Back to Legal
Privacy Policy
Effective Date: 30 October 2026
At Vula Medical we value our Data Subject's privacy and strive to protect their Personal Information. Vula’s Data Subjects are typically health practitioners or healthcare students registered with the statutory council or other body that regulates their profession (for example the Health Professions Council of South Africa, the South African Nursing Council, the South African Pharmacy Council or the Allied Health Professions Council of South Africa, or an equivalent body in another country) (“Healthcare Practitioners”), or people employed in an administrative role and acting on behalf of a healthcare establishment, department of health or a private or public healthcare practice. In processing your information in this role we act as a Responsible Party, and we will only collect, process, store and share your Personal Information in accordance with the Protection of Personal Information Act No. 4 of 2013 (POPIA) as detailed in our Privacy Policy. Our processing of information in an operator role is regulated separately in our Patient Privacy Notice
Privacy policy
How we collect, process, store and share your Personal Information.
At Vula Medical (Pty) Ltd (“Vula”), we value your privacy and are committed to protecting your Personal Information. We collect, use, and otherwise process Personal Information in accordance with this Privacy Policy, the Protection of Personal Information Act No. 4 of 2013 (“POPIA), and where applicable, the privacy and data protection laws in the jurisdictions in which we operate.
Reference in this Privacy Policy to “we”, “us”, “our” or any similar term may be construed as reference to “Vula”. We act as the responsible party of our end user’s (“the Data Subjects”) Personal Information when an account is opened with Vula using either the Vula Mobile App or online Web Portal. This Privacy Policy applies to the Vula Medical App, the Vula Online Web Portal and the Vula Medical Website (together, the “Vula Platform” or “Platform”).
We Process your Personal Information on the lawful bases described in this Privacy Policy (see 'Use of Personal Information'). Where we rely on your consent - for example for marketing other than about our own similar services, or for optional features - we will ask for it separately and specifically, and you may withdraw it at any time. By providing us with your Personal Information, you acknowledge that you have read this Privacy Policy.
This Privacy Policy explains how we will endeavour to protect and use your Personal Information.
We act as an Operator when we process patient Personal Information and Special Personal Information on behalf of our Data Subjects, and in accordance with our agreement with them (the EULA), to provide Vula’s services.
PRINCIPLES GOVERNING THE PROCESSING OF PERSONAL INFORMATION
Vula processes Personal Information and Special or Sensitive Personal Information in accordance with a set of core privacy and data protection principles that reflect internationally recognised standards and the requirements of applicable privacy laws in the jurisdictions in which we operate. These principles guide how we collect, use, store, disclose, and protect Personal Information.
Accountability and Governance
Vula is accountable for the Personal Information it processes and takes responsibility for ensuring that such processing is carried out in a lawful, fair, and responsible manner. We maintain appropriate internal policies, procedures, and oversight mechanisms to support compliance with these principles and to ensure that third parties who process information on our behalf are subject to equivalent obligations.
Lawfulness, Fairness, and Consent
Personal Information is processed only where there is a lawful basis to do so. This may include the performance of our agreement with you, the informed consent of the individual, our legitimate interests or those of a third party (balanced against your rights), the necessity of processing to support healthcare delivery, or compliance with legal or regulatory obligations. Where consent is required, it must be voluntary, informed, and specific, and individuals must be made aware of the purpose for which their information is processed and by whom.
Purpose Limitation
Personal Information is collected for specific, explicit, and legitimate purposes related to the provision and operation of the Vula Platform, including enabling secure clinical communication, referrals, and care coordination. Information is not collected for one purpose and then used for an unrelated purpose without appropriate authorisation or consent. Vula may create de-identified and aggregated information from Personal Information processed through our App and Services. Such de-identified information may be used for analytics, service improvement, reporting and research, as described in this Policy and, for patient information, as authorised under our EULA and described in our Patient Privacy Notice (including, where Vula de-identifies patient information for its own purposes, with the patient’s consent).
