PRIVACY POLICY
KORU WELLNESS Registration Number: 2024/547830/07
Effective Date: January 06, 2026
This Privacy Policy describes how Koru Wellness (Pty) Ltd (“Company”, “we”, “us”, or “our”) collects, uses, and protects your personal information when you use our mental health platform and services (“Service”).
1. INFORMATION WE COLLECT
1.1 Personal Information We collect information that identifies you personally, including:
- Name, email address, phone number
- Date of birth and gender
- Location information (for service delivery and emergency purposes)
- Payment and billing information
- Emergency contact details
1.2 Health Information We collect sensitive personal information related to your mental health, including:
- Mental health assessments and screening responses
- Mood tracking data and wellness check-ins
- Goals, progress notes, and self-reported symptoms
- Communication with counselors and therapists
- Crisis intervention records
1.3 Technical Information We automatically collect technical data, including:
- WhatsApp message metadata (delivery status, timestamps)
- App usage analytics and interaction patterns
- Device information and IP addresses
- Log files and error reports
1.4 Communication Data We collect communications you have with us, including:
- Customer support inquiries
- Feedback and survey responses
- Messages sent through our platforms
2. HOW WE USE YOUR INFORMATION
2.1 Service Provision We use your information to:
- Deliver personalized mental health content via WhatsApp and our app
- Connect you with appropriate mental health professionals
- Track your progress and adapt our recommendations
- Provide crisis intervention and emergency support
- Process payments and manage subscriptions
2.2 Communication We use your information to:
- Send you daily wellness messages and mental health tips
- Notify you of appointment reminders and platform updates
- Respond to your inquiries and provide customer support
- Communicate important service changes or safety information
2.3 Improvement and Analytics We use aggregated, de-identified data to:
- Improve our mental health tools and content
- Conduct research to advance mental health outcomes
- Analyze platform usage patterns and effectiveness
- Develop new features and services
3. INFORMATION SHARING
3.1 Mental Health Professionals We share necessary information with licensed counselors and psychologists to facilitate your care, including:
- Your assessment results and progress data
- Communication history and session notes
- Emergency contact information when required
3.2 Corporate Clients For workplace wellness programs, we may share:
- Aggregated, anonymized wellness metrics with employers
- Individual crisis intervention information only when legally required
- We never share individual mental health details with employers
3.3 Legal Requirements We may disclose information when:
- Required by South African law or valid legal process
- Necessary to protect someone from imminent harm
- Required for child protection purposes
- Needed to prevent suicide or serious self-harm
3.4 Service Providers We share limited information with trusted partners who help deliver our services:
- WhatsApp (for message delivery)
- Cloud hosting providers (with strict data protection agreements)
- Payment processors (for billing purposes)
- Emergency services (only in crisis situations)
4. DATA PROTECTION AND SECURITY
4.1 Security Measures We implement comprehensive security measures including:
- End-to-end encryption for all communications
- Secure data storage with access controls
- Regular security audits and penetration testing
- Staff training on data protection and confidentiality
4.2 Access Controls
- Only authorized personnel have access to personal information
- All access is logged and monitored
- Mental health professionals access only their assigned clients’ data
- Administrative staff have limited access based on job requirements
4.3 Data Retention
- Active user data is retained while your account is active
- Mental health records are retained for 7 years after account closure (as required by professional guidelines)
- Payment information is retained for 5 years for audit purposes
- WhatsApp message logs are retained for 2 years
5. YOUR RIGHTS UNDER POPIA
Under the Protection of Personal Information Act, you have the right to:
5.1 Access
- Request copies of your personal information
- Receive information about how your data is processed
- Obtain details about who has access to your information
5.2 Correction
- Request correction of inaccurate personal information
- Update your contact details and preferences
- Amend your mental health information with