Privacy Policy

1. INTRODUCTION

1.1 StrokePath is an online, subscription-based, self-guided information platform that makes available exercises, educational content, tools, guidance and recommendations to support persons who have experienced a stroke and those who care for them. StrokePath is owned and operated by StrokePath (Pty) Ltd, registration number 2026/623728/07 ("we", "us", "our" or the "Operator").

1.2 This Privacy Policy explains how we collect, process, share, store and protect your personal information in accordance with the Protection of Personal Information Act 4 of 2013 ("POPIA") and other applicable data-protection laws.

1.3 This Privacy Policy applies to all users of StrokePath, including Subscribers and any person whose personal information a Subscriber provides to us (for example, a person in the Subscriber's care).

1.4 We are the "responsible party" (also known as a data controller) that determines the purpose of and means for processing your personal information.

1.5 In this Privacy Policy: "personal information" means information relating to an identifiable, living, natural person and, where applicable, an identifiable, existing juristic person, as defined in POPIA; "special personal information" includes information concerning your health; "processing" means any operation performed on personal information; "operator" means a person who processes personal information on our behalf; and "de-identify" means to delete information that identifies a data subject or that can be used to re-identify them.

1.6 Where any conflict arises between this Privacy Policy and the Terms in relation to the processing of personal information, this Privacy Policy prevails to the extent of the inconsistency.

1.7 We may amend this Privacy Policy from time to time. Any changes will be published on the Platform and take effect on the date stated or, failing that, on publication. Please review it regularly. Your continued access to or use of StrokePath after any change constitutes your acceptance of the amended Privacy Policy.

2. THE PERSONAL INFORMATION WE COLLECT

2.1 Depending on how you use StrokePath, we may collect and process the following categories of personal information:

2.1.1 Identity information: such as your name, and where required, identity or passport number, date of birth and gender;

2.1.2 Contact information: such as your email address, mobile or telephone number and postal or physical address;

2.1.3 Account and profile information: such as your username, password (stored in encrypted form), subscription plan, settings and preferences;

2.1.4 Health information or biometric information (constituting special personal information): such as medical diagnosis including but not limited to stroke history, condition, symptoms, functional or mobility status, clinical notes, treatment plans, medical certificates, medical aid details, and physiological measurements (such as weight, height, or heart rate data captured by medical devices or wearable tech), medication, and any progress notes, assessments, goals, exercise activity, blood typing, fingerprinting, retinal scanning, facial recognition, and voice recognition or any other health-related or biometric information that you (or a person in your care) freely and voluntarily choose to enter into StrokePath's tools, trackers or features and which you have consented to being processed;

2.1.5 Information about persons in your care: where you use StrokePath as a caregiver, parent, guardian or lawful representative, the personal and health information of the person you support;

2.1.6 Payment and financial information: billing details and a record of your payments. We do not receive or store your full card details; these are collected and processed by our Payment Provider (see clause 6.3 of the Terms);

2.1.7 Transaction information: your subscription and payment history, sponsored-pass applications and related financial records;

2.1.8 Usage and technical information : such as your device, IP address, browser type, operating system, log data, and information about how you interact with the Platform, collected in part through cookies (see clause 11);

2.1.9 Communications: support queries, correspondence, feedback and survey responses; and

2.1.10 Marketing information: your marketing preferences and consents.

3. HOW WE COLLECT PERSONAL INFORMATION

3.1 We collect personal information:

3.1.1 directly from you: when you register, subscribe, complete forms, use the Platform's features and tools, apply for a sponsored pass, or contact us;

3.1.2 automatically: through cookies and similar technologies and through your use of the Platform;

3.1.3 from third parties: such as our Payment Provider and other service providers acting on our behalf; and

3.1.4 from a Subscriber: where a Subscriber provides us with information about a person in their care.

3.2 Where you provide us with personal information about another person (including a minor or a person who lacks capacity), you warrant that you are authorised to do so, that you have obtained their informed consent, or that you are their parent, guardian or lawful representative, and that you have made them aware of this Privacy Policy.