Data Minimisation
Vula limits the collection and processing of Personal Information to what is reasonably necessary to fulfil the identified purposes. We do not collect excessive or irrelevant information, and we rely on Healthcare Practitioners to exercise appropriate clinical judgment regarding the information shared via the Platform for which data the Healthcare Practitioner takes responsibility as the Responsible Party.
Collection Practices
Where practicable, Personal Information is collected directly from the Healthcare Practitioner. If unsolicited Personal Information is received, Vula will assess whether it may lawfully be retained and, if not, will securely delete or de-identify the information within a reasonable period, where lawful to do so.
Transparency and Openness
Vula is committed to transparency in its information-handling practices. We make available clear and accessible privacy notices that explain what Personal Information is processed, the purposes of processing, how information may be shared, how individuals can exercise their rights, and how privacy-related concerns or complaints may be raised.
Further Processing and Disclosure
Where Personal Information is disclosed to third parties or further processed on Vula’s behalf, such processing is limited to purposes that are compatible with the original purpose of collection. Vula requires such third parties to be bound by appropriate confidentiality, security, and data protection obligations.
Information Quality and Accuracy
Vula takes reasonable steps to ensure that Personal Information under its control is accurate, complete, up to date, and not misleading, having regard to the purpose for which it is processed. Users of the Service must provide accurate and current information and maintains safeguards to preserve data integrity.
Security Safeguards
Vula implements appropriate technical, administrative, and organisational measures to protect Personal Information against loss, misuse, interference, unauthorised access, disclosure, or alteration. These safeguards are regularly reviewed and updated to address evolving risks and technological developments.
Cross-Border Processing
Where Personal Information is processed or stored outside an individual’s country of residence, Vula takes reasonable steps to ensure that such processing is subject to safeguards that provide a level of protection consistent with these principles and applicable local requirements, including contractual, technical, and organisational controls.
Retention and Disposal
Personal Information is retained only for as long as necessary to fulfil the purposes for which it was collected or to comply with legal, regulatory, or professional obligations. Once no longer required, information is securely deleted or irreversibly de-identified, unless retention is required by law.
Individual Rights and Participation
Individuals have the right to request access to Personal Information held about them to request correction or deletion of information that is inaccurate, irrelevant, excessive, out of date, incomplete, misleading or unlawfully obtained, to object to certain processing (including direct marketing), and to lodge a complaint with the Information Regulator, subject to applicable limitations. Objections and requests for correction or deletion may be made free of charge. Requests are handled within a reasonable timeframe and in accordance with applicable law. Where access or correction is refused, individuals will be informed of the reasons and available avenues of recourse.
Incident Management and Breach Notification
Vula maintains procedures to identify, assess, and respond to actual or suspected data security incidents. Where there are reasonable grounds to believe that Personal Information for which Vula is responsible has been accessed or acquired by an unauthorised person, Vula will notify the Information Regulator and affected Data Subjects as soon as reasonably possible, as required by section 22 of POPIA. Where Vula acts as an Operator, it will notify the relevant Healthcare Practitioner or facility immediately so that they can notify affected patients, and will take reasonable steps to mitigate any adverse effects.
PERSONAL INFORMATION COLLECTED
When you register to use the Vula App or Online Web Portal, we open and operate an account for you, provide you with our products and services, and provide you with electronic communications relating to your account, our products and our services. To this end, we need to collect the following Personal Information from you:
• Name and Surname
• ID or passport number
• Healthcare Professional Registration Number
• Mobile number
• Email Address
• The Name and Location of your Practice, Department and/or Facility and your professional registration details (council, registration number, category and status)
• Profile photo (optional)
• Records of voice calls you place or receive through the Vula Platform, such as the date, time, duration and participants of each call and whether it was recorded (the content of recordings and transcripts is processed on behalf of the Healthcare Practitioner or facility, as described under 'Voice Calling, Call Recording and Transcription') in this document.
