Effective Date: 30 October 2026

The Vula Platform is a tool which allows our clients, being healthcare professionals, to share patient information with other clients, medical and surgical specialists, in order to obtain expert advice and expedite referrals. To provide this service, the information of the patient needs to be entered into the Vula Platform by the healthcare professional (or approved administrative associate), on a case by case basis, and shared with the selected specialist(s). We act as an Operator, as the term is defined in POPIA, and process patient Personal Information and Special Personal Information on behalf of our clients, in accordance with our agreement with them, when they use the Vula Medical Referral and Chat Platform. The Patient Privacy Notice pertains to our role as an Operator who collects, processes, stores and shares patient Personal Information and Special Personal Information in the provision of this service to Health Practitioners.

Patient privacy notice

The Vula Medical App (the “App”), the Vula Online Web Portal and the Vula Medical Website (together, the “Vula Platform” or “Platform”), established by Vula Medical (Pty) Ltd trading as Vula Medical (“Vula”) is used by a Doctor or other Healthcare Worker (“Health Practitioner”) to transfer patient information and details of the patient’s condition (the “Information”) to a medical specialist selected by the Health Practitioner because of his/her expertise (“the Specialist”). The Specialist is also a user / client of our App.

Reference in this policy to “Vula”, “we”, “us”, “our” or any similar term may be construed as reference to Vula Medical.

This Patient Privacy Notice pertains to our role as an Operator who collects, processes, stores and shares patient Personal Information and Special Personal Information in the provision of this service to Health Practitioners.

This Patient Privacy Notice provides information on:

• Expectations of the Health Practitioner

• Children

• Patient Information Collected

• Processing of Patient Information

• Your Choice: De-identification for Research and Data Partnerships

• Sharing of Information

• Patient Privacy and Confidentiality

• Information Security

• Transborder Flow of Information

• Retention of Patient Information

• Electronic Communications

• Data Breaches

• Revisions to this Notice

• Privacy Queries

• Information Officer

THE ROLES IN YOUR HEALTHCARE

It is important to understand the distinct legal and operational roles performed by your Health Practitioner and by Vula Medical in relation to the collection, use, and disclosure of your Personal Information and Sensitive Information:

• Your Health Practitioner: Your Health Practitioner (for example, your general practitioner, nurse, or other treating clinician) is your primary care provider and is exclusively responsible for:

◦ the clinical assessment, diagnosis, and treatment of your condition;

◦ determining the necessity and appropriateness of a referral or consultation with another healthcare provider;

◦ deciding on and collecting your health information in accordance with clinical and legal requirements;

◦ obtaining your informed consent to collect, use, and disclose your health information, including your consent to use the Vula Medical App for referral and care-coordination purposes and obtaining, on Vula’s behalf, your consent to the de-identification of your information as described under ‘Your Choice: De-identification for Research and Data Partnerships’; and

◦ ensuring compliance with all professional, ethical, and statutory obligations governing the handling of your health information.

Your Health Practitioner is the primary custodian of your medical record and controls the purposes for which your information is collected and used in a clinical context.

• Vula: Vula Medical provides and operates the Vula Platform, which is a secure digital communication and referral-management tool used by healthcare practitioners. We do not provide medical or clinical services and do not make decisions about your care. We process your Personal Information and Sensitive Information solely on behalf of, and under the instructions of, your Health Practitioner for the purpose of enabling secure referral workflows, clinical communications, and care-coordination activities. In addition, we may de-identify your information. Where we do so for our own purposes, we act as a responsible party and only with your consent. Once de-identified, the information may be used by us, and by third parties to whom we make it available (including under licence or by sale), as described under ‘Purpose of Collection and Use’.

EXPECTATIONS OF THE HEALTH PRACTITIONER

The Health Practitioners and administrative staff concerned –

• have the obligation to obtain consent to treat the patient, and further process the patient’s Personal Information and Special Personal Information, as defined in POPIA – to the extent that consent is required in law;

• are allowed to collect the patient’s Information in accordance with the laws governing health care services, and may not collect and use the Vula Platform to process any information that he/she is not empowered to collect.

