Privacy Policy - VitalScan

VitalScan (Pty) Ltd

Version 1.

Last Updated:2026-05-05

1. Introduction

VitalScan is an emergency information access platform designed to assist verified first responders in accessing critical personal and medical information during a medical emergency where a user may be unable to communicate.

VitalScan processes personal and special personal information in accordance with the Protection of Personal Information Act, 4 of 2013 (POPIA) and other applicable South African laws.

This Privacy Policy explains:

What information we collect
Why we collect it
How it is used
How it is protected
How long it is retained
Your rights as a data subject

2. Responsible Party

VitalScan (Pty) Ltd is the Responsible Party as defined in POPIA and determines the purpose and means of processing personal information.

An Information Officer has been appointed in accordance with POPIA and is responsible for overseeing compliance and handling data subject requests.

Contact details for the Information Officer are provided in Section 16 of this Policy.

3. Who This Policy Applies To

This Privacy Policy applies to:

Registered clients and principal members
Dependants linked to client accounts
Verified first responders
Website visitors
Subscription users
Customer support users
VitalScan staff and employees

4. Information We Collect

All information processed by VitalScan is supplied voluntarily by users.

Users remain in control of what information they choose to provide.

Certain optional fields may be left blank.

4.1 Client Information (Emergency Profile)

The following personal information may be collected:

Personal Information

Full name
Identity number or passport number
Date of birth
Email address
Mobile number
Sex
Religion (optional)
Ethnic group (optional)

Medical Aid Information

Medical aid provider
Membership number
Plan details

4.2 Emergency Contact Information

Users may provide details of emergency contacts including:

Name
Relationship
Contact numbers

4.3 Medical Information (Special Personal Information)

VitalScan allows users to store medical information that may be relevant during an emergency.

This may include:

Allergies
Chronic medication
Medical conditions
Blood type
HIV status (optional)
Mental health information (optional)
Pregnancy details (optional)
Disability information
Surgical history
Advance directives
Organ donor status
Additional emergency notes

Medical information is supplied voluntarily by users and is not verified by VitalScan.

4.4 Vehicle Information

Users may optionally provide:

Vehicle make
Vehicle model
Vehicle colour
Registration number

This information may assist with emergency identification in vehicle-related incidents.

4.5 Dependant Information

Principal members may create profiles for dependents, including minors.

Dependant profiles may include:

Identification details
Medical information
Emergency contact information

Minor profiles:

Cannot create independent accounts
Must be created by a lawful guardian
Are managed entirely by the guardian account

4.6 First Responder Information

First responders must provide verification information before gaining access to the platform.

Information collected may include:

Name and surname
Identity number
Email address
Professional registration number
Occupation
Employer details
City and province

This information is used strictly for verification, access control, and audit logging.

4.7 Website and Subscription Information

The website may collect limited personal information including:

Account registration details
Subscription and billing information
Customer support enquiries

Detailed emergency medical information is not stored on the public website.

5. How We Use Personal Information

VitalScan processes personal information strictly for the following purposes:

Emergency identification
Emergency medical awareness
Next-of-kin notification
First responder verification
Platform security and audit logging
Subscription management
Customer support
Legal and regulatory compliance

VitalScan does not:

Sell personal information
Use personal data for advertising
Profile users for marketing purposes
Process data for unrelated commercial purposes

6. Lawful Basis for Processing

VitalScan processes personal information in accordance with POPIA under the following lawful bases:

Explicit consent from the user
Vital interest of the data subject during emergency situations
Performance of a contract (subscription services)
Legitimate interest in securing and maintaining the platform

Special personal information such as medical data is processed solely for emergency identification purposes.

7. Emergency Access Controls

Emergency information may be accessed only when:

A verified first responder is logged into the VitalScan application
The responder account has been approved
A QR code or NFC tag linked to a profile is scanned
A secondary security PIN is entered

Emergency access is:

Read-only
Time-limited
Logged and auditable

Each access attempt records:

Date and time
Responder identification
IP address
Access attempt status

No personal or medical information is stored directly on QR codes or NFC tags.