• Your marketing and communication preferences and records of any consents you have given
• Records of the patient consent confirmations you make in the App, including the date and time and the version of the consent wording displayed
• Information about your use of the Platform, such as referrals sent and received, response times, departments and teams you belong to, and features used
For all users of our Vula Medical App and Online Web Portal, we also collect technical information, including your device ID, IP address, device platform and model, and app version, as well as information about your usage through cookies and similar technologies. We collect this for the purposes of service improvement, troubleshooting, analytics, and ensuring system security.
Device information collected is limited to the following:
• Device ID
• Vula App Version
• Device Platform
• Device Token
• Device Manufacturer
• Device Model
• Device OS Version
• Device Time Zone
• Device Country Code
VOICE CALLING, CALL RECORDING AND TRANSCRIPTION
Voice calling, call recording and transcription form part of a Healthcare Practitioner's use of the Vula Platform. The content of recordings and transcripts forms part of the referral record and is processed by Vula as an operator on behalf of the Healthcare Practitioner or facility responsible for the patient's care, as described in our Patient Privacy Notice. Vula processes the Personal Information of the users taking part in a call, such as their names, call records and recording choices, in order to provide the feature and to keep a record of the consent to recording.
The Vula Platform allows Healthcare Practitioners to place voice calls to one another in connection with a referral or clinical consultation. Where a call is recorded, the recording and any transcript generated from it are treated as part of the referral record and are processed on the same basis as the images, videos and voice notes attached to a referral.
The caller chooses whether to place a recorded call or a standard call, and that selection is logged. The person being called is asked to agree to the recording before it begins; where that person cannot be asked, the caller is responsible for informing them. Consent to the recording and transcription of discussions concerning a patient is dealt with at the time the referral is created.
The transcript is generated automatically and cannot currently be edited. It is saved as generated and is marked as automatically generated and not verified, and the audio recording is retained as the primary record of the discussion. Corrections are recorded as a separate note on the referral. Transcripts are produced using automated speech-recognition technology (a form of artificial intelligence) and may contain errors - see 'Artificial Intelligence and Automated Processing' below.
Voice calling is facilitated by a third party real-time communications provider. The audio is transmitted through that provider and the recording is written to storage controlled by Vula. Transcription may be performed by that provider or by a third party transcription provider. These providers process the information on our behalf and on our documented instructions, and are subject to the contractual obligations described under “Service Providers” below.
PERSONAL INFORMATION COLLECTED FOR VULA'S OWN PURPOSES
Vula may also collect Personal Information from you in other ways, including:
• when you communicate with us by email, chat, telephone or any other means, we collect the communication and any data provided in it;
• when you use the Vula platform we collect information about your activity on the Platform, such as referrals sent and received and response times (the clinical content of referrals and chats is processed on behalf of the Healthcare Practitioner or facility, as described in our Patient Privacy Notice);
• when we obtain information from third parties such as identity verification services from the Health Professions Council of South Africa, or similar professional registration councils, to confirm you are a registered healthcare practitioner;
• information contained in a public record or has deliberately been made public by you;
• where you have consented to the collection of the information from another source, including our social media platforms;
• collection of the information from another source would not prejudice a legitimate interest you may have;
• collection of the information from another source is necessary –
• to avoid prejudice to the maintenance of the law by any public body, including the prevention, detection, investigation, prosecution and punishment of offences;
• to enforce a law imposing a pecuniary penalty;
• to enforce legislation concerning the collection of revenue as defined in relevant local legislation;
• for the conduct of proceedings in any court or tribunal that have commenced or are reasonably contemplated; or
• in the legitimate interests of national security.