Compliance with privacy law is primarily the Health Practitioner’s responsibility as they are the Responsible Party providing the medical service to the patient, and the Responsible Party who initially collected a patient’s Personal Information and Special Personal Information and obtained the patient’s consent (if required) to do so. Health Practitioners are obliged to take steps to ensure that their patients are aware of how and why any of their Information will be collected and processed and, where required, shared with Third Parties in performance of a contract, or in order to provide a service to, or treat a patient.

Health Practitioners can either explain to their patients how the Vula service works and what Information will be collected and processed, or show this Patient Privacy Notice to patients, or both. Should a patient be under the age of 18, the Health Practitioner must obtain consent from the parent or guardian to process the patient’s Information.

If a Health Practitioner is unable to explain this to a patient if the patient is, for example, unconscious, mentally incapacitated, or an unaccompanied minor, then the Health Practitioner must explain and obtain consent from the patient’s guardian or a guardian appointed by the State when it is possible to do so.

Patients are not obliged to provide their Information to their Health Practitioner for use on the Vula Platform. However, if the Information needed for a referral or consultation is not provided, the Health Practitioner may not be able to use the Vula Platform to obtain advice from, or refer the patient to, a Specialist, and may need to do so by other means.

CHILDREN

Vula processes Personal Information and Special Personal Information of patients for healthcare purposes and, from time to time, this may include Special Personal Information relating to children under the age of 18 years old. Health Practitioners are responsible for ensuring that the processing of a child's information is lawful - for example, with the consent of a parent or guardian (a 'competent person' under POPIA), with the consent of the child where the child may lawfully consent to their own medical treatment, or on another lawful basis permitted by POPIA and the Children's Act 38 of 2005. Any consent to the de-identification of a child's information, as described under ‘Your Choice: De-identification for Research and Data Partnerships’, must be given by a parent, guardian or other competent person.

If it is not reasonably practicable for the Health Practitioner to explain this to a parent or guardian due to the minor being unaccompanied and parent or guardian unreachable, then the Health Practitioner must follow the requirements of the Children's Act 38 of 2005 regarding consent to medical treatment (including consent by the head of the health establishment or a court where applicable).

PATIENT INFORMATION COLLECTED

Patient Information collected, by the Health Practitioner for purposes of using the Vula App will be restricted to the following:

• Name and Surname

• Contact Information (phone number and/or email address)

• Physical Address (if applicable)

• Age or Date of Birth

• Gender

• Weight and/or height (if applicable)

• ID Number or Hospital/Practice Folder Number (unique identifier to the patient)

• Medical Aid Number (if applicable)

• Location

• Basic Health Information

• Medical History

• Comorbidities, existing conditions and current treatments

• Family History or relative specific related information

• Information related to the patient’s current medical condition including assessment, diagnosis and treatment

• Images including photographs of physical ailment, x-rays, diagnostic reports or results, or other where required

• Admission forms that may include a patient’s (or guardian’s) signature

• Chat correspondence related to the patient during the referral process

• Audio recordings of voice calls between Health Practitioners discussing the patient, and transcripts generated from those recordings

We do not collect information directly from you. All Personal Information and Sensitive Information that we handle is collected by your Health Practitioner, who inputs the information into the Vula Platform after obtaining your informed consent to do so. Your Health Practitioner is responsible for determining what information is necessary and appropriate for your referral and care-coordination purposes.

The patient Information collected by the Health Practitioner is transferred securely within the Vula Platform to a Specialist (who is also a user of our Platform) to obtain advice which may lead to a more accurate diagnosis or treatment. It may also lead to the Specialist recommending a follow-up appointment with him/herself or another Health Practitioner. The Information may potentially be transferred to multiple Specialists using the Vula Platform in order to further advise, treat or follow up with patients.

We only support the secure transmission of information between your Health Practitioner and the specialist(s) involved in your care as per the Health Practitioner’s instructions.

VOICE CALLS BETWEEN HEALTH PRACTITIONERS

The Vula Platform allows a Health Practitioner to speak to a Specialist by voice call in order to discuss a referral. Where such a call takes place, it may be recorded and a written transcript may be generated from the recording, so that there is an accurate record of the clinical discussion about the patient.

The Health Practitioner chooses whether to place a recorded call or an ordinary call, and the person being called is asked to agree to the recording before it begins. Where that person cannot be asked directly, the Health Practitioner is responsible for informing them. Consent to the recording and transcription of discussions concerning a patient is dealt with at the time the referral is created.