This emergency access process is subject to ongoing review as part of the VitalScan Data Security Risk Assessment and is assessed annually for effectiveness and emerging risks.

8. Security Safeguards

VitalScan implements appropriate technical and organisational safeguards including:

Microsoft Azure hosting (South Africa North region)
Microsoft Entra External ID authentication
Encryption at rest
Encryption in transit (TLS)
Role-based access control
Administrative access restrictions
Database audit logging
Scan rate limiting
Suspicious activity alerts
Automatic session timeouts

Emergency access is:

PIN-protected
Role-restricted
Fully logged

9. Cross-Border Data Transfers

VitalScan uses certain services that operate outside South Africa.

Authentication services are provided through Microsoft Entra External ID, hosted in the European Union region.

Core databases are hosted in Microsoft Azure South Africa North.

Where cross-border processing occurs, VitalScan ensures:

Adequate contractual safeguards
Microsoft Data Processing Agreements
Equivalent data protection standards

All cross-border processing complies with Section 72 of POPIA.

10. Data Retention

VitalScan retains personal information only for as long as necessary for lawful purposes.

Retention periods include:

Active emergency profiles retained while accounts remain active
Deleted accounts permanently deleted within 30 days
Authentication logs retained for a minimum of 12 months and up to 3 years where required for legal, security, or dispute resolution purposes
Emergency scan logs retained for a minimum of 12 months and extended where necessary for legal or investigative purposes
Audit logs retained for a minimum of 12 months and extended where required for compliance or legal purposes
Backup data retained for up to 12 months unless required for longer retention under security or legal obligations
Financial records retained for 5 years
Security incident records retained for 5 years

11. Data Subject Rights

Under POPIA, users have the right to:

Access their personal information
Correct inaccurate information
Withdraw consent
Request deletion
Object to unlawful processing
Lodge a complaint with the Information Regulator

Requests must be submitted through official support channels or in accordance with applicable Promotion of Access to Information Act (PAIA) procedures, where applicable.

Requests may be required to be submitted on prescribed forms and directed to the Information Officer. A reasonable fee may apply in certain cases, as permitted by law.

VitalScan will respond to requests within 30 days, unless the complexity of the request requires a reasonable extension as permitted under applicable legislation.

12. Security Breach Notification

If VitalScan has reasonable grounds to believe that personal information has been accessed by an unauthorised person, VitalScan will:

Investigate the incident
Notify affected data subjects
Notify the Information Regulator
Implement mitigation measures

Notification will occur as soon as reasonably possible in accordance with Section 22 of POPIA.

13. Third-Party Service Providers

VitalScan uses trusted service providers including:

Microsoft Azure (cloud hosting infrastructure)
Microsoft Entra External ID (authentication services)
PayFast and mobile app stores (payment processing)

These providers are contractually bound to process personal information in accordance with applicable data protection laws.

14. Platform Classification Disclaimer

VitalScan is a digital information access platform designed to assist with the availability of personal and medical information during emergency situations.

VitalScan is not:

A medical device
A healthcare provider
A telemedicine service
An emergency response provider

VitalScan does not provide medical diagnosis, treatment, or clinical advice.

Users must always rely on qualified healthcare professionals and official emergency services when seeking medical assistance.

15. Updates to This Privacy Policy

VitalScan may update this Privacy Policy periodically to reflect:

Legal requirements
System updates
Security improvements

Material updates will be communicated through the platform.

Continued use of VitalScan constitutes acceptance of the updated Privacy Policy.

16. Information Officer Contact Details

Information Officer

VitalScan (Pty) Ltd

Johan Niemand

Email: info@vitalscan.co.za

Telephone: +27 72 958 9649

Registered Address:

13 Nature View

490 Botterklapper Street

Die Wilgers

Pretoria

South Africa