USE OF PERSONAL INFORMATION
We use your Personal Information for one or more of the following purposes:
• to verify your identity as a healthcare practitioner or healthcare service provider;
• to manage and maintain your account with us;
• to prevent fraudulent or unauthorised use of our products and services;
• to better manage our business and your relationship with us;
• to improve our products and services, and to develop new products and services;
• to create de-identified and aggregated information and statistics (for example, about referral volumes, response times and service use) for analytics, service planning, research and reporting;
• to conduct, support and facilitate research, including health-systems and public-health research, using de-identified or aggregated information wherever reasonably possible;
• to make de-identified and aggregated information available to third parties, including under licence or by sale, for research, analytics and the development of products, services and AI models (see 'Sharing of Personal Information');
• to provide service reports to the departments, practices, facilities or organisations through which you use the Platform, including information about the use of the Platform within that department, practice or facility;
• to develop, train, test and monitor features of the Platform, including artificial intelligence features, using de-identified information wherever reasonably possible (see 'Artificial Intelligence and Automated Processing');
• to keep records of the patient consent confirmations you make in the App, so that we can demonstrate that consent was obtained;
• to comply with our legal and regulatory obligations, including record-keeping and responding to lawful requests;
• to notify you about benefits and changes to the features of our products and services;
• to send you direct marketing about Vula's own similar products and services (you may opt out at any time, including in every message) and, only with your prior consent, other direct marketing or personalised advertising;
• to respond to your enquiries and to resolve disputes.
Where necessary, Vula may disclose your Personal Information in the public interest, which public interest includes:
(a) the interests of national security;
(b) the prevention, detection and prosecution of offences;
(c) important economic and financial interests of a public body;
(d) fostering compliance with legal provisions established in the interests referred to under points (b) and (c);
(e) historical, statistical or research activity; or
(f) the special importance of the interest in freedom of expression.
SHARING OF PERSONAL INFORMATION
We may disclose your Personal Information to third parties for legitimate business purposes, in accordance with applicable law and subject to applicable professional and regulatory requirements regarding confidentiality. In addition, we may disclose your Personal Information to:
• any person that works for us and is in the employ of Vula, either as a permanent employee or contractor;
• companies and organisations that provide services to us, including in relation to technical infrastructure, marketing and analytics, and web and app development and support;
• companies and organisations that assist us with identity verification, background screening, due diligence and Processing or otherwise fulfilling transactions that you have requested;
• our professional advisers, consultants and other similar services;
• legal and regulatory authorities, upon request, or for the purposes of reporting any actual or suspected breach of applicable law or regulation;
• any relevant party, law enforcement agency or court, to the extent necessary for the establishment, exercise or defence of legal rights;
• any relevant party for the purposes of the prevention, investigation, detection or prosecution of criminal offences or the execution of criminal penalties, including, but not limited to, safeguarding against and the prevention of threats to public security.
We provide service reports to the Departments of Health, facilities and organisations that procure or support the Vula Platform. Reports used for research, planning or public-health purposes contain de-identified or aggregated information as far as possible. Reports provided to the head of your department or facility (or their delegate) include identified information about your use of the Vula Platform, such as whether you are a registered user, the number of referrals you have sent and received, and your average response times. These reports are provided so that they can monitor use of the Vula Platform, identify areas for improvement and manage resources. Otherwise, identified information about you is included in reports only where disclosure is required by law. Each report is provided on condition that it is kept confidential and used only for these purposes.
We may also prepare de-identified and aggregated reports for funders and partners that support the Vula Platform or public-health programmes. These reports do not identify you or any patient.
We may also share de-identified information with, or license or sell it to, third parties such as healthcare providers, healthcare establishments, universities, researchers, public-health organisations and organisations developing health products, services and AI models, for purposes including research, publication, analytics and product development (including their own commercial purposes). This de-identified information is health information that has been anonymised, does not contain personally identifiable information and can, therefore, not be linked to a specific patient. Vula will only share this de-identified information under a written data sharing agreement, after the information has been assessed under Vula's de-identification standard. Recipients are contractually prohibited from attempting to re-identify any individual, from combining the information with other information in a way that could identify an individual, and from sharing it further except as permitted by their agreement with Vula. They must use the information only for the purposes permitted by that agreement, and obtain any approval required by law for that use, including research ethics approval.
