Our POPIA Commitment

1. Our commitment

Blue White Medical (Pty) Ltd is committed to complying with the Protection of Personal Information Act 4 of 2013 ("POPIA") and other applicable South African privacy laws. We value the trust placed in us by website visitors, customers, healthcare professionals, suppliers, employees and business partners.

We take reasonable and appropriate steps to protect personal information throughout its lifecycle—from collection and use to storage, sharing, retention and secure disposal. We also review our practices as our business, technology and legal obligations change.

This page is a plain-language statement of our privacy commitment. It does not replace our Privacy Policy, which explains our processing activities in more detail.

2. What POPIA protects

POPIA regulates how personal information about identifiable people and, where applicable, identifiable existing organisations is processed. Processing includes collecting, recording, organising, storing, updating, using, sharing, restricting, deleting or destroying information.

Depending on your interaction with us, personal information may include your name, contact details, employer or organisation, job title, correspondence, quotation and order information, website activity, service or repair records, billing details and marketing preferences.

Blue White Medical is generally the responsible party when it determines why and how personal information is processed. A service provider processing information on our instructions may act as an operator.

3. The eight conditions

Our privacy programme is guided by POPIA's eight conditions for lawful processing:

4. How we apply POPIA

Our practical approach includes:

• collecting personal information for specific, lawful and business-related purposes;
• limiting access to staff and service providers who reasonably need it for their work;
• using information for enquiries, quotations, orders, repairs, deliveries, accounts, regulatory duties and related customer service;
• taking reasonable steps to keep information accurate, relevant and up to date;
• requiring appropriate confidentiality and security commitments from operators who process information for us;
• keeping information only as long as needed for its purpose, legal duties, quality records, dispute resolution or legitimate business records;
• deleting, destroying or de-identifying information securely when it is no longer lawfully required; and
• transferring information outside South Africa only where POPIA permits and appropriate safeguards or another lawful ground applies.

5. Sensitive information

Some information—such as health information, biometric information, religious or philosophical beliefs, race or ethnic origin, trade-union membership, political persuasion, sex life, criminal behaviour and certain information about children—receives additional protection under POPIA.

If special personal information is genuinely necessary for a lawful business purpose, we aim to process it only where POPIA authorises the processing and with safeguards appropriate to the risk.

6. Privacy governance

The company's Information Officer, together with any registered Deputy Information Officers and authorised staff, oversees the duties assigned under POPIA. Our public privacy contact coordinates enquiries and requests and helps route them to the appropriate person.

• We maintain privacy policies, procedures and appropriate records for relevant processing activities.
• Staff are expected to respect confidentiality and follow applicable privacy and information-security requirements.
• We assess suppliers that may handle personal information and seek appropriate contractual safeguards.
• We review privacy risks when introducing or materially changing systems, suppliers or processing activities.
• We investigate concerns, suspected misuse and security incidents and take reasonable corrective action.

7. Your privacy rights

Subject to POPIA, PAIA and any lawful limitations, you may have the right to:

• ask whether we hold personal information about you and request access to it;
• ask us to correct, update, delete or destroy information where the legal requirements are met;
• object, on reasonable grounds, to certain processing;
• object at any time to processing for direct marketing;
• withdraw consent where our processing relies on consent, without affecting earlier lawful processing;
• ask about third parties who have had access to your information where POPIA provides for this;
• not be subject to certain solely automated decisions that produce legal or substantial effects, except where POPIA permits them; and
• lodge a complaint with the Information Regulator or take other action available under law.

Rights are not always absolute. For example, we may need to keep certain records to meet a legal duty, perform a contract, protect another person's rights or establish or defend a legal claim.

8. How to make a request

Official objection, correction and deletion forms are available from the Information Regulator's POPIA forms page. Access to records may need to follow the process in our PAIA Manual.

9. Direct marketing and cookies

We aim to send electronic direct marketing only where POPIA permits it. Marketing messages should identify the sender and provide a reasonable, free way to unsubscribe. You may object to direct marketing at any time, and we will keep enough information to record and respect that choice.

Our website may use essential cookies and, where enabled, analytics or other optional technologies. We aim to provide appropriate information and choices for non-essential cookies. Please read our Cookie Policy for details and available controls.

10. Security safeguards

We use reasonable and appropriate technical and organisational measures designed to protect personal information against loss, damage, unauthorised destruction, unlawful access, interference, modification or disclosure. Depending on the risks involved, these measures may include access controls, authentication, backups, security monitoring, staff awareness, supplier controls and secure disposal.

No system is completely secure. If there are reasonable grounds to believe personal information has been accessed or acquired by an unauthorised person, we will investigate, contain the incident and notify the Information Regulator and affected data subjects as soon as reasonably possible where POPIA requires, subject to any lawful delay or direction.

Security compromises may be reported to the Information Regulator through its current eServices portal. If you suspect that information shared with Blue White Medical is at risk, please contact us promptly.

11. Ongoing improvement

Privacy compliance is an ongoing responsibility rather than a once-off exercise. We aim to review and improve our privacy practices as our products, services, website, suppliers, technology and legal obligations evolve.

This may include updating notices and consent wording, reviewing retention periods and access rights, improving staff awareness, assessing operator arrangements, testing safeguards and responding to new guidance from the Information Regulator.

We may update this page from time to time. The current version and effective date will be shown above.

12. Related legal documents

These documents work together. Please read the one most relevant to your interaction with Blue White Medical.

13. Contact Blue White Medical

For privacy questions, objections, access or correction requests, complaints or withdrawal of consent, contact:

14. Questions and complaints

Please contact us first if you have a privacy concern so that we can investigate and try to resolve it. You also have the right to lodge a complaint directly with the Information Regulator (South Africa).