PRIVACY POLICY

1. Introduction and Scope

G 1 Healthcare (Pty) Ltd ("G1 Healthcare", "we", "us") is the responsible party for the personal information described in this policy, as that term is used in the Protection of Personal Information Act 4 of 2013 ("POPIA").

This policy explains what we collect, why we collect it, who we share it with, where it goes, how long we keep it, and what you can require us to do about it. It applies to visitors to www.g1healthcare.co.za, registered account holders, business and institutional customers, and anyone who contacts us or submits a request for quotation.

We supply ostomy and continence care medical devices. Because of what we sell, some of the information we hold is health information, which POPIA treats as special personal information and protects more strictly. Clause 5 sets out how we handle it.

2. Responsible Party and Information Officer

G 1 Healthcare (Pty) Ltd, Registration No. 2025/451756/07, a private company incorporated in South Africa.

Registered office and address for legal service: 3 Inglenook Road, Riverside Lifestyle Estate, House 14, Nahoon Valley Park, Eastern Cape, 5202, South Africa.

The Managing Director of G1 Healthcare is the designated Information Officer for the purposes of POPIA and the Promotion of Access to Information Act 2 of 2000 ("PAIA"), and is registered as such with the Information Regulator. All privacy requests, objections and complaints should be addressed to the Information Officer at support@g1healthcare.co.za.

3. Personal Information We Collect

3.1 Information you give us when you create an account. Your name, email address, telephone number, and the sign-in credentials you set. Your password is created and held by our authentication provider — we never see it or store it.

3.2 Information you give us when you place an order. Your delivery address, the name and telephone number of the person who is to receive the parcel (which may not be you), the products and quantities ordered, your chosen payment method, and any purchase order number.

3.3 Payment information. Card and banking details are entered on PayFast's secure page and are processed by PayFast. They are never transmitted to, or stored on, our systems. We receive only the payment result, amount and reference.

3.4 Regulatory verification documents. Where a product is restricted by its regulatory classification, we collect the medical licence or prescription document you upload, together with the licence type, licence number, issuing authority and expiry date.

3.5 Business and institutional customer information. For hospital, clinic and distributor accounts: organisation name, tax registration number, tax exemption status, agreed credit limit and payment terms, the names and contact details of your buyers, procurement managers and finance officers, and the contents of any request for quotation you submit.

3.6 Service and support information. Support tickets you open, the issue you describe, service contract and equipment serial number details, technician assignment records, and correspondence with our team.

3.7 Content you publish. Product reviews, ratings and review titles. See clause 11 — reviews are published publicly.

3.8 Preferences and alerts. Wishlist items, your last-used delivery address, and any email address you give us to be notified when an out-of-stock product is available again.

3.9 Enquiries. Anything you send us through the contact form, by email or over WhatsApp, including your name, email address, telephone number and the content of your message.

3.10 Technical information collected automatically. IP address, browser and device type, pages viewed, and cookie and local storage identifiers. See our Cookie Policy.

3.11 Traceability records. The lot or batch number and, where applicable, the serial number of the specific device supplied to you, linked to your order. We are required to hold this so that a defective lot can be traced to the people who received it.

4. Where the Information Comes From

Almost all of it comes directly from you. We also generate information about you in the ordinary course of business (order history, verification decisions, credit standing on a business account), and we receive limited information back from our fulfilment partner — approval status, tracking number, courier and estimated delivery date. We do not buy personal information from data brokers and we do not build profiles of you from third-party sources.

5. Health Information and Other Special Personal Information

5.1 What is special personal information here. Your prescription or medical licence document; the clinical detail you volunteer in a support ticket, review or enquiry; and — by inference — the fact that you purchased a stoma, urostomy or continence device at all.

5.2 Our ground for processing it. Section 26 of POPIA prohibits the processing of health information unless section 27 or section 32 applies. G1 Healthcare is a licensed distributor of medical devices, not a medical professional or healthcare facility, so we rely on your explicit consent under section 27(1)(a), given when you place an order or upload a document, together with section 27(1)(b) where processing is necessary to establish, exercise or defend a right in law. You may withdraw that consent at any time — but if you do, we cannot lawfully continue to supply restricted products to you, and clause 13 explains which records we must nevertheless retain.

5.3 Confidentiality. Everyone who handles health information at G1 Healthcare does so under a written duty of confidentiality, as contemplated in section 32(2) of POPIA. Access is restricted to the compliance staff who review verification documents and the support staff handling your enquiry.

5.4 Minimisation at the warehouse. Our fulfilment partner and the warehouse receive the SKU and quantity they need to pick and pack your parcel. They are not given prescriptions, licence documents, clinical notes, or any part of your medical history.

5.5 Regulations on the processing of health information. The Regulations on the Processing of Health Information published under POPIA and in force since 6 March 2026 impose specific security, disposal and cross-border requirements on the processing of health records. We apply those standards to health information in our possession whether or not G1 Healthcare falls within the categories of responsible party the Regulations expressly name.

