Privacy Policy

Link to PAIA documents:

PIVOT MOBILE APP PRIVACY POLICY

1. COMMITMENT TO YOUR PRIVACY

1.1. Welcome to the Pivot Mobile App (“App”), owned and operated by Triba Health ApS (“Triba Health”). Triba Health is committed to protecting the privacy of the user of the App. Triba Health values the trust of its subscribers and all others who work with it and Triba Health recognises that maintaining your trust requires transparency and accountability in how Triba Health handles your Personal Information. This privacy policy (“Policy”) is incorporated into and is subject to Triba Health’s standard terms and conditions and the general terms relating to the use of the App.

1.2. In performing Triba Health’s services in the ordinary course of business, Triba Health may collect, use and disclose Personal Information. Anyone from whom Triba Health collects such information can expect that it will be appropriately and lawfully protected and that any use of or other dealing with this information is subject to consent, where this is required by law. This is in line with the general privacy practices of Triba Health.

1.3. This Policy sets out how Triba Health collects, uses, discloses, and safeguards the Personal Information it processes in the course of its business, in accordance with the Protection of Personal Information Act 4 of 2013 (“POPIA”).

2. DEFINITIONS

2.1. In this Policy, in addition to the other terms that have been defined in the body of the Policy, Triba Health makes use of the following terms:

2.1.1. “Personal Information” means all information which may be considered to be personal in nature or information about an identifiable natural and/or existing juristic person (where applicable) in terms of the Electronic Communications and Transactions Act 25 of 2002 (“ECTA”), the Consumer Protection Act 68 of 2008 (“CPA”) and POPIA;

2.1.2. “Special Personal Information” means Personal Information concerning, among other things, a data subject’s health, as contemplated in section 26 of POPIA;

2.1.3. “Responsible Party” means Triba Health, being the party that determines the purpose of and means for processing your Personal Information;

2.1.4. “Operator” means a third party that processes Personal Information on behalf of Triba Health in terms of a written contract; and

2.1.5. “User, you, your or yourself” refers to any person who makes use of the App for any purposes whatsoever, whether or not such use is free of charge or paid for.

2.2. In addition, unless the contrary is specified, terms that are used in the Policy that are specifically defined in POPIA, are given the meanings ascribed to them in POPIA.

3. INFORMATION OFFICER

3.1. Triba Health has appointed an Information Officer who is responsible for ensuring Triba Health’s compliance with POPIA, and who is registered with the Information Regulator (South Africa).

3.2. Any request, query or concern regarding this Policy or the processing of your Personal Information may be addressed to the Information Officer at info@triba.co.za, by calling +27 21 526 0300, or in writing to Triba Health ApS at its registered address (available on request from the Information Officer).

4. COLLECTION OF PERSONAL INFORMATION

4.1. Triba Health may collect Personal Information in conducting its ordinary business operations, including through the use of its App. In processing such Personal Information, Triba Health at all times ensures that (i) it complies with the provisions of POPIA and (ii) such Personal Information is collected for a specific, explicitly defined and lawful purpose.

4.2. The categories of Personal Information Triba Health may collect include your name, contact details, account credentials, demographic information, information you submit through the App, and — where you provide it — health-related information relevant to the services (see clause 6 below).

4.3. Where reasonably practicable, Triba Health collects Personal Information directly from you. At the point of collection, Triba Health will take reasonable steps to ensure you are aware of the information being collected, the purpose of collection, the name and address of the Responsible Party, and the recipients of the information, in accordance with section 18 of POPIA.

4.4. Whether you supply particular Personal Information is generally voluntary. However, certain information is necessary for Triba Health to create your account, provide the App and deliver the services. If you do not supply such information, Triba Health may be unable to provide you with the App or some of its features or services.

4.5. If you choose to receive messages on WhatsApp, Triba Health collects and verifies the mobile number you use for WhatsApp and records the message topics you select, the date and time of that choice and where in the App you made it, so that it only sends you the messages you have asked for.

5. PURPOSE AND LAWFUL BASIS FOR PROCESSING

5.1. Triba Health processes your Personal Information for the following purposes: (i) providing, operating and improving the App and the services; (ii) creating and administering your account; (iii) delivering health, coaching and programme-related content and support; (iv) processing payments and managing subscriptions; (v) responding to your queries and providing customer support; (vi) sending you service and, where permitted, marketing communications; (vii) inviting you to take part in voluntary user research, including interviews, usability testing and surveys; and (viii) complying with applicable law.