The transcript is generated automatically and cannot be edited. It is saved as generated and is marked as automatically generated and not verified. The audio recording is retained and is the primary record of the discussion. Where a Health Practitioner considers a transcript to be inaccurate, the correction is added to the referral as a separate note. A patient may also ask their Health Practitioner for the correction of their Information as described under “Access and Correction of Patient Information” below. Transcripts are produced by automated speech-recognition technology (a form of artificial intelligence) and may contain errors.

The recording and the transcript are treated in the same way as the other Information relating to the referral, including images, and are retained as part of the clinical record. Voice calls are carried by a third party real-time communications provider, which processes the audio on our behalf and on our instructions, and transcription may be performed by that provider or by a third party transcription provider.

ACCESS AND CORRECTION OF PATIENT INFORMATION

Your Health Practitioner is the primary custodian of your official medical record and holds clinical responsibility for the integrity and completeness of your health information. Accordingly, any request to access or correct your clinical information should be directed to your Health Practitioner in the first instance.

You may also request access to, or correction of, the Personal Information that the Health Practitioner holds through Vula. If you send such a request to Vula, we will refer it to your Health Practitioner or the relevant facility without delay and assist them, on their instructions, to respond. Requests may be sent to our Information Officer using the contact details below. Requests to correct or delete information, and objections, are free of charge.

If you are not satisfied with how your information has been handled, you may lodge a complaint with the Information Regulator (South Africa): JD House, 27 Stiemens Street, Braamfontein, Johannesburg, 2001; email: enquiries@inforegulator.org.za; website: https://inforegulator.org.za.

Vula processes patient Personal Information and Special Personal Information as an operator, only with the knowledge or authorisation of, and on the instructions of, the Health Practitioner or facility responsible for the patient's care, and in accordance with its agreement with them. As POPIA requires of operators (sections 20 and 21), Vula treats the information as confidential, does not disclose it unless required by law or in the course of properly performing its services, and establishes and maintains appropriate security measures. Where the Vula Platform is used in another country, Vula also complies with the obligations that the law of that country places on service providers that process information on behalf of others.

The Health Practitioner, as the responsible party, is responsible for ensuring that the patient's information is processed in accordance with the conditions for lawful processing set out in POPIA (the “Processing Conditions”), which include, among others, accountability, purpose limitation, data minimisation, information quality, transparency, security safeguards and data subject participation. Vula supports the Health Practitioner in meeting these conditions, for example through the security of the Vula Platform and by assisting with patient requests. Health Practitioners and Specialists using the Vula Platform in other jurisdictions must comply with the data protection laws that apply to them there.

Vula processes patient Personal Information and Special Personal Information only to the extent reasonably necessary to provide the Vula Platform to the Health Practitioner, namely to enable secure clinical communication, facilitate referrals and support patient care, and, where authorised by the Health Practitioner (including under Vula’s terms of use) or the facility, to de-identify information as described under ‘Purpose of Collection and Use’. Vula also processes the information where it is required to do so by law.

As part of the service it provides to Health Practitioners and facilities, Vula subjects all Health Practitioners and Specialists who use the Vula Platform to verification and approval processes relevant to their professional discipline before granting them access. Patient information processed via the Vula Platform is accessible only to the authorised Health Practitioner(s) and Specialist(s) involved in the relevant referral or consultation, and to authorised members of the department, practice or facility responsible for the referral, whether through the Vula mobile application or the secure web portal.

The Health Practitioner remains the primary custodian of the patient’s medical record and is responsible for responding to patient requests for access to, or correction of, their Personal Information or Special Personal Information, in accordance with applicable local privacy and healthcare laws. Health Practitioners may access and download reports relating to their patients and referrals via the Vula Web Portal at any time, subject to applicable legal and professional obligations.

PURPOSE OF COLLECTION AND USE

We collect, store, and process your Personal Information and Sensitive Information for the primary purpose of enabling your Health Practitioner to use the Vula Platform for clinical referral and care-coordination activities. This includes:

• securely transmitting your information to another healthcare practitioner or specialist selected by your Health Practitioner for the purpose of obtaining clinical input or facilitating a referral; and

• enabling secure, auditable communication between your Health Practitioner and that specialist to support your assessment, diagnosis, treatment, or ongoing management.