6. Why We Process Your Information, and on What Lawful Basis

7. Who We Share Your Information With

We do not sell your personal information, and we do not share it for anyone else's marketing. We share it only with the operators and recipients listed below, each of which processes it on our documented instructions under a written agreement that requires POPIA-grade security and confidentiality, as required by sections 20 and 21 of POPIA.

We will also disclose personal information where we are obliged or entitled to:

• to SAHPRA and other regulators, where a device we supplied is implicated in an adverse event, a field safety corrective action or a recall — see our Product Safety, Adverse Event & Recall Policy;
• to the South African Revenue Service and other authorities where the law requires it;
• to our auditors, insurers and legal advisers, under professional duties of confidentiality;
• to a court, where disclosure is ordered or is necessary to establish or defend a legal claim; and
• to an acquirer, if our business or a part of it is sold or restructured — in which case the acquirer is bound by this policy in respect of information transferred to it.

8. Sending Information Outside South Africa

What crosses the border is information, not your parcel. Your order is stored at our fulfilment partner's South African warehouse and delivered to you by a South African courier. We do not ship from abroad, and nothing you buy passes through customs. Clause 1 of our Shipping & Delivery Policy confirms that we deliver within the Republic only.

Several of the operators in clause 7 nevertheless process your personal information on computer systems located outside the Republic. The warehouse software our fulfilment partner uses to record the picking and packing of your parcel, Mintsoft, is supplied by a company in the United Kingdom and runs on its servers there; our fulfilment partner's own systems are cloud-hosted abroad; our authentication and email providers are in the United States; uploaded documents are stored with a provider incorporated in India; and our hosting and database infrastructure is likewise cloud-hosted outside South Africa. Each of those is a transfer of data, and section 72 of POPIA applies to it.

8.1 How each transfer is authorised. Section 72 of POPIA permits a transfer only on specific grounds. We rely on:

• Section 72(1)(a) — binding agreement. Each recipient is bound by a written data processing agreement requiring it to apply protections substantially similar to POPIA's eight conditions for lawful processing, and to impose equivalent terms on any onward transfer.
• Section 72(1)(b) — necessity for the contract. Handing your delivery details to the fulfilment partner and the warehouse is necessary to perform the contract of sale you concluded with us. Your parcel cannot be picked, packed or dispatched otherwise.
• Section 72(1)(c) — your consent, where you have given it for a transfer that is not covered by the grounds above.

8.2 Health information specifically. Consistent with the 2026 Regulations on the Processing of Health Information, we do not transfer prescription or licence documents abroad for fulfilment purposes at all. Those documents remain within our own systems and our document storage operator, and are not passed to the fulfilment partner, the warehouse or any courier.

8.3 What our fulfilment partner sends back. The flow of information to our fulfilment partner is deliberately one-directional. It returns to us only the approval decision, any rejection reason, the tracking number, the courier and the estimated delivery date. It does not return, and we do not receive, any other customer data from it.

9. Security Safeguards

Section 19 of POPIA requires us to secure the integrity and confidentiality of personal information by taking appropriate, reasonable technical and organisational measures. The measures we apply include:

• encrypted transmission (HTTPS/TLS) across the whole site, including checkout and document upload;
• encryption at rest for the store database;
• payment card data handled entirely within PayFast's environment, so that no card or bank account number ever enters our systems;
• passwords, session security and sign-in fraud detection managed by a specialist authentication provider using industry-standard hashing — we hold no password material;
• an administration console reachable only by authenticated staff holding an administrative role, with customer and order records closed to every other account;
• company registration and licence documents served from private storage behind an in-app viewer rather than as public files;
• authenticated, secret-keyed and origin-restricted callbacks between our systems and our fulfilment partner; and
• continual review of our safeguards against generally accepted information security practice.

No system is perfectly secure. You are responsible for keeping your sign-in credentials confidential and for telling us immediately if you believe your account has been accessed by someone else.

10. If Something Goes Wrong — Breach Notification

If we have reasonable grounds to believe that your personal information has been accessed or acquired by an unauthorised person, section 22 of POPIA requires us to notify the Information Regulator and to notify you, as soon as reasonably possible after discovering the compromise. We will notify the Regulator on its prescribed Security Compromise Notification Form.

Our notice to you will describe, as far as we know them, the nature of the compromise, the information involved, the measures we have taken or propose to take, what you can do to mitigate the effects, and the identity of the unauthorised person if we know it. We may delay notification only where a public body responsible for the prevention or investigation of offences tells us that notification would impede a criminal investigation.

11. Reviews and Publicly Visible Information

A product review you submit is published on the product page together with your display name, or — if you have not set a name — the part of your email address that precedes the @ sign, and a "verified purchase" marker where our records show you bought the product. Your full email address is never published.

Given the products we sell, a review may reveal something about your health to anyone who reads it. Please consider that before you submit one, and do not include information you would not want to be public. You may ask us to remove your review at any time by emailing the Information Officer. Nothing else you give us is published.

12. Direct Marketing and Electronic Communications

12.1 Transactional messages. Order confirmations, dispatch and tracking notices, RFQ acknowledgements, restock alerts you asked for, safety and recall notices, and replies to your enquiries are not marketing. We send them because you transacted with us or asked us to, and you cannot opt out of safety and recall notices for a product you have received.

