Privacy Policy

Miva is the trading name of Simple Online Healthcare, which operates Miva in South Africa through joinmiva.com. In this policy, “we”, “us” and “Miva” mean that organisation, which is the responsible party for the personal information collected through this website.

Simple Online Healthcare is incorporated in the United Kingdom. Its registered office is 77 Dunn Street, Glasgow G40 3PA, United Kingdom. Miva trades in South Africa through local clinical, pharmacy and support partners. You can reach us about any privacy matter at contact@joinmiva.com.

We handle personal information in accordance with the Protection of Personal Information Act 4 of 2013 (POPIA), and applicable medicines and pharmacy legislation including the Medicines and Related Substances Act 101 of 1965 and the standards set by the South African Pharmacy Council (SAPC) and the Health Professions Council of South Africa (HPCSA).

Information you give us directly

• When you leave your email address to stay informed or sign up for a treatment.
• When you create an account or complete a medical questionnaire.
• When you place an order and we process and deliver it.
• When you contact us by email or a form on this website.
• When you communicate with our doctors or pharmacists about your treatment.

Information we receive indirectly

• From service providers who deliver technical, payment or courier services on our behalf.
• From other health providers, such as your GP or pharmacy, with your authorisation.
• Through cookies and analytics tools when you visit our website.

Wherever it is reasonably practicable, we collect health information directly from you, as required under POPIA.

Depending on your relationship with us, we may collect and hold:

• Name, date of birth, gender, address and email address.
• Order, invoice and payment details.
• Health information: questionnaire answers, height and weight, current medicines, allergies, medical history, treatment and dispensing records, and any side effects you report.
• Identity verification details where we are required to confirm who you are.
• Online identifiers such as your IP address and cookie IDs.
• Correspondence with our patient support team and clinical team.

We only ask for your South African ID number where it is necessary to provide or coordinate your care.

• To have your request assessed by an HPCSA-registered doctor or an SAPC-registered pharmacist.
• To prepare, dispense and deliver your medicine.
• To keep a clinical record, as required by South African health law and professional standards.
• To handle your questions, complaints, returns and refunds.
• To report adverse reactions to SAHPRA or the manufacturer where required.
• To send service messages, and marketing messages you have opted in to.
• To secure, maintain and improve our website and services.

We only use or disclose your information for the purpose it was collected for, or for a directly related purpose, unless an exception under POPIA applies.

• To provide the service you asked for, such as assessing, supplying and delivering your treatment.
• With your authorisation — for example for marketing emails, non-essential cookies, and sharing information with your GP. You can withdraw this at any time.
• To meet legal obligations, including clinical record-keeping, medicines and tax requirements.
• To prevent or lessen a serious threat to someone's life or health.
• For related purposes such as fraud prevention, protecting our systems and improving our services.

Health information

Health information receives additional protection as a special category of personal information under POPIA. It is only accessible to the clinicians and support staff involved in your care, all of whom are bound by confidentiality obligations and professional standards.

We never sell your information. We share it only with parties who need it, including:

• Our doctors, pharmacists and clinical support staff.
• The dispensing pharmacy and the courier that delivers your parcel.
• IT, hosting, email and payment providers acting as our operators under written agreements, including group services provided by our parent company.
• Your GP or another health provider, with your authorisation, or where required for your continuing care.
• Regulators and authorities — such as SAHPRA, the SAPC, the HPCSA or the Information Regulator — where the law requires or permits it.

Your information is stored on secure servers, some of which are located outside South Africa (including in the United Kingdom and the United States), because parts of our technology and support are provided by our UK parent company and its suppliers. Before we transfer personal information outside South Africa we take the steps required by section 72 of POPIA, including binding contractual protections, so that your information receives comparable safeguards to those under POPIA.

• Health records: at least 6 years from the date of the last entry, as required by the National Health Act 61 of 2003 and its regulations.
• Dispensing and prescription records: as required by medicines legislation and pharmacy standards.
• Accounting records and invoices: 5 years, as required by SARS and the Companies Act.
• Email sign-ups and marketing preferences: until you unsubscribe, and then for a limited period so we can honour your opt-out.

When information is no longer needed for any lawful purpose, we securely destroy or anonymise it.

We use appropriate technical and organisational safeguards: encryption in transit and at rest, access limited to staff who need it, multi-factor authentication, audit logging and regular reviews. Our staff are bound by confidentiality obligations.

If we experience a security compromise that may have led to unauthorised access to your personal information, we will notify the Information Regulator and the affected people as soon as reasonably possible, as required by POPIA.

We use functional cookies that are necessary for the website to work. We ask for your consent before setting analytics and marketing cookies, and you can change your choice at any time in your browser settings.

Marketing emails and texts are only sent where you have consented, and every message includes a working unsubscribe link, as required by POPIA and the Electronic Communications and Transactions Act.

Under POPIA you have the right to:

• Access the personal and health information we hold about you.
• Request correction of information that is inaccurate or incomplete, or ask us to delete or destroy it where permitted.
• Ask us to stop sending you marketing at any time.
• Withdraw your authorisation for sharing information with other providers.
• Complain to us, and then to the Information Regulator, if you are not satisfied.

We will respond to an access or correction request within a reasonable time. If we need more time, we will tell you within that period. To protect you, we may need to verify your identity first. There is normally no charge for a request.

Please contact our Information Officer first at contact@joinmiva.com.

If we cannot resolve your concern, you can complain to the Information Regulator (South Africa) online at inforegulator.org.za. Complaints about the care itself can be made to the relevant professional regulator, such as the HPCSA or the SAPC.

We may update this privacy policy from time to time. The current version is always published on this page, and we will clearly signal any significant change to the way we handle your information.