4. HEALTH INFORMATION (SPECIAL PERSONAL INFORMATION)

4.1 Because StrokePath relates to stroke recovery, some of the information you provide is information concerning health, which POPIA classifies as "special personal information" and which receives heightened protection.

4.2 We process your health information primarily on the basis of your explicit consent, or where the processing is otherwise permitted by POPIA. By choosing to provide health information (whether about yourself or a person in your care) and to use the features that record or rely on it, you give your explicit consent to our processing of that information for the purposes set out in this Privacy Policy.

4.3 You may withdraw your consent at any time by contacting our Information Officer. Withdrawal will not affect the lawfulness of processing carried out before withdrawal, but it may mean that we can no longer provide you with certain features or all of StrokePath's services. Should you withdraw your consent, your withdrawal will be dealt with in accordance with clause 6, 7 and 12 of the Terms.

4.4 StrokePath is not a healthcare provider and does not provide medical advice, diagnosis or treatment. We process health information only to operate the Platform and provide the self-guided information service described in the Terms, and not to provide medical care.

4.5 We apply enhanced technical and organisational security measures to health information, and we comply with any applicable regulations, codes of conduct or guidance issued under POPIA that govern the processing of health information.

5. WHY WE PROCESS YOUR PERSONAL INFORMATION

5.1 We process your personal information for the following purposes, to the extent relevant to your use of StrokePath:

5.1.1 to create, administer and secure your account and verify your identity;

5.1.2 to provide the education hub, the paid features, and the exercises, tools, guidance and recommendations available through StrokePath, and to personalise the content and experience for you or the person in your care;

5.1.3 to process your subscription, payments and any sponsored-pass application (through our Payment Provider);

5.1.4 to communicate with you, including sending service, transactional and administrative messages about your account, subscription and the Platform;

5.1.5 to send you direct marketing where you have consented or where the law otherwise permits it, subject to your right to opt out (see clause 8);

5.1.6 to respond to your queries, provide support and handle complaints;

5.1.7 to monitor, improve, develop and secure the Platform and our content, and to conduct research, analytics and statistical analysis (using de-identified or aggregated information wherever practicable);

5.1.8 to detect, prevent and address fraud, security incidents, misuse and other unlawful activity;

5.1.9 to comply with our legal, regulatory and tax obligations; and

5.1.10 to establish, exercise or defend legal claims and to protect our rights, property or safety and those of our users or others.

5.2 We will generally use your personal information only for the purpose for which it was collected, or for a secondary purpose that is compatible with that purpose or otherwise permitted by law.

6. OUR LEGAL BASIS FOR PROCESSING

6.1 When we process your personal information, we rely on one or more of the following bases under POPIA, depending on the purpose:

6.1.1 your consent (including your explicit consent for the processing of health information);

6.1.2 that the processing is necessary to conclude or perform the contract between you and us (the Terms);

6.1.3 that the processing is necessary to comply with a legal obligation;

6.1.4 that the processing protects your legitimate interests or those of another person; and

6.1.5 that the processing is necessary for the pursuit of our legitimate interests or those of a third party to whom the information is supplied, balanced against your rights.

7. PERSONS IN YOUR CARE AND CHILDREN

7.1 Subscribers must be at least 18 (eighteen) years of age, as set out in the Terms.

7.2 We do not knowingly collect or process the personal information of a child without the consent of a competent person (as defined in POPIA), or unless we can rely on another lawful basis. Where you provide a child's personal information (for example, as a parent or guardian of a person in your care), you warrant that you are competent and authorised to consent to its processing.

7.3 If you believe we have collected a child's personal information without appropriate authorisation, please contact our Information Officer and we will take appropriate steps.

8. DIRECT MARKETING

8.1 We will only send you electronic direct marketing (for example about new features, offers or content) where you have consented to receive it, or where the law otherwise permits us to market similar offerings to you as an existing customer, in each case in accordance with POPIA and the Consumer Protection Act 68 of 2008.