5.2. Triba Health relies on one or more of the following lawful bases for processing, as recognised in section 11 of POPIA: (i) your consent; (ii) the processing being necessary to conclude or perform a contract with you; (iii) compliance with a legal obligation; (iv) the protection of your legitimate interests; or (v) the pursuit of the legitimate interests of Triba Health or a third party.

5.3. Where Triba Health invites you to take part in user research, including interviews, usability testing and surveys, your participation is entirely voluntary. You may decline an invitation, or withdraw from a research activity at any time, and doing so will not affect your access to the App, the services, or the standard of any service or support you receive. You may opt out of receiving research invitations at any time, free of charge, by using the opt-out provided in the invitation or by contacting the Information Officer.

5.4. Where Triba Health selects research participants on the basis of health information, or where a research activity itself involves the processing of health information, Triba Health will obtain your explicit consent for that processing as contemplated in clause 6 below. Any recording, transcription, or further use of material generated during a research activity will be subject to a separate, specific consent obtained from you at the time of that activity.

6. SPECIAL PERSONAL INFORMATION (HEALTH INFORMATION)

6.1. Because the App provides health-related services, Triba Health may process Special Personal Information concerning your health.

6.2. Triba Health processes such health information on the basis of your explicit consent and/or because the processing is necessary for the provision of health services to you, as permitted under sections 27 and 32 of POPIA.

6.3. Triba Health treats health information with a heightened degree of confidentiality and applies appropriate, reasonable technical and organisational measures to protect it. You may withdraw your consent to the processing of your health information at any time, subject to clause 10.7 below.

7. OBTAINING CONSENT

7.1. Triba Health does not, except where otherwise permitted by law, collect, use or disclose your Personal Information without your consent.

7.2. Where Triba Health relies on your consent, that consent is voluntary, specific and informed, and you may withdraw it at any time by contacting the Information Officer. Withdrawal of consent does not affect the lawfulness of processing carried out before the withdrawal.

7.3. You have the right to object to the processing of your Personal Information as contemplated in section 11(3) of POPIA. You may object to processing of your Personal Information for purposes of direct marketing by means of unsolicited electronic communications, or where the processing is based on the protection of a legitimate interest or the pursuit of a legitimate interest, at any time. Where your objection relates to direct marketing, you are not required to provide any grounds for that objection.

8. USE, DISCLOSURE AND SHARING OF PERSONAL INFORMATION

8.1. Triba Health operates its App, and conducts its business in general, in accordance with South African legislation. Triba Health considers it imperative to protect the privacy interests of data subjects (natural as well as juristic persons).

8.2. Triba Health may share your Personal Information with Operators (third-party service providers) who process it on Triba Health’s behalf — for example providers of hosting, cloud infrastructure, in-app messaging, video consultation, payment processing, analytics, error monitoring and customer communication services. Triba Health concludes written contracts with such Operators requiring them to process Personal Information only on Triba Health’s instructions and to maintain appropriate security safeguards, as required by sections 20 and 21 of POPIA.

8.3. Triba Health may also disclose Personal Information where required to do so by law, court order or a competent authority, or to protect its rights.

8.4. Triba Health is part of a Danish-headquartered group and relies on cloud infrastructure, in-app messaging, video consultation, analytics and communication providers whose processing and storage take place outside of South Africa (including in the European Economic Area and other jurisdictions). Your Personal Information will therefore be transferred to, and processed in, countries outside South Africa. Triba Health will ensure that any such transfer complies with section 72 of POPIA — for example where the recipient is subject to a law, binding corporate rules or a binding agreement that provides an adequate level of protection substantially similar to POPIA, where you have consented, or where the transfer is necessary for the performance of a contract with you. Where a destination country does not provide a comparable level of protection, Triba Health will put in place contractual and technical safeguards to protect your Personal Information.

8.5. Where you have opted in to WhatsApp messages, Triba Health sends them through WhatsApp, a service provided by Meta Platforms, using a customer communication Operator. Your WhatsApp number and the content of those messages are processed by these providers in order to deliver them, subject to their own terms and privacy policies, and may be processed outside South Africa as set out in clause 8.4.

9. RETENTION OF PERSONAL INFORMATION

9.1. Triba Health retains your Personal Information only for as long as there is a legitimate purpose for it, or for as long as required or authorised by applicable South African law, in accordance with POPIA. Triba Health will not retain Personal Information for longer than is necessary to achieve the purpose for which it was collected, unless retention is required or authorised by law, or you have consented to longer retention.

9.2. Unless a longer retention period is required or permitted by law, Triba Health applies the following minimum retention periods:

9.2.1. Account and profile details, communications, health and wellness information (including data you enter such as lab results), and payment records: 3 (three) years after termination of your account or of our relationship with you.