If you are referring a patient or seeking medical advice in the Platform, you will be required to share Personal Information relating to yourself and the patient as part of the service provided by Vula. This Personal Information will only be shared with specialist medical healthcare providers or permitted medical clerks co-ordinating referrals on behalf of a department or specialist, who are approved users of the Vula Platform.
We will otherwise treat your Personal Information as private and confidential and will not share it with other parties except:
• where you have given permission;
• where we believe it is reasonably necessary to comply with any law, regulation, legal Process or governmental request, to enforce our Terms and Conditions of use or other agreements, or to protect the rights, property, or safety of us, our customers or others;
• where we may transfer rights and obligations pursuant to our agreement with you.
If we engage a third party to Process any of your Personal Information, the third party will be subject to binding contractual obligations to only Process such Personal Information in accordance with our prior written instructions; and use measures to protect the confidentiality and security of such Personal Information.
ARTIFICIAL INTELLIGENCE AND AUTOMATED PROCESSING
Some features of the Vula Platform use artificial intelligence, such as automated speech recognition to produce call transcripts. AI features are designed to assist Healthcare Practitioners. They do not make clinical decisions, and any AI-generated content is labelled and must be reviewed by a Healthcare Practitioner before it is relied on.
We may use de-identified information derived from the Platform to develop, train, test and improve our features, including AI models. We may also make de-identified information available to third parties, including under licence or by sale, to develop, train and test their own products, services and AI models. Where we use identifiable information for these purposes, we do so only where we have a lawful basis and, for patient information, the authorisation of the relevant Healthcare Practitioner or facility. Our AI service providers may not use your information to train their own models.
We do not make decisions about you that have legal consequences for you, or that affect you to a substantial degree, based solely on automated processing. If we ever do so, we will tell you, explain the underlying logic and give you an opportunity to make representations, as required by section 71 of POPIA. For example, we do not suspend or restrict your account, or assess your professional activity on the Platform, based solely on automated processing.
Our use of AI is described in our Artificial Intelligence Policy, which requires risk assessment, human oversight and approval before any AI feature is deployed.
DATA ACCURACY
The Personal Information provided to Vula should be accurate, complete and up-to-date. Should Personal Information change, the onus is on the provider of such data to notify Vula of the change and provide Vula with the accurate data.
SECURITY OF PERSONAL INFORMATION
Vula places great importance on ensuring the security of your Personal Information. We regularly review and implement up-to-date technical and organisational security measures when Processing your Personal Information. Vula employees and contractors are trained to handle Personal Information securely and with the utmost respect, failing which they may be subject to disciplinary action.
Vula takes seriously the technical and organisational security measures we have in place to protect your Vula Account. In addition, the law requires that Data Subjects also have due regard to generally accepted information security practices and procedures in order to assist in securing the Vula Platform, their own user accounts, own Personal Information, and the patient Personal Information and Special Personal Information therein.
Our Vula Platform, including both the Mobile App and the Online Web Portal, are developed using secure technologies with Security by Design and Privacy by Default principles at the forefront of its architecture. The Platform can only be accessed using strong access control protocols, and only by Vula approved and validated data subjects.
As Vula is obliged to prevent loss of, damage to or unauthorised destruction of Personal Information and unlawful access to or Processing of Personal Information, Vula uses cloud-based infrastructure provided by Heroku (a Salesforce company) on Amazon Web Services (AWS) data centres located in Europe. Vula requires its cloud hosting providers to maintain appropriate technical, physical and organisational safeguards to support the confidentiality, integrity, availability and resilience of the Personal Information processed through the Vula Platform.
Vula, together with its relevant service providers, has taken reasonable measures to:
• identify all reasonably foreseeable internal and external risks to personal information in its possession or under its control;
• establish and maintain appropriate safeguards against the risks identified;
• regularly verify that the safeguards are effectively implemented; and
• ensure that the safeguards are continually updated in response to new risks or deficiencies in previously implemented safeguards.