8.2 You may opt out of direct marketing at any time by using the "unsubscribe" link in any marketing email, replying "STOP" to a marketing message, adjusting your preferences in your account settings, or contacting us at support@mystrokepath.com.

8.3 If you opt out of direct marketing, we may still send you service, transactional and administrative communications that are necessary for your use of StrokePath.

9. SHARING AND DISCLOSURE OF PERSONAL INFORMATION

9.1 We do not sell your personal information. We may share it with the following categories of recipient, only as necessary and subject to appropriate safeguards:

9.1.1 Payment Providers: Paystack South Africa Proprietary Limited and any other payment service provider we appoint, together with their subcontractors, to process your payments through their secure, PCI-DSS compliant systems;

9.1.2 hosting and cloud-storage providers: to host the Platform and store data securely;

9.1.3 IT, analytics, communications and support providers: who help us operate, secure, analyse and improve the Platform and communicate with you;

9.1.4 healthcare professionals in the neurorehabilitation practice area: who review the Content (this review relates to the Content generally and not to any individual Subscriber's case);

9.1.5 professional advisers: such as our legal, accounting and audit advisers;

9.1.6 authorities and regulators: where we are required or permitted by law, or to establish, exercise or defend legal claims; and

9.1.7 a successor: in connection with a merger, acquisition, reorganisation or sale of all or part of our business, subject to this Privacy Policy.

9.2 Where a third party processes personal information on our behalf, it does so as our "operator" under a written agreement that requires it to process the information only on our instructions, to keep it confidential, and to maintain appropriate security measures and notify us of any security compromise.

9.3 Where a recipient processes your personal information as a responsible party in its own right (for example, a Payment Provider in respect of its own services), its own privacy policy will govern that processing.

10. INTERNATIONAL TRANSFERS OF PERSONAL INFORMATION

10.1 No special personal information is stored outside of the Republic of South Africa.

10.2 Some of our service providers, or the servers on which your personal information is stored or processed (including for payment processing), may be located outside South Africa. Where this occurs, your personal information may be transferred to, and processed in, jurisdictions outside South Africa.

10.3 We will transfer your personal information outside South Africa only where a condition in section 72 of POPIA is met. For example, where the recipient is subject to a law, binding corporate rules or binding agreement providing an adequate level of protection; where you consent; where the transfer is necessary to perform the contract with you; or where the transfer is for your benefit and it is not reasonably practicable to obtain your consent.

11. COOKIES AND SIMILAR TECHNOLOGIES

11.1 We use cookies and similar technologies to enable the Platform to function, to remember your preferences, to keep you signed in, to measure and analyse usage, and to improve and secure the Platform.

11.2 These may include strictly necessary cookies (required for the Platform to work), performance and analytics cookies, and functional cookies. Some may be set by our third-party service providers.

11.3 You can control or disable cookies through your browser settings and, where offered, through our cookie preferences tool. If you disable certain cookies, some features of the Platform may not function properly.

12. AUTOMATED DECISION-MAKING

12.1 We do not make decisions that have legal consequences for you, or that affect you to a substantial degree, based solely on the automated processing of your personal information, except where this is permitted by law (for example, automated fraud or payment screening carried out by our Payment Provider) or where you have consented. Where such processing occurs, you have the rights afforded by section 71 of POPIA.

13. DATA SECURITY

13.1 We take appropriate, reasonable technical and organisational measures to secure the integrity and confidentiality of personal information in our possession or under our control, and to protect it against loss, damage, unauthorised access and unlawful processing. These measures may include encryption in transit and at rest, access controls, and periodic assessment of our safeguards.

13.2 Payment information is handled by our Payment Provider through its secure, PCI-DSS compliant systems, and we do not receive or store your full card details.

13.3 No method of transmission over, or storage on, the internet is completely secure. While we take reasonable steps to protect your personal information, we cannot guarantee its absolute security, and you are responsible for keeping your account credentials confidential.