Your information is handled only to the extent reasonably necessary to perform these functions and activities of the Vula Platform.

We will not use or disclose your identifiable Personal Information for any secondary purpose (such as marketing) without your explicit further consent. Where authorised by your Health Practitioner or the facility responsible for your care, and as permitted by law (including, where we do so for our own purposes), we may de-identify your information. In this case, the de-identified information may be used by Vula, and by third parties to whom Vula makes it available (including under licence or by sale), for purposes including service improvement, system analytics, reporting, the development and testing of products, services and AI models (including features of the Vula Platform), and research. Information that has been de-identified in this way is no longer personal information, and no further consent is needed for its use. De-identification is carried out in accordance with Vula's de-identification standard so that you cannot reasonably be re-identified. Recipients of de-identified information are contractually prohibited from attempting to re-identify anyone, from combining the information with other information in a way that could identify you, and from sharing it further, and must obtain any approval required by law for their use of it.

If your Health Practitioner does not provide your information for entry into the Vula Platform, they will be unable to use our service to facilitate your specialist referral or consultation.

YOUR CHOICE: DE-IDENTIFICATION FOR RESEARCH AND DATA PARTNERSHIPS

Vula would like to use health information from the Vula Platform, with the details that identify patients removed, to support health research and to develop better health services and technology. We will only do this with your consent. For this purpose, Vula Medical (Pty) Ltd decides how and why your information is de-identified, and acts as the responsible party. You can contact us using the details at the end of this Notice.

What we ask. Before your Health Practitioner creates a referral for you on the Vula Platform, they will ask for your consent, on our behalf, both to the use of the Vula Platform for your referral and to Vula removing the details that identify you (such as your name, ID number, contact details, address and photographs of your face) from your health information, in accordance with Vula’s de-identification standard, so that the information can no longer reasonably be linked to you.

How de-identified information is used. Once your information has been de-identified, it may be used by Vula, and by organisations to which Vula makes it available (including under licence or by sale). These organisations include universities, researchers, healthcare providers, public-health organisations and companies developing health products, services and artificial intelligence (AI) models. The information may be used for health research, analytics, improving health services, and developing, training and testing health products, services and AI models. De-identified information is no longer personal information, and no further consent is needed for its use. Recipients are contractually prohibited from attempting to re-identify anyone.

Your choice. You do not have to agree. If you do not agree, your Health Practitioner may not be able to use the Vula Platform to obtain advice from, or refer the patient to, a Specialist, and may need to do so by other means.

Changing your mind. You may withdraw your consent at any time by telling your Health Practitioner or by contacting our Information Officer. We will then not include your information in any further de-identification. Information that has already been de-identified cannot be traced back to you and so cannot be withdrawn.

ARTIFICIAL INTELLIGENCE FEATURES

Some features of the Vula Platform use artificial intelligence, such as automated transcription of calls between Health Practitioners. These features assist Health Practitioners; they do not make decisions about your care. Your Health Practitioner remains responsible for all clinical decisions, and AI-generated content is labelled and must be reviewed by a Health Practitioner. Vula's AI service providers may not use your information to train their own models.

SHARING OF INFORMATION

Should Vula share any Information with a Third Party outside the scope of obtaining advice from, or referring a patient to a Specialist or Health Practitioner, it will do so only with de-identified information, under a written data sharing agreement, on the following conditions (in addition to Vula's de-identification standard):

• Any information that can identify a person will be removed to protect the person’s privacy. This includes the name, surname, identity number, and facial images.

• Any information that can be used to communicate with a person will be removed to prevent unauthorised communications being sent. This includes phone numbers and email addresses.

• The information shared will only be used for the purposes permitted by Vula's written agreement with the recipient, and the recipient must obtain any approval required by law for that use, including research ethics approval (where applicable).

Where necessary to protect our legal rights and interest, or the interests of others, we may also use patient Information in relation to legal claims, compliance, audit, risk management and regulatory functions.

We may, from time to time, share Information contained in reports with the Departments of Health for research purposes. However, we will only share Personal Information in these reports insofar as it is necessary for the governmental institution to fulfil its functions in advancing public health or other public interests.

