Privacy notice

Protection of Personal Information Act 4 of 2013 (POPIA). Version 1.0, effective 23 October 2026.

> DRAFT for publication on 23 October 2026. Items marked [VERIFY] must be settled before publication.

1. Who we are

Hazchem On The Go is a medical courier. We collect and deliver laboratory specimens, chronic medication parcels and other medical consignments for clinics, laboratories, pharmacies and employers. Therapy On The Go (Pty) Ltd, registration number 2022/668078/07, trading as Hazchem On The Go. ICASA Unreserved Postal Service Certificate 0332/UPS/SEP/2025 ("we", "us") is the responsible party for the personal information described in this notice, collected through https://haz-chem.co.za, our forms, our systems and our services.

• Information Officer: Tshepo Mokitimi, Chief Executive Officer [VERIFY: Information Officer registration on the Information Regulator eServices portal]
• Contact: info@haz-chem.co.za (subject line "POPIA"), telephone +27 66 248 6595
• Address: [VERIFY: an address for service must be published here (POPIA s18(1)(b)). Recommended: a PO Box or the CIPC registered office, so that no operating street address is published (group rule of 8 Oct 2026).]

2. What we collect

• Customers and quote requests: name, company, email address, phone number, collection and delivery addresses, and consignment details.
• Recipients of parcels: name, mobile number, delivery address, and proof of delivery (signature, time, GPS location and a photo of the hand-over). For chronic medication we may check your ID and a one-time PIN before hand-over.
• Health information (special personal information): a parcel label, manifest or collection point can show that a person receives chronic medication or has had a specimen taken. We treat this as health information. We do not open parcels, and we do not see test results or prescriptions.
• Drivers and staff: identity, licence and PrDP details, training records and vehicle tracking data while on duty.

We collect information directly from you, from your employer or the organisation that booked a service for you, and from the practitioners who treat you. We collect only what we need for the purpose (s10).

3. Why we use it and our lawful basis

• To collect, track and deliver consignments and prove delivery (s11(1)(b); health information under s32(1)(a) as a service provider to healthcare institutions, which are responsible for the underlying health record).
• To comply with postal, road traffic and transport-of-specimen rules (s11(1)(c)).
• To invoice customers and keep accounting records (s11(1)(b) and (c)).
• To keep drivers, parcels and vehicles safe through tracking (s11(1)(f), legitimate interest).
• To answer quote requests. We send marketing only if you opted in (s69).

When we deliver for a clinic, laboratory, pharmacy or programme (for example a chronic medication programme), that organisation is the responsible party for your health record. We act as its operator under a written agreement and use your details only to make the delivery.

4. Who we share it with (operators and third parties)

• Vehicle tracking and telematics provider: location of vehicles while on duty.
• Healthcare App (Pty) Ltd (a group company): dispatch, manifest and proof-of-delivery software, hosted on Amazon Web Services in Cape Town, South Africa.
• Microsoft 365: email and documents.
• Lovable (website hosting) for this website.
• Our professional advisers and authorities (for example ICASA or SARS), where the law requires it.

Every operator processes information only on our instructions, under a written agreement that requires it to keep the information secure and confidential (s20 and s21). We do not sell personal information.

5. Transfers outside South Africa

This website is hosted outside South Africa. Contact form details may therefore pass through servers in the European Union or the United States. We rely on POPIA s72(1)(a) and (b). Delivery and proof-of-delivery records are hosted in South Africa.

6. How long we keep it

• Manifests, chain-of-custody and proof-of-delivery records: 5 years after delivery, or longer if a customer contract or law requires it.
• Vehicle tracking data: 12 months, unless needed for an incident or claim.
• Quote requests that did not lead to a service: 12 months.
• Invoices and accounting records: 5 years.

When the retention period ends, we delete or de-identify the information, unless a law, a court order or a pending claim requires us to keep it longer (s14).

7. How we protect it

Encrypted connections (HTTPS); encryption of databases and backups at rest; multi-factor sign-in for staff; access limited to the people who need it for their role; audit logs of access to health records; secrets kept in a password vault; and encrypted, access-controlled backups. If we believe a security compromise has affected your information, we will tell you and the Information Regulator as soon as reasonably possible (s22).

8. Automated decisions

Routing software plans routes. No decision with legal effect about you is made solely by a computer.

9. Children

We deliver to adults. Where a parcel is for a child, we hand it to a parent, guardian or authorised adult.

10. Your rights

• Ask whether we hold personal information about you and receive a copy of it (POPIA s23; PAIA).
• Ask us to correct or delete information that is inaccurate, irrelevant, excessive, out of date, incomplete, misleading or unlawfully obtained (s24).
• Object to processing that relies on our legitimate interest or on yours (s11(3)), and object to direct marketing at any time (s11(3)(b)).
• Withdraw your consent at any time. This does not affect processing that already happened, or processing that the law requires (s11(2)(b)).
• Not be subject to a decision based solely on automated processing that has legal or similarly significant effects (s71).
• Complain to the Information Regulator (details below).

To use any of these rights, email info@haz-chem.co.za with the subject "POPIA request". We may ask you to prove your identity first. We respond within 30 days. Access requests are free for your own information. For copies of records under the Promotion of Access to Information Act, see our PAIA manual [VERIFY: link to the PAIA manual once it is published].

11. Cookies and similar technology

This website uses only the storage it needs to work, for example to keep you signed in. Where the hosting platform counts visits, it does so without advertising cookies or cross-site tracking. We do not use advertising or social-media tracking cookies.

12. Complaints

Please contact our Information Officer first, so that we can put things right. You may also complain to the Information Regulator (South Africa), JD House, 27 Stiemens Street, Braamfontein, Johannesburg, 2001. Website https://inforegulator.org.za. Complaints: POPIAComplaints@inforegulator.org.za. General enquiries: enquiries@inforegulator.org.za.

13. Changes to this notice

We will publish any change on this page with a new version number and effective date. If a change materially affects how we use your health information, we will tell you before it takes effect.

Group: Hazchem On The Go is part of the House of Experts group. Notice version 1.0, effective 23 October 2026.