13.4 If we have reasonable grounds to believe that your personal information has been accessed or acquired by an unauthorised person, we will notify you and the Information Regulator as required by section 22 of POPIA.

14. DATA RETENTION

14.1 We retain your personal information only for as long as is reasonably necessary to fulfil the purposes for which it was collected, unless a longer retention period is required or permitted by law, or is necessary for a legitimate purpose (such as the prospect of litigation), or you have consented to longer retention.

14.2 When we no longer require your personal information, we will securely delete, destroy or de-identify it.

14.3 De-identified and aggregated information, which can no longer be linked to you and to which POPIA no longer applies, may be retained and used indefinitely for research, analytics and improvement of the Platform and our content.

15. YOUR OBLIGATION TO KEEP INFORMATION ACCURATE

15.1 The personal information you provide to us should be accurate, complete and up to date at all times. If it changes or becomes inaccurate, it is your responsibility to update it in your account or to notify us promptly.

15.2 To the maximum extent permitted by law, we will not be liable for any loss or damage arising from your failure to keep your personal information accurate and up to date.

16. YOUR RIGHTS UNDER POPIA

16.1 Subject to POPIA, you have the right:

16.1.1 to be notified that we are collecting your personal information, and where it has been accessed or acquired by an unauthorised person;

16.1.2 to request confirmation of whether we hold your personal information, and to request access to it;

16.1.3 to request that we correct, update, destroy or delete your personal information;

16.1.4 to object, on reasonable grounds, to the processing of your personal information;

16.1.5 to object to the processing of your personal information for direct marketing;

16.1.6 to withdraw your consent where we rely on consent (including for health information);

16.1.7 not to be subject, in certain circumstances, to a decision based solely on automated processing;

16.1.8 to submit a complaint to the Information Regulator; and

16.1.9 to institute civil proceedings regarding an alleged interference with the protection of your personal information.

16.2 To exercise any of these rights, please contact our Information Officer using the details in clause 19. We may need to verify your identity before acting on your request. Requests for access to information may be made in accordance with our PAIA manual and, where applicable, may be subject to the prescribed fee.

16.3 If you object to, or withdraw your consent to, our processing of certain personal information, or ask us to delete it, we may be unable to continue providing some or all of the features of StrokePath to you. Should you withdraw your consent, your withdrawal will be dealt with in accordance with clause 6, 7 and 12 of the Terms.

17. COMPLAINTS

17.1 If you have a concern or complaint about how we process your personal information, please contact our Information Officer first, using the details in clause 19, so that we can try to resolve it.

17.2 If you are not satisfied, you may lodge a complaint with the Information Regulator, using the details in clause 19.

18. CHANGES TO THIS PRIVACY POLICY

18.1 We may update this Privacy Policy from time to time to reflect changes in our practices, technology, or legal or regulatory requirements. The current version will always be available on the Platform, and material changes will be notified to you where the law requires. Please review it periodically.

19. CONTACT US AND THE INFORMATION REGULATOR

19.1 If you have any questions about this Privacy Policy or wish to exercise your rights, please contact our Information Officer:

19.1.1 Operator: StrokePath (Pty) Ltd (StrokePath Proprietary Limited), registration number 2026/623728/07

19.1.2 Information Officer: Ms Denisha Vassan

19.1.3 Email: compliance@mystrokepath.com

19.2 You also have the right to lodge a complaint with the Information Regulator (South Africa):

19.2.1 Website: www.inforegulator.org.za

19.2.2 Physical address: Woodmead North Office Park, 54 Maxwell Drive, Woodmead, Johannesburg, 2191

19.2.3 Postal address: P.O. Box 31533, Braamfontein, Johannesburg, 2017

19.2.4 Telephone: 010 023 5200 or Toll free: 0800 017 160

19.2.5 General enquiries: enquiries@inforegulator.org.za

19.2.6 POPIA complaints: complaints.IR@justice.gov.za