1 – INTRODUCTION

1. This privacy policy (Privacy Policy) applies to all persons using the online mobile application and/or website located at www.elevate.co.za (collectively, the Portal). The Portal is owned and operated by Elevate Proprietary Limited (Registration Number: 2017/452357/07) (Elevate).
2. By installing, downloading and/or accessing the Portal, the person that accesses the Portal (User) accepts and agrees to this Privacy Policy and expressly consents to the use and disclosure of their personal information in accordance with the provisions of this Privacy Policy. If the User does not agree to the provisions of this Privacy Policy, the User may not access or use the Portal.
3. Elevate reserves the right to amend this Privacy Policy or add provisions to it at any time. By continuing to access and/or use this Portal, the User agrees to the amended versions of the Private Policy.
4. This Privacy Policy shall be governed and interpreted in accordance with the laws of the Republic of South Africa.

2 – INFORMATION COLLECTED

If the User registers with the Portal, Elevate will collect, analyse, present and use the User’s personal information. This personal information may include, without limitation, the User’s name, identity or passport number, gender, age and language preference, date of birth and contact details, previous and ongoing health data from a Participating Medical Scheme, health data from wearable devices and details of the User’s visits to the Portal.

The supply of personal information by the User to Elevate is voluntary and not mandatory. However, if the User refuses to supply any personal information, certain consequences may naturally flow from such a refusal, such as preventing Elevate from concluding or performing any contract with the User, or preventing Elevate from complying with one or more of its obligations in law.

– PURPOSE FOR WHICH PERSONAL INFORMATION IS USED

The purposes for which Elevate uses personal information includes, but is not limited to:

1. recommending and providing services to the User;
2. entering into a contract with a User and/or to enable a partner to contact the User and enter into a contract with the User;
3. perform any obligations under a contract with the User;
4. complying with legal obligations;
5. protecting a legitimate interest of a User (unless the User has specifically objected in writing to all or some of the processing activities on reasonable grounds);
6. pursuing its own legitimate interests or the legitimate interests of a third party who it is sharing the information with (unless the User has specifically objected in writing to all or some of the processing activities on reasonable grounds);
7. providing tips and goals to Users for improving healthy behaviour;
8. customising and displaying content including, but not limited to products, articles, listings and advertisement to the User in a way that Elevate feels may interest the User or be most beneficial to them;
9. to send content including, but not limited to products, articles, listings and advertisement content to the User via email or other electronic media, where the User has consented to be contacted by Elevate with such content;
10. facilitating the User’s transactions on the Portal;
11. communicating with the User for Elevate’s internal purposes; and
12. research and marketing conducted by Elevate.

If Elevate intends to process a User’s personal information for any other purpose not listed above or which is otherwise not automatically permitted by law, it shall ensure that it obtains the User’s written consent to do so.

Elevate will not sell a User’s personal information to any third party without the prior written consent of the User.

4 – COLLECTION DIRECTLY FROM THE USER

Elevate shall, as far as possible, always collect personal information about a User directly from the User, except in the following circumstances:

1. where personal information is collected from a public record, or from another source if the information has already been made public by the User;
2. where the User has given their written consent to Elevate to collect their information from another source;
3. where the collection of a User’s personal information from another source will not prejudice any of the User’s legitimate interests;
4. where the collection of personal information from another source is necessary to maintain Elevate’s legitimate interests or those of any third party it intends sharing the information with;
5. where the collection of personal information directly from the User would prejudice the purpose for the collection; and/or
6. where the collection of personal information directly from the User is not reasonably practicable in the circumstances.

If Elevate collects personal information from a source other than the User, it shall record in writing the details of that source, including the full names and contact details of that source where applicable.

The User hereby consents to Elevate requesting and obtaining credit information pertaining to the User from any reputable credit reporting agency or institution for the purpose of concluding any transaction for services to the User on this Portal.

Personal information may be collected from or supplied by the User in any of the following ways:

1. when subscribing to a service;
2. when requesting further services or information from Elevate
3. when contacting Elevate to report a problem with the Portal or the services or for any other reason; and/or
4. when completing any forms on the Portal or the websites of the third parties appointed to process such information.

The User may visit the Portal without providing any personal information. However, the Portal’s servers may still collect technical information regarding the use of the Portal, which is aggregated for analytical purposes, technical maintenance and for improving the content offered on the Portal. Such information may include details of the User’s visit, information about the User’s computer, including IP (Internet Protocol) address, operating system and browser type, the User’s location, and usage information. An individual User will not be identified from or by this information and Elevate is entitled to copy, distribute or otherwise use such information without limitation.

5 – RELEASE OF PERSONAL INFORMATION

Elevate may release the User’s personal information or disclose it to third parties in certain circumstances, including, but not limited to the follow:

1. if Elevate is required to do so by law or a court order;
2. in order for Elevate to enforce its rights;
3. in order for Elevate to provide services to the User.