9.2.2. Financial and tax records: 5 (five) to 7 (seven) years, as required by the Tax Administration Act 28 of 2011 and the Companies Act 71 of 2008.

9.2.3. Anonymised data may be retained indefinitely for research, scientific and statistical purposes.

9.3. Once the applicable retention period has elapsed and there is no longer a legal obligation to retain your Personal Information, it is securely destroyed or anonymised.

9.4. You may request deletion of your Personal Information at any time by contacting info@tribahealth.com, subject to any retention obligations imposed by applicable law.

10. YOUR RIGHTS IN RELATION TO YOUR PERSONAL INFORMATION

10.1. It is important to note that you have rights in relation to your Personal Information.

10.2. You have the right to contact Triba Health at any time to ask Triba Health to:

10.2.1. confirm that it holds your Personal Information (at no charge);

10.2.2. provide you access to any records containing your Personal Information or a description of the Personal Information that Triba Health holds about you (subject to payment of a prescribed fee); and / or

10.2.3. confirm the identity or categories of third parties who have had, or currently have, access to your Personal Information (also subject to payment of a prescribed fee).

10.3. Triba Health can be contacted by writing an email to info@triba.co.za or calling us on +27 21 526 0300.

10.4. When you make a request regarding your Personal Information, Triba Health will take reasonable steps to confirm your identity.

10.5. There may be times when Triba Health cannot grant access to your Personal Information, including where granting you access would (i) interfere with the privacy of others, or (ii) result in a breach of confidentiality. Triba Health will always provide you with reasons if this is the case.

10.6. If you are of the view that any Personal Information that Triba Health holds about you is incorrect in any way, including that it is inaccurate, irrelevant, outdated, incomplete or misleading, you are allowed to ask Triba Health to correct it. If you believe that any Personal Information that Triba Health holds about you is excessive or has been unlawfully obtained, you can ask Triba Health to destroy or delete it. You may do the same if you think that it has been retained for longer than necessary, given the purpose. Triba Health will do so unless there are good grounds not to (such as that Triba Health is required to hold it for a period prescribed by any applicable legislation).

10.7. It is important, however, to understand that if you withdraw your consent for Triba Health to use some of your Personal Information, it may affect the quality and level of service that Triba Health can provide to you.

11. SECURITY

11.1. Triba Health has adopted a security model to protect your Personal Information that complies with generally accepted information security practices and procedures. As part of Triba Health’s security systems, Triba Health has implemented fire-wall technology, password controls, encryption processes and antivirus software. This is in addition to the physical security measures adopted by Triba Health to ensure that it takes all appropriate, reasonable technical and organisational measures to prevent (i) loss of, damage to, or unauthorised destruction of Personal Information, and (ii) unlawful access to or processing of Personal Information. Triba Health has a stringent security policy in place that every officer, employee and supplier of Triba Health must adhere to.

11.2. Triba Health confirms that it takes all reasonable measures to:

11.2.1. identify all reasonably foreseeable internal and external risks to any Personal Information in its possession or under its control;

11.2.2. establish and maintain appropriate safeguards against any risks that are identified by Triba Health;

11.2.3. regularly verify that these safeguards are effectively implemented by or on behalf of Triba Health; and

11.2.4. ensure that such safeguards are continually updated in response to new risks or deficiencies in previously implemented safeguards.

11.3. Where there are reasonable grounds to believe that your Personal Information has been accessed or acquired by an unauthorised person, Triba Health will notify the Information Regulator and you as soon as reasonably possible after the discovery of the compromise, in accordance with section 22 of POPIA.

12. DIRECT MARKETING

12.1. If you (i) are a client of Triba Health, or (ii) are a user of the App who has purchased products or services from Triba Health, Triba Health may use your contact details to send you details of similar products or services which Triba Health thinks you would be interested in, subject to your right to opt out at any time.

12.2. Triba Health will only send you electronic direct marketing communications where you have consented to receive them (for example by ticking the relevant boxes or opting in at the time your details are collected), or where permitted under section 69 of POPIA. You will be given the opportunity to object to, or opt out of, direct marketing both at the time your details are collected and in every direct marketing communication, free of charge. Triba Health will not process your Personal Information for direct marketing purposes by means of unsolicited electronic communications except as permitted by law.

12.3. An invitation to take part in user research is not direct marketing and is not sent for the purpose of promoting Triba Health’s products or services. Where Triba Health offers a reward or other incentive for participation, it will treat that invitation as a direct marketing communication and will send it only where permitted under this clause 12.