In addition, Vula’s Data Subjects are responsible for:
• maintaining adequate security and control over your Vula Account sign-in details, including the use of strong passwords, ensuring that passwords are not written down or saved anywhere unencrypted, and not sharing your Vula Account sign-in details with other individuals;
• enabling any additional security features available to you on your Mobile device including Mobile device access pin codes, access patterns or facial recognition features;
• keeping your contact details up to date so that you can receive any notices or alerts we may send to you in relation to security (see Electronic Communications);
• maintaining security and control over the email mailbox and phone number associated with your Vula Account;
• notifying us in a timely manner as to the theft or other unauthorised use of your mobile device or Vula Account via our support email (support@vulamedical.com) so we can reset your Vula Account password.
• where you are designated as an administrator of a department, practice, facility or team, verifying the identity and professional registration of each user you admit to it, removing users without undue delay when they leave or change role, and reviewing its membership at regular intervals. Admitting a user grants that user access to the patient information associated with that department, practice, facility or team, including referrals created before the user was admitted
In order to increase the security of your Vula Account and protect it from interruption caused to it by phishing, spoofing or other attack, computer viruses, spyware, scareware, Trojan horses, worms or other malware that may affect your computer or other devices, Vula recommends that you regularly use reputable virus screening and prevention software and remain alert to the fact that SMS, email services and search engines are vulnerable to spoofing and phishing attacks.
We encourage our Data Subjects to take all the above measures, and all other security measures available to you. In the case where the measures are not adhered to this may result in unauthorised access to your Vula Account and the loss or theft of any of your Personal Information as well as, potentially, any patient Personal Information and Special Personal Information that you have utilised the Vula Platform to Process. Vula shall have no liability to you or your patient for any unauthorised access to your Vula Account, where such unauthorised access was due to no fault of Vula, and/or any failure by you to act upon any notice or alert that we send to you.
By accepting this Privacy Policy, and then submitting your Personal Information through the Vula Platform, you agree to the transfer, storing and Processing of it by this Third Party Hosting Provider.
Further information on Heroku, Salesforce, and their hosting services can be found at the following links:
SERVICE PROVIDERS
We engage third party service providers to process Personal Information on our behalf. The categories of provider we engage are: cloud hosting and infrastructure providers; real-time communications providers; transcription providers; identity and professional registration verification providers; and support, communications and analytics providers. A current list of the providers we engage within each category is available on request from our Information Officer, and we will update that list as providers change.
Where a provider processes Personal Information on our behalf it acts as an operator. In each case we have concluded a written contract with the provider, or have accepted terms which incorporate a data processing addendum, requiring the provider to process the information only on our documented instructions and to establish and maintain the security measures required by applicable data protection law, and restricting any onward transfer.
TRANSBORDER FLOW OF PERSONAL INFORMATION
In order to operate the Vula Platform and enable secure communication between healthcare professionals, we may process, store, or transfer Personal Information to recipients or service providers located outside the country in which the information was originally collected.
Where Personal Information is transferred across borders, such transfers are undertaken only where necessary to provide the Vula Platform and associated services, and where appropriate safeguards are in place to ensure that the information is protected in a manner consistent with this Privacy Policy and applicable data protection requirements. These safeguards may include the application of local laws, binding corporate rules, or contractual obligations that provide an equivalent level of protection.
In particular, our cloud hosting infrastructure is provided by Amazon Web Services in data centres located in Europe, and our real-time communications provider processes call audio on infrastructure located in the United States. Where Personal Information is processed outside the Republic of South Africa, we rely for the purposes of section 72 of POPIA on binding obligations, including where applicable, standard contractual clauses concluded with those providers, which afford a level of protection substantially similar to that required by POPIA and which restrict any further transfer. We maintain a written assessment of these transfers.