In addition to the above, Elevate may share the personal information of a User with its partners to enable the partner to contact the User and, if applicable, to conclude a transaction between the partner and the User.

Elevate may, in the course of providing any content or services on this website, or for the purposes of concluding or performing any other services or transaction with a User, share certain personal information with third party operators who perform certain processing activities on behalf of Elevate.

The User will always be notified of the information shared and the categories of third party operators with whom it is shared, prior to such information being shared.

Elevate may also share aggregated information about Users and their usage patterns. Elevate may also use such aggregated information to help advertisers target specific audiences. Such aggregated information will be de-identified and the User’s personal information will not be disclosed.

Other than as stated above, Elevate shall not share a User’s personal information with any third parties unless it has the User’s express consent to do so.

6 – USER’S RIGHTS IN RELATION TO THE PROCESSIN G OF THEIR PERSONAL INFORMATION

Users shall have the following rights in relation to the processing of their personal information:

1. to access and correct any personal information held by Elevate about them;
2. to object to the processing of their information; and
3. to lodge a complaint with the Information Regulator.

Users may make a request to access of correct any personal information held by Elevate about them by sending an email to info@elevate.co.za.

7 – FURTHER PROCESSING

Elevate shall not process a User’s personal information for any purpose not previously specified, except in the following circumstances:

1. where the User has consented to such further processing;
2. where the further processing is necessary for the exercise of any contractual rights or the fulfillment of any obligations between Elevate and the User;
3. where the further processing activities are linked to or compatible with the original purpose;
4. where the further processing is necessary for the prevention, detection, investigation, prosecution and punishment of an offence;
5. where the further processing is necessary to enforce any law;
6. where the further processing is necessary for the conduct of legal proceedings in any court or tribunal that have commenced or are reasonably contemplated;
7. where the further processing is necessary to prevent or mitigate a serious and imminent threat to the life or health of the User or another individual; and/or
8. where the further processing is necessary for historical, statistical or research purposes.

Elevate shall ensure that if it intends processing personal information for other purposes not previously specified, it shall notify the User of such further purposes and the possible consequences of the intended further processing for the User.

8 – ACCURACY, CORRECTNESS AND COMPLETENESS OF PERSONAL INFORMATION

Elevate shall take reasonably practicable steps to ensure that the personal information kept by it about Users is complete, accurate, not misleading and is updated when necessary.

However, if a User is aware of any personal information in Elevate’s custody that is incorrect, inaccurate or which needs to be updated, the User must make a written request to Elevate’s information officer at info@elevate.co.za. to update or correct the relevant information.

If a User has contested the accuracy of any personal information being used by Elevate, it shall immediately stop using that information until its accuracy has been verified.

Elevate reserves its right to only adhere to a request from a User to update his/her/its personal information, if the correction or updating of that information will result in the personal information being correct and accurate.

Where personal information that has been shared by Elevate with a third party is subsequently updated or corrected, Elevate shall ensure that all third parties, with whom that information was shared, receives the updated and/or corrected version of the information as soon as it has been updated and/or corrected.

9 – SECURITY SAFEGUARDS

Elevate is committed to protecting the personal information in its custody against any loss of, damage to or unauthorised destruction of that information, and to prevent any unauthorised parties from accessing that information.

Elevate takes steps to continually identify and document any risks to the personal information it has in its possession or under its control and that appropriate security safeguards are in place against those risks.

Elevate shall ensure that in any contracts entered into with third party operators who process personal information on Elevate’s behalf, include the following obligations:

1. the operator shall not process any personal information without Elevate’s knowledge and authority;
2. the operator shall treat all personal information given to it as confidential and shall not disclose it to any unauthorised third parties;
3. the operator shall establish and maintain adequate security measures which are the same or offer similar protection over the personal information as that employed by Elevate;
4. the operator shall notify Elevate immediately where there are reasonable grounds to believe that any personal information has been leaked to or accessed by any unauthorised person;
5. if the operator is situated in another country, it must comply with the data protection laws in that country and be able to provide verification that it is so compliant; and
6. if an operator is legally obliged to disclose any personal information processed by them on Elevate’s behalf to other parties, it must notify Elevate beforehand to enable Elevate and/or individual Users to protect their rights if necessary.

Elevate shall ensure that all personal information on its systems is properly backed-up and that back-up copies are stored separately from the live files.

10 – NOTIFICATION OF BREACH OF SECURITY

If personal information about a User is inadvertently leaked or Elevate’s security has been unlawfully breached by any unauthorised party, Elevate shall immediately identify the relevant Users who may be affected by the security breach, and shall contact them at their last known email address or contact details or by the quickest means possible.

Elevate shall provide sufficient information to the User to allow him/her/it to take the necessary protective measures against the potential consequences of the compromise, or shall advise Users of the steps to be taken by them and the possible consequences that may ensue from the breach for them.

