Privacy Policy

We, lunoflo (Pty) Ltd ("lunoflo", "we", "us", "our"), are committed to protecting the privacy and personal information of our website visitors, customers, and business contacts in accordance with the Protection of Personal Information Act 4 of 2013 ("POPIA").

This Privacy Policy applies to personal information we collect through our website, www.lunoflo.co.za (the "Website"), and in the course of our commercial dealings with you as a prospective or existing customer.

Important distinction: this policy does not cover patient data

This policy describes how lunoflo processes personal information as a Responsible Party. When our customers (allied health practices) use the lunoflo platform, they are the Responsible Party for the patient data they process. In that context, lunoflo acts solely as an Operator on their behalf, and our processing is governed by the Data Processing Addendum to our Master Subscription Agreement. Patients of our customers should refer to their respective practice's privacy policy for information on how their health data is handled.

Responsible Party and Information Officer

In terms of POPIA, the Responsible Party for the information covered by this policy is:

What personal information we collect

We collect and process the following categories of personal information:

Information you provide to us: This includes information you provide when you fill in forms on our Website, request a demo, enter into a contract with us, or otherwise correspond with us. This may include:

• Identity and contact details (e.g., name, company name, email address, telephone number).
• Account and billing information.

Information we collect automatically: When you visit our Website, we may collect technical information, such as your IP address, browser type, operating system, and browsing behaviour. This is typically done through cookies and similar technologies (please see our Cookie Policy for more detail).

Special personal information: We do not seek to collect special personal information (such as health or biometric data) or the personal information of children through our Website.

How and why we use your personal information

We process your personal information on a lawful basis for the following purposes:

• To provide our Website and services to you (performance of a contract).
• To carry out our obligations arising from any contracts entered into between you and us (performance of a contract).
• To respond to your enquiries and provide customer support (legitimate interest).
• To send you service-related notices and, where you have consented or the law allows, direct marketing about our services (consent or legitimate interest).
• To comply with our legal obligations and protect our legal rights (legal obligation).
• To generate aggregated, de-identified statistics to improve our Website and services (legitimate interest).

Sharing and disclosure of your information

• We may share your personal information with third-party service providers who act as operators on our behalf, such as cloud hosting providers (e.g., AWS) and payment processors. We have written agreements in place with these operators to ensure they protect your information.
• We may disclose your personal information if required by law, a court order, or a regulatory body.
• Our Website may contain links to third-party websites. If you follow a link to any of these websites, please note that they have their own privacy policies and that we do not accept any responsibility or liability for these policies.

Cross-border information transfers

While the core lunoflo platform and all patient data are hosted exclusively within South Africa, some of our own commercial or website tools (such as analytics or email providers) may be hosted outside of South Africa. Where we transfer your personal information outside of the Republic, we will only do so in compliance with section 72 of POPIA, ensuring that the recipient is subject to laws or binding agreements that provide an adequate level of protection.

Security and data retention

We take reasonable technical and organisational measures to protect your personal information against loss, unauthorised access, and damage. We will retain your personal information only for as long as is necessary for the purposes set out in this policy, or as required by applicable law, after which it will be securely destroyed or de-identified.

Your rights

Subject to applicable law, you have the right to:

• Request access to the personal information we hold about you.
• Request the correction or deletion of your personal information.
• Object to the processing of your personal information on reasonable grounds.
• Lodge a complaint with the Information Regulator (South Africa).

To exercise these rights, please contact our Information Officer. For formal access requests, the procedure outlined in our PAIA Manual applies.

Contact us

If you have any questions about this policy, please contact our Information Officer at pieter@lunoflo.co.za with "Privacy Policy" in the subject line.