We design our privacy and security practices to accommodate the data protection requirements of the jurisdictions in which we operate and will comply with any mandatory data localisation or cross-border transfer restrictions that apply in a particular country.
If you have any concerns about the cross-border processing of your Personal Information, please contact our Information Officer.
RETENTION OF PERSONAL INFORMATION
Vula will retain your Personal Information –
• for achieving the purpose for which the information was collected;
• when retention of the record is required or authorised by law;
• for the record for lawful purposes related to its functions or activities;
• when retention of the record is required by a contract between the parties thereto;
• when the Data Subject, or a competent person where the Data Subject is a child, has consented to the retention of the record;
• for historical, statistical or research purposes if the responsible party has established appropriate safeguards against the records being used for any other purposes.
We may however, notwithstanding the above mentioned criteria, retain your Information in a de-identified manner for such period as we deem necessary.
INCOMPLETE PERSONAL INFORMATION
Where indicated (for example in account registration forms), it is obligatory for you to provide accurate Personal Information to enable us to open and operate your Vula Account so you may be able to use our products or services. Should you decline/refuse or neglect to provide such Personal Information, or provide inaccurate or incomplete Personal Information, we may not be able to Process your account registration or provide you with our products or services.
DATA SUBJECT RIGHTS
We support the right of Data Subjects to access their Personal Information, including information relating to patients where applicable. The Personal Information that Vula collects, processes, stores, and shares is limited to what is reasonably necessary to provide, operate, and improve the services we offer, and to comply with applicable legal, regulatory, and compliance obligations.
Vula acts as the Responsible Party in respect of the Personal Information of its Data Subjects, and as an Operator of patient Personal Information and Special Personal Information. In its role as Operator, Vula processes patient information solely on behalf of, and in accordance with the instructions of, the relevant Healthcare Practitioner and in line with applicable data protection and privacy requirements, save that Vula may de-identify patient information as described in the EULA and the Patient Privacy Notice. Where Vula de-identifies patient information for its own purposes, it acts as a responsible party for that processing and relies on the patient’s consent.
You have certain rights under data protection law, including the right to object to the Processing of your Personal Information or to request that we:
• provide you with a copy of your Personal Information (including in a format that can be shared with a new provider); or
• correct, delete, or restrict the Processing of your Personal Information.
These rights are limited in some situations, such as where we are legally required to Process or store your data, and may limit your ability to use our products and services. If you would like to exercise any of the above rights, please send an email to support@vulamedical.com with your request.
Requests to object, or to correct or delete information, are free of charge and may be made by email, in writing, by telephone (which we record) or through other reasonably accessible channels. We will respond within 30 days, or tell you if we need longer and why.
Requests about patient information should be made to the treating Healthcare Practitioner or facility, which is the responsible party. If we receive such a request we will refer it to them and assist them in responding.
You may also object at any time to direct marketing, and you have the right not to be subject to a decision based solely on automated processing (see 'Artificial Intelligence and Automated Processing').
If you are not satisfied with how we have handled your Personal Information or your request, you may lodge a complaint with the Information Regulator (South Africa): JD House, 27 Stiemens Street, Braamfontein, Johannesburg, 2001; email: enquiries@inforegulator.org.za; website: https://inforegulator.org.za (complaints may be lodged on the prescribed Form 5 or through the Regulator's eServices portal).
ELECTRONIC COMMUNICATIONS
In order for Vula to provide you with the agreed services, you accept and agree that:
• any communications, agreements, notices and/or any other documents (together “Communications”) relating to your Vula Account or your use of Vula’s products and services will be provided to you electronically by posting them on the Vula Website, emailing them to the email address you have provided to us, or through any other form of electronic communication. You consent to receiving all Communications electronically;
• you will at all times have available to you the necessary hardware and software to receive, access and retain Communications sent to you electronically, including a device with an internet connection and a valid and accessible email address;
• you assume full responsibility for providing Vula with a valid and accessible email address to which any Communications may be sent, and for ensuring that the email address and any other contact information is kept up to date. Any Communication sent to the email address you have provided to us will be deemed to have been received by you. You can amend your contact information by signing-in to your Vula Account and accessing the Profile & Settings page.