Vula's employees and contractors, and our service providers, have access to patient information where this is necessary to provide the Vula Platform and related support services to Health Practitioners. For example, where a Health Practitioner contacts our support team about a specific referral, our staff may discuss that referral, including patient details, with them, after confirming that the Health Practitioner is authorised to access that referral. We may also be required to disclose patient information by law. Access and disclosure are limited to what is necessary for these purposes, and everyone with access is bound by confidentiality. Accordingly, patient information may be accessed by or disclosed to:

• any person that works for us and is in the employ of Vula, either as a permanent employee, consultant or contractor;

• companies and organisations that provide services to us, including in relation to technical infrastructure, and web and app development and support;

• our professional advisers, consultants and other similar services;

• legal and regulatory authorities, upon request, or for the purposes of reporting any actual or suspected breach of applicable law or regulation;

• any relevant party, law enforcement agency or court, to the extent necessary for the establishment, exercise or defence of legal rights;

• any relevant party for the purposes of the prevention, investigation, detection or prosecution of criminal offences or the execution of criminal penalties, including, but not limited to, safeguarding against and the prevention of threats to public security.

We will otherwise treat all patient Information as private and confidential and will not share it with other parties except:

• where permission has been given;

• where we believe it is reasonably necessary to comply with any law, regulation, legal process or governmental request, to enforce our Terms and Conditions of use or other agreements, or to protect the rights, property, or safety of us, our customers or others;

• where we may transfer rights and obligations pursuant to an agreement with the Health Practitioner, Specialist or Patient.

PATIENT PRIVACY AND CONFIDENTIALITY

At Vula, we value each patient’s privacy and, and strive to ensure patient confidentiality is maintained at all times. Vula will only collect, process, store and share patient Personal Information and Special Personal Information in accordance with this Patient Privacy Notice, in accordance with the agreement with a Health Practitioner and Specialist, in accordance with the applicable legislation and the Terms and Conditions of use of the Vula Platform they agreed to when registering to use our products and services.

INFORMATION SECURITY

Vula places great importance on ensuring the security of all patient Information and is obliged to prevent the loss of, damage to, or unauthorised destruction of Personal Information and Special Personal Information as well as the unlawful access to or processing of this information. The patient Information processed through the Platform is securely stored within the Vula Platform using regularly reviewed, up to date, and appropriate and reasonable technical and organisational measures as required by applicable law to protect the Information from loss, misuse, unauthorised access, unauthorised disclosure, alteration or destruction.

The Vula Platform, including both the Mobile App and the Web Portal, are developed using secure technologies with Security by Design and Privacy by Default principles at the forefront of its architecture, and can only be accessed using strong access control protocols, and only by Vula approved and validated end users.

The Vula Platform is a cloud based solution hosted by Heroku (a Salesforce Company) on Amazon Web Services (AWS) infrastructure in data centres located in Europe. All patient Information collected, processed and stored is, thus, done so in this location. The AWS Data Centre is ISO 27001 certified which provides assurance with regards to the physical, logical and environmental security of the hosted solution and the patient Information therein, as well as the business continuity and availability of the services we offer.

Vula, in collaboration with the AWS Data Centre, has further taken reasonable measures to:

• identify all reasonably foreseeable internal and external risks to Personal Information in its possession or under its control;

• establish and maintain appropriate safeguards against the risks identified;

• regularly verify that the safeguards are effectively implemented; and

• ensure that the safeguards are continually updated in response to new risks or deficiencies in previously implemented safeguards.

TRANSBORDER FLOW OF INFORMATION

To enable Healthcare Practitioners to use the Vula Platform and its services, the patient Personal Information and Special Personal Information we process may, in certain circumstances, be transferred to, stored in, or accessed from locations outside the patient’s country of residence.

Where patient information is transferred outside the Republic of South Africa, such transfer will occur only where it is necessary to provide the requested services and where the recipient is subject to laws, binding corporate rules, or contractual obligations that provide a level of protection substantially similar to that required under this Privacy Notice and applicable data protection legislation.

We take reasonable and appropriate steps to ensure that patient information is protected at all times, including by implementing suitable contractual, technical, and organisational safeguards with our service providers and partners.

