Privacy Policy

1. Introduction and Responsible Party

‍
ALEMÈ Health (Pty) Ltd (“ALEMÈ”, “we”, “us”, “our”), Registration No. [Registration Number], with its registered address at [Street Address], [Suburb], [City], [Postal Code], is a licensed courier and compounding pharmacy and is the Responsible Party in respect of the Personal Information we process, as contemplated in the Protection of Personal Information Act 4 of 2013 (“POPIA”).

This Privacy Policy explains how we collect, use, store, share and protect your Personal Information when you use our website www.aleme.co.za (“the Website”), our pharmacy services, our courier delivery services and any related services. Because we are a pharmacy, we necessarily process health information, which POPIA classifies as special personal information deserving of heightened protection. We are authorised to process health information as a healthcare provider in terms of section 32 of POPIA, subject to the confidentiality obligations imposed on pharmacy professionals by the Pharmacy Act 53 of 1974 and the Rules relating to Good Pharmacy Practice.

Oversight of Personal Information processing rests with our Information Officer, who may be contacted at [popia@aleme.co.za]. Our POPIA and PAIA documentation, including our PAIA Manual, is available on request and on the Website.

2. Personal Information We Process

• Identity Information: name, surname, identity or passport number, date of birth, gender and title.
• Contact Information: delivery and billing addresses, email addresses and telephone numbers.
• Health Information (special personal information): prescriptions, diagnoses or ICD-10 codes appearing on prescriptions or medical scheme claims, medicine and dispensing history, allergies, and clinical information you or your prescriber provide to enable safe dispensing and compounding.
• Children’s Information: where we dispense for a patient under 18, we process the child’s identity and health information with the consent of, and as provided by, a parent, guardian or other competent person, or as otherwise permitted by law.
• Financial Information: payment details, medical scheme name, plan and membership number, and claim and co-payment information.  Card payments are processed by our PCI DSS-compliant payment service provider; we do not store full card numbers on our own systems.
• Transaction Information: details of orders placed, products supplied, deliveries and collections, and communications about them.
• Technical and Usage Information: IP address, device and browser information, and information about how you use the Website, collected through cookies and similar technologies as described in our Cookie Policy.
• Communication records: records of your interactions with us, including pharmacist counselling notes, emails, messages and, where indicated, recorded calls.

3. How We Collect Personal Information

‍
We collect Personal Information directly from you (when you register, place an order, submit a prescription or communicate with us); from your prescriber or other healthcare providers (when a prescription is transmitted to us or clarified); from your medical scheme or its administrator (for claims and authorisations); automatically from your device when you use the Website; and, where necessary, from a person legally competent to act on behalf of a patient (such as a parent or caregiver).

4. Purposes of Processing

• Dispensing, compounding and delivering medicines and providing pharmaceutical care, including clinical checks, counselling and pharmacovigilance.
• Processing payments and submitting claims to medical schemes at your request.
• Complying with our legal and regulatory obligations under the Medicines Act, the Pharmacy Act, GPP, tax legislation and other applicable laws, including record-keeping and reporting to SAHPRA, the SAPC and other authorities where required.
• Managing your profile, providing repeat-medicine and reminder services, and communicating service messages regarding your orders and prescriptions.
• Operating, securing and improving the Website, and preventing and detecting fraud, prescription fraud and abuse.
• Sending you direct marketing only as permitted by section 69 of POPIA: to non-customers, only with your consent; to existing customers, only in respect of similar products or services, with an opt-out available in every communication. We do not use your health information for marketing purposes without your express consent.

5. Sharing of Personal Information

‍
We do not sell your Personal Information.  We share it only as necessary and lawful, with: our employees and locum pharmacists bound by company and professional confidentiality; your prescriber or other healthcare providers involved in your care; your medical scheme and its administrators and switching agents for claims processing; our couriers (limited to the information needed to deliver your parcel - couriers do not receive details of the medicines inside); our IT, hosting, payment and other service providers (operators) under written agreements imposing confidentiality and security obligations; and regulators, law enforcement or courts where disclosure is required by law.  Parcel packaging does not disclose the nature of its contents.
‍

6. Storage, Security and Cross-Border Transfers

‍
We implement appropriate, reasonable technical and organisational measures to protect Personal Information against loss, damage, unauthorised access and unlawful processing, including encryption in transit, access controls, staff confidentiality undertakings and physical security at our premises.  Personal Information is stored on infrastructure located in South Africa or, where our service providers store information in other jurisdictions, we ensure that the transfer complies with POPIA, including through contractual protections that provide an adequate level of protection. Should a data breach occur that requires notification, we will notify the Information Regulator and affected data subjects as required by POPIA.

7. Retention

‍
We retain Personal Information only as long as necessary for the purposes described in this policy and as required by law.  Prescription and dispensing records are retained for the minimum periods prescribed by the Medicines Act, the Pharmacy Act and GPP (not less than 5 (five) years), and financial records for the periods required by tax and company legislation.  Thereafter, records are securely destroyed or de-identified.

8. Your Rights

• To be notified that your Personal Information is being collected, and of any breach affecting it.
• To request access to the Personal Information we hold about you, and to obtain a copy (a request may be made).
• To request correction or deletion of Personal Information that is inaccurate, irrelevant, excessive, outdated, incomplete, misleading or unlawfully obtained, subject to records we are required by law to retain.
• To object, on reasonable grounds, to processing, and to opt out of direct marketing at any time.
• To withdraw consent where processing is based on consent, without affecting processing already carried out.
• To lodge a complaint with the Information Regulator (South Africa): complaints.IR@inforegulator.org.za / www.inforegulator.org.za.

9. Cookies, Children and Third-Party Sites

‍
Our use of cookies and similar technologies is described in our Cookie Policy. The Website is not directed at children; however, as a pharmacy we lawfully process children’s health information for dispensing purposes as described in clause 2. The Website may link to third-party websites whose privacy practices we do not control; we encourage you to review their privacy policies.

‍
10. Changes to this Policy and Contact

‍
We may amend this Privacy Policy from time to time and will take reasonable steps to bring material changes to your attention on the Website.  Questions, access requests and complaints may be addressed to our Information Officer at [popia@aleme.co.za] or [+27 XX XXX XXXX].  This policy is governed by the laws of the Republic of South Africa.