You may at any time withdraw your consent to receiving Communications electronically by contacting support@vulamedical.com. You acknowledge that failure to give, or withdrawing, consent to receiving Communications electronically may put the security of your Vula Account at risk (see Security of Personal Information) should you not receive communications pertaining to your account security due to the consent withdrawn for receiving communications.
Care should always be taken in reviewing messages purporting to originate from Vula and, should you have any uncertainty regarding the authenticity of any communication, please contact us via support@vulamedical.com immediately to verify the authenticity of such communication.
USE OF COOKIES
We also collect Personal Information through the use of cookies. Cookies (and other similar technologies) help us give you the best experience of using our site. Cookies are small data files that we or companies we work with may place on your computer or other devices when you visit our website at www.vulamedical.com or use the Vula Online Web Portal. They allow us to remember your actions or preferences over time.
When you visit our Website or App we may place Cookies onto your device, or read Cookies already on your device, subject always to obtaining your consent, where required, in accordance with applicable law. We use Cookies to record information about your device, your browser and, in some cases, your preferences and browsing habits.
DECLINING COOKIES
Overall, cookies help us provide you with a better website, by enabling us to monitor which pages you find useful and which you do not. A cookie in no way gives us access to your computer or any information about you, other than the data you choose to share with us.
Certain aspects and features of our services are only available through the use of cookies. Cookies that are strictly necessary for the website and Web Portal to function are set automatically. Analytics, marketing and other non-essential cookies are set only with your consent, which you may withdraw at any time through the cookie settings. You may decline our cookies if your browser or browser add-on permits, but doing so may interfere with your use of Vula’s services. For information on how to delete or reject cookies, you can consult the “help” function within your browser, or visit www.allaboutcookies.org, where you will also find more information about cookies generally.
DATA BREACHES
We take the security of all information seriously and implement appropriate technical, organisational, and administrative measures designed to protect information against unauthorised access, loss, misuse, or disclosure.
In the event of a privacy or security incident affecting the Vula Platform or any third-party hosting or infrastructure environment where there are reasonable grounds to believe that your Personal Information has been accessed or acquired by an unauthorised person, we will notify you and the Information Regulator as soon as reasonably possible, as required by section 22 of POPIA. Where patient information is affected, we will notify the responsible Healthcare Practitioner or facility immediately so that they can notify affected patients.
We expect our users to notify us promptly if they have reasonable grounds to believe that their account, or any patient information accessed through the Vula Platform, has been accessed, disclosed, or acquired by an unauthorised person. Any such notification should be sent to: support@vulamedical.com
REVISIONS TO THIS PRIVACY POLICY
We may amend this Privacy Policy from time to time. You should visit the website regularly to check when this Privacy Policy was last updated and to review the current Privacy Policy. We will do our best to notify you of any substantive amendments to the Privacy Policy and any such notice will be posted in our Mobile App, or on our Online Web Portal or Website, or sent by email to the address associated with your Vula Account. An updated Privacy Policy applies from the date stated in the notice, including to Personal Information we already hold, and your continued use of the Vula Platform after that date constitutes acceptance of it.
PRIVACY QUERIES
Should you have any query in relation to this Privacy Policy or how we handle your Personal Information, please contact us by sending an email to support@vulamedical.com.
INFORMATION OFFICER
Vula’s current Information Officer is:
Name: William Mapham
Position: CEO
Email Address: william@vulamedical.com
Information Regulator: Information Regulator (South Africa): JD House, 27 Stiemens Street, Braamfontein, Johannesburg, 2001; email: enquiries@inforegulator.org.za; website: https://inforegulator.org.za (complaints may be lodged on the prescribed Form 5 or through the Regulator's eServices portal).