Our cloud hosting infrastructure is provided by Amazon Web Services in data centres located in Europe, and the real-time communications provider which carries voice calls processes call audio on infrastructure located in the United States. Where patient Information is processed outside the Republic of South Africa, we rely for the purposes of section 72 of POPIA on binding obligations which afford a level of protection substantially similar to that required by POPIA and which restrict any further transfer.

Notwithstanding the above, where patient Personal Information is subject to mandatory data localisation, cross-border disclosure restrictions, or equivalent territorial processing requirements under the laws of a particular jurisdiction, such information shall be stored, processed, and handled in accordance with those mandatory local legal requirements, to the extent that they apply.

You may withdraw your consent to the cross-border processing of your Personal Information at any time. Please note, however, that doing so may mean that your Healthcare Practitioner is no longer able to use the Vula Platform to provide services to you.

RETENTION OF PATIENT INFORMATION

Vula retains Patient Information only for as long as is reasonably necessary for the purposes for which it was collected, or for any longer period required or permitted by applicable law.

Where Patient Information forms part of a patient’s clinical or medical record, Vula will retain that information for at least the minimum period prescribed by applicable health-care laws and regulations governing the retention of medical records. The applicable retention period may differ depending on the nature and category of the Patient Information, the applicable health-care service, and the legal or regulatory requirements applicable to that information.

For the avoidance of doubt, Patient Information may include records generated on the Platform in connection with a patient's care, including audio recordings of voice calls, transcripts of those calls, clinical notes, correspondence, assessments and other information generated or received in connection with the provision of health-care services, where such information forms part of, or is required to support, the patient’s clinical record.

Vula maintains a documented retention schedule identifying, for each relevant category of Patient Information:

• the applicable retention period;

• the legal, regulatory or operational basis for retaining the information;

• the purpose for which the information is retained; and

• the manner in which the information is securely disposed of or otherwise processed at the end of the applicable retention period.

Once the applicable retention period has expired, Vula will securely delete the relevant Patient Information or, where deletion is not reasonably practicable or where continued retention is otherwise justified or required by law, irreversibly de-identify the information so that it can no longer reasonably be associated with an identifiable patient.

Where Patient Information is subject to more than one applicable retention requirement, Vula will retain the information for the longer applicable period. Vula will not retain identifiable Patient Information indefinitely merely because it was previously collected or formed part of a patient record.

ELECTRONIC COMMUNICATION

At times, and on a case by case basis, Vula may send patients additional information regarding their scheduled or follow-up appointments with a Specialist or other Health Practitioner, or with regards to the treatment and management of their medical condition. This will be done in the form of electronic communication including, but not limited to, SMSs and eMails. Messages contain the minimum information necessary and will not disclose your diagnosis. These messages are sent on behalf of, and at the request of, the Health Practitioner or facility responsible for the patient's care, and are not used for marketing. Patients who do not wish to receive these messages may tell their Health Practitioner or reply to opt out.

DATA BREACHES

In the event of any privacy or security breaches of the Vula Platform, or at our Third Party Hosted Data Centre, that are likely to result in any risk to a patient’s Personal Information and/or Special Personal Information, or to the patient’s rights and freedoms, we will notify Health Practitioners, Specialists, and the relevant Regulatory Authority as soon as we become aware of such. Notifications will include the nature of the breach, the information involved, and recommended steps that affected individuals should take to mitigate potential harm.

End users of the Vula Platform have also been advised to notify Vula immediately where they have reasonable grounds to believe that their accounts or patient data have been accessed or acquired by any unauthorised person.

REVISIONS TO THIS NOTICE

We may amend this Patient Privacy Notice from time to time. Health Practitioners and Specialists should check the Vula Platform regularly to see when this Patient Privacy Notice was last updated and to review the updated notice. Each updated version applies to patient information already on the Vula Platform as well as to information entered after it takes effect.

PRIVACY QUERIES

Should you have any query in relation to this Patient Privacy Notice or how we handle your patient Personal Information or Special Personal Information, please contact us by sending an email to support@vulamedical.com

INFORMATION OFFICER

Vula’s current Information Officer is:

Name: William Mapham

Position: CEO

Email Address: william@vulamedical.com

Information Regulator: Information Regulator (South Africa): JD House, 27 Stiemens Street, Braamfontein, Johannesburg, 2001; email: enquiries@inforegulator.org.za; website: https://inforegulator.org.za.