Phila Privacy Policy

Introduction

PHILA WEALTH (PTY) LTD ("we", "us", "our") is a South African healthcare technology company committed to protecting the privacy of every South African. This Privacy Policy explains how we collect, use, disclose, and safeguard your personal information when you use Phila, in compliance with the Protection of Personal Information Act (POPIA) and other applicable South African data protection laws.

By using our services, you acknowledge that you have read and understood this Privacy Policy.

We are transparent about how we handle your health data and personal information to ensure you can trust us with your healthcare.

1. Information We Collect

• We collect information necessary to provide healthcare services and comply with legal requirements:
• • Health Information: vital signs, medical history, consultation notes
• • Personal Information: name, contact details, demographics
• • Device Information: IP address, device type, app usage analytics
• • Transaction Information: payment details (processed securely)

2. The Face Scan and Face Data

• Phila offers an optional contactless vital-signs scan that uses your device's front camera. This section explains exactly what happens to your face during that scan.
• • What we collect: no facial images. The camera feed is analysed in real time to measure colour changes in your skin caused by your pulse. We do not collect, store, or transmit photographs, video, facial scans, faceprints, or any facial-recognition template.
• • What is saved: only the resulting numerical health measurements, such as heart rate and breathing rate, together with the time of the scan and a quality score. Nothing that could reconstruct your face is retained.
• • We do not use the camera to identify you. The scan measures physiology; it does not recognise, match, or verify who you are, and it is never used for authentication.
• • Processing: the camera feed is processed by our measurement technology provider under a data processing agreement. Frames are analysed for the duration of the scan only and are discarded as the scan runs. They are not retained after the scan ends.
• • Sharing: no facial images or camera data are shared with anyone, including advertisers and data brokers. The resulting health measurements form part of your health record and are shared only as described in Third-Party Sharing below.
• • Retention: because no facial images are stored, there is nothing to retain or delete. The health measurements derived from a scan are kept as part of your health record, and you can request their deletion as set out in Data Deletion below.
• • Your choice: the scan is optional. You can use consultations and the rest of the service without ever using it, and you can withdraw camera permission at any time in your device settings.

3. How We Use Your Information

• Your information enables us to:
• • Deliver healthcare consultations and services
• • Process payments and manage subscriptions
• • Comply with South African healthcare regulations
• • Improve service quality and user experience
• • Communicate important health and service updates
• • Prevent fraud and ensure system security

4. Data Security & Protection

• We implement enterprise-grade security measures:
• • AES-256 encryption for all data transmission and storage
• • ISO 27001 information security management
• • Regular security audits and penetration testing
• • Strict access controls and role-based permissions
• • POPIA compliance and data protection frameworks

5. Your Rights Under POPIA

• You have the right to:
• • Access your personal information
• • Request correction of inaccurate data
• • Request deletion of your information
• • Object to processing of your data
• • Request restriction of processing
• • Contact our Information Officer: info@phila.life

6. Data Retention

• We retain your data for as long as necessary to provide services and comply with legal obligations. Health records are retained in accordance with South African healthcare standards. You may request deletion subject to legal requirements.

7. Third-Party Sharing

• We share information only when necessary:
• • Healthcare practitioners involved in your care
• • Payment processors (securely, with encryption)
• • Regulatory bodies (as required by law)
• • Service providers under strict data processing agreements
• We never sell your data to third parties.

8. International Transfers

• Any international data transfers comply with POPIA requirements and include appropriate safeguards such as Standard Contractual Clauses.

9. Cookies & Tracking

• We use cookies to enhance your experience. You can control cookie preferences in your browser settings. We do not track you for marketing purposes without consent.

10. Policy Updates

• This policy was last updated on 2026-08-11. We reserve the right to update it. Continued use of Phila after updates constitutes acceptance of the new policy.

11. Contact Us

• For privacy inquiries or concerns:
• Email: help@phila.life
• Information Officer: info@phila.life

12. Data Deletion

• You have the right to request deletion of your personal data at any time.
• To request deletion, visit our data deletion page at /delete-data on our website.
• After submitting your request, you will receive a confirmation email within a few minutes.
• Click the link in the email to confirm and complete the deletion process.
• Once confirmed, all your data will be permanently deleted within 30 days.
• This includes: account information, patient profile, payment methods, health records, and consultation history.
• Note: Some data may be retained if required by South African healthcare regulations (HPCSA requirements).
• For questions about data deletion, contact our support team.