12.4. WhatsApp messages. Triba Health will only send you messages on WhatsApp where you have opted in by ticking the topics you wish to hear about and confirming your WhatsApp number in the App. How often Triba Health messages you depends on the topics you choose. You may change your topics or turn WhatsApp messages off at any time in the App's Account settings, or reply STOP to any WhatsApp message to unsubscribe, free of charge. Triba Health keeps a record of your opt-in, the topics you selected and any withdrawal of that consent.

13. CHILDREN

13.1. The App is not intended for use by children (persons under the age of 18). Triba Health does not knowingly process the Personal Information of a child without the prior consent of a competent person, as required by section 34 of POPIA.

13.2. If you believe that Triba Health has inadvertently collected the Personal Information of a child, please contact the Information Officer so that the information can be deleted.

14. SDKs, DEVICE IDENTIFIERS AND TRACKING TECHNOLOGIES

14.1. As a mobile application, the App does not rely on browser cookies in the way a website does. Instead, the App uses software development kits (SDKs), device and application identifiers, and similar tracking technologies to operate the App and understand how it is used.

14.2. These technologies may collect information such as device and application identifiers, usage and interaction data, diagnostic and crash data, and approximate location. Triba Health uses this information to operate and secure the App, understand and improve how the App is used, diagnose and fix errors, and communicate with you.

14.3. Some of these technologies are provided by the Operators referred to in clause 8.2 — including product analytics, error and performance monitoring, and customer communication providers — and may use persistent identifiers that can be associated with you or your device. These Operators process such information on Triba Health’s behalf under written contracts, and cross-border transfers are handled as described in clause 8.4.

14.4. Where required by law, Triba Health relies on your consent for such tracking, and you can manage certain tracking preferences through your device settings and, where available, in-App settings.

15. THIRD-PARTY WEBSITES

15.1. The App may contain links to third party websites. In the event that you follow a link to any of these websites, it is important to note that these websites have their own terms of use and privacy policies and that Triba Health does not accept any responsibility or liability for them.

15.2. As Triba Health is not responsible for any representations, information, warranties and/or content on any website of any third party (including websites linked to this App), Triba Health does not exercise control over third parties’ privacy policies and the onus is on the User to refer to the privacy policy of any such third party before providing them with any of your Personal Information.

16. UPDATING OF PRIVACY POLICY

Triba Health reserves the right to update, modify or amend this Policy from time to time. Triba Health will update the “last updated” date at the top of this Policy and, where a change is material — in particular where Triba Health intends to process your Personal Information for a purpose other than that for which it was collected — Triba Health will take reasonable steps to notify you of the change and, where required by law (including for health information), obtain your fresh consent. You are encouraged to review the Policy whenever you use the App. Save as expressly provided to the contrary in this Policy, any amended version of the Policy shall supersede and replace all previous versions thereof.

17. CONTACT INFORMATION AND COMPLAINTS

17.1. Questions, concerns or complaints related to this Policy or Triba Health’s treatment of Personal Information should be directed to the Information Officer at info@triba.co.za.

17.2. If you are not satisfied with how Triba Health has handled your Personal Information or your complaint, you have the right to lodge a complaint with the Information Regulator (South Africa):

17.2.1. Website: https://inforegulator.org.za

17.2.2. Email: enquiries@inforegulator.org.za (general) or POPIAComplaints@inforegulator.org.za (POPIA complaints)

17.2.3. Telephone: +27 (0)10 023 5200.

THIS WEBSITE: COOKIES, LOCAL STORAGE AND ANALYTICS

This section describes what the Pivot member website itself stores and collects.

Strictly necessary cookies. When you log in, the website sets a cookie that keeps you signed in for up to 30 days, or until you log out. If you reset your password, a cookie holds your reset link for up to 1 hour so that the link does not stay in your browser's address bar. If a host removes you from a consultation, a cookie stops this browser from rejoining that consultation for up to 4 hours. The website cannot work without these cookies.

Analytics. The website uses PostHog, hosted in the European Union, to understand how it is used, for example which pages are viewed and which buttons are pressed. Once you log in, this activity is linked to your account. PostHog keeps an identifier in a cookie and in your browser's local storage.

Error monitoring. The website uses Sentry to record technical errors and performance information so that problems can be found and fixed.

Camera and microphone. Your browser asks for your permission before the website uses your camera or microphone. They are used only while you take part in a session or consultation you have chosen to join.

You can clear or block cookies and local storage in your browser settings. If you block the strictly necessary cookies, you will not be able to log in.