent person should consent to our processing of your information.

9. Cookies and similar tech

We use localStorage for study progress and the auth provider’s session storage/cookies so you stay signed in. We do not run third-party ad pixels. The site may load fonts or scripts from Google or other CDNs, which have their own privacy practices.

10. Changes

We may update this notice. The date at the top will change. Material changes will be posted here.

Read with the Terms of Use. This is a practical POPIA notice, not legal advice to us or to you.