12.2 Marketing to existing customers. Section 69(3) of POPIA permits us to market our own similar products to you using contact details you gave us in the course of a sale, provided you were given the opportunity to object when we collected them and on every message. Every marketing email carries an unsubscribe link.

12.3 Marketing to anyone else. If you are not an existing customer, we will only send you electronic direct marketing with your prior consent, requested on Form 4 of the POPIA Regulations. We will not ask you more than once.

12.4 Your further rights. Section 45 of the Electronic Communications and Transactions Act 25 of 2002 entitles you to ask the sender of any unsolicited commercial communication to identify the source of your details and to stop. Section 11 of the Consumer Protection Act 68 of 2008 gives you the right to demand that we stop, and to register a pre-emptive block on direct marketing. We honour all three.

13. How Long We Keep Your Information

Section 14 of POPIA requires us to delete or de-identify personal information once the purpose for which it was collected has been achieved, unless a law requires or authorises us to keep it. Some of our retention periods are set by regulation rather than by choice.

This is why we may not be able to erase everything on request. If you ask us to delete your information, we will delete what we are not required to keep, and restrict the rest to the statutory purpose alone. Records are destroyed in a manner that prevents their reconstruction once the period lapses.

14. Your Rights Under POPIA

You have the right to:

• Be told what we hold. Confirm, free of charge, whether we hold personal information about you, and request a record of it (section 23). A request for the record itself is dealt with under PAIA — see our PAIA Notice and PAIA Manual.
• Correct or delete. Require us to correct or delete information that is inaccurate, irrelevant, excessive, out of date, incomplete, misleading or obtained unlawfully, on Form 2 of the POPIA Regulations (section 24).
• Object. Object at any time, on reasonable grounds, to processing we carry out on the basis of legitimate interest, using Form 1 of the POPIA Regulations (section 11(3)).
• Withdraw consent where our processing relies on it, including consent to process your health information (section 11(2)). Withdrawal does not affect processing already carried out lawfully.
• Stop direct marketing at any time (section 69), as set out in clause 12.
• Not be subject to a decision based solely on automated processing that has legal consequences for you (section 71). We do not make such decisions — verification of a licence, approval of a credit account and review of an order are all decided by a person.
• Complain. Lodge a complaint with the Information Regulator on Form 5 of the POPIA Regulations, or institute civil proceedings (sections 74 and 99).

To exercise any of these, email the Information Officer at support@g1healthcare.co.za. We may ask you to verify your identity before we act, so that we do not disclose your information to somebody else. We respond within 30 days.

Information Regulator (South Africa)
JD House, 27 Stiemens Street, Braamfontein, Johannesburg, 2001
Complaints: complaints.IR@inforegulator.org.za
POPIA enquiries: POPIAComplaints@inforegulator.org.za
inforegulator.org.za

15. Accounts, Consent Records and Order Tracking

Placing an order requires an account. We do not offer guest checkout. This is not a marketing preference: the products we sell disclose a health condition, so we must be able to evidence that you consented to us processing that information, reach you if a device is recalled, honour a request to see or delete what we hold, and ask you again if our terms change. None of that is possible against an email address typed once at a checkout.

What we record when you accept. Each time you accept our policies — when you register, at checkout, when you answer the cookie banner, and when you consent to us handling a prescription — we store the date and time, which document and which version of it, the purpose you consented to, and the IP address and browser the acceptance came from. These records are kept as evidence that our processing was lawful, are never edited or deleted once written, and are retained for as long as the underlying record they justify. You may ask for a copy of yours at any time.

Order tracking. Our Track My Order page shows delivery progress only — status, tracking number, courier and dates. It deliberately does not show what you bought, what you paid, or where it is being delivered, because that page is answerable by anyone holding an order number and an email address. To see the order itself, sign in.

16. Children

Our store is intended for adults. We do not knowingly process the personal information of a child under 18 except with the consent of a competent person, as section 35 of POPIA requires. Where a parent or guardian purchases ostomy products for a child in their care, the parent or guardian is the contracting party and gives consent on the child's behalf. If you believe a child has given us information without that consent, contact the Information Officer and we will delete it.

17. Cookies and Local Storage

We use strictly necessary, functional, security and analytics cookies, and browser local storage to keep your cart between visits. Full detail, and how to control them, is in our Cookie Policy.

18. Changes to This Policy

We review this policy at least annually and whenever we add a new operator or a new use of personal information. The current version is always published here and the revision date appears at the top of this page. Where a change materially affects your rights, we will tell you directly before it takes effect.

19. Related Policies

Read this policy together with our Terms and Conditions of Sale, Website Terms of Use, Prescription & Licence Verification Policy, Cookie Policy, PAIA Manual and Product Safety, Adverse Event & Recall Policy. The full list is on our Legal & Policies page.

20. Contact the Information Officer

G 1 Healthcare (Pty) Ltd — Registration No. 2025/451756/07

Registered Office: 3 Inglenook Road, Riverside Lifestyle Estate, House 14, Nahoon Valley Park, Eastern Cape, 5202, South Africa

Email: support@g1healthcare.co.za

WhatsApp: +27 84 498 6840