11 – DECISIONS BASED ON PERSONAL INFORMATION PROCESSED

If Elevate is required to make a decision about a User using any personal information that has been obtained, it shall ensure that a record of such information and the decision made is kept for a reasonable period of time to give the User an opportunity to request access to that record.

Elevate shall allow a User a reasonable opportunity to make representations before any decision is made solely on the basis of the personal information processed, if that decision will affect the legal position of the User, or will otherwise adversely affect them in some manner or form.

Elevate shall always ensure that the underlying logic behind any decision made pursuant to the automated processing of personal information is sound and that this underlying logic can be communicated to the User to enable them to make representations.

If Elevate has made a decision based on incorrect personal information, it shall immediately revisit that decision as soon as it becomes aware of the error or inaccuracy of that information.

12 – LINKED THIRD PARTY WEBSITES

The Portal may contain links or references to other websites, including those of its data processors or advertisers (“third party websites”) which are not under Elevate’s control.

The provisions of this Privacy Policy are not applicable to third party websites and Elevate shall not responsible for the information processing practices and/or privacy policies of those third party websites, or the cookies that those websites may use.

13 – MARKETING AND PROMOTIONAL MATERIAL

1. Elevate may from time to time send marketing and promotional material to the User. By registering on the Portal, the User consents to Elevate sending such material to the User.
2. The User may unsubscribe from receiving further marketing and promotional material. If the User wishes to do so, the User can follow the “unsubscribe” link in the material or send an email to Elevate.

 14 – CHILDREN’S PERSONAL INFORMATION

Elevate shall not process any personal information relating to a person under the age of 18 years unless it has obtained consent from that person’s parent or legal guardian. If the Portal is being accessed by the parent or guardian of a child under the age of 18 years, and personal information pertaining to that child is being provided by the parent or guardian, then they hereby expressly consent to Elevate processing such information according to the further provisions of this Privacy Policy.

15 – TRANSFER OF PERSONAL INFORMATION

Personal information collected by Elevate may from time to time be transferred to a Participating Medical Scheme or other third parties and the User consents to such transfer. Elevate will take reasonable steps to ensure that such persons have appropriate privacy measures in place.

16 – CROSS BORDER TRANSFERS OF PERSONAL INFORMATION

Elevate may transfer personal information to another country in the following circumstances:

1. the transfer is necessary for the performance of a contract that Elevate has with the User;
2. the transfer is necessary for the conclusion or performance of a contract with a third party which is for the benefit of or in the interest of the User;
3. the transfer is otherwise for the benefit of the User; or
4. the User has consented to the transfer of their information.

If Elevate is required to transfer personal information from South Africa to a third party in a foreign country, it shall ensure that the third party is subject to a law, binding code of conduct or contract which effectively upholds principles for the reasonable processing of personal information which are substantially similar to the data protection offered in the Republic of South Africa.

17 – RETENTION OF PERSONAL INFORMATION

Elevate will keep a record of any personal information collected for no longer than is necessary to achieve the specific purpose for which it collected such information in the first place unless:

1. it is required by law to keep a record of such information for a longer period of time; or
2. it needs to keep a record of such information for another lawful purpose; or
3. it has a contractual obligation to keep a record of such information; or
4. the User has consented to their information being kept for a longer period.

Elevate may, if it has de-identified personal information, keep such information for historical, statistical or research purposes. Elevate shall ensure that appropriate safeguards are in place to prevent those records from being used for any other purposes, or against the information being re-identified.

18 – RETURNING, DESTROYING OR DELETING PERSONAL INFORMATION

Where Elevate is no longer authorised to retain a record of any personal information, it shall either:

1. ensure that the information is permanently destroyed or deleted as soon as reasonably practicable; or
2. return the information to the User or transfer it to a third party, if requested by the User in writing to do so.

19 – COOKIES

1. The Portal makes use of cookies. Cookies store information regarding Users. Cookies have various purposes, such as improving the User’s experience on the Portal and to facilitate the User’s use of the Portal.
2. Users may disable or decline cookies. However, if the User does so, the User might not be able to use the Portal properly and certain aspects of the Portal might not function.

20 – LODGING AN OBJECTION

A User may, on reasonable grounds, object to the processing of their personal information at any time after that processing has started.

If a User wishes to object to the processing of their personal information, they must send written notice of their objection to Elevate’s information officer, together with their reasons for doing so.

21 – REVOCATION OF CONSENT

Users may at any time revoke their consent to Elevate’s use of their personal data by disabling data sources independently on the Elevate Portal. Upon revocation, the User’s account will still be registered, but the User’s personal data with respect to such specific data source will not be utilised from the date of such revocation.

22 – CONTACT

For more information on User’s rights to privacy over their information, or the information processing activities of Elevate please do not hesitate to contact us directly on info@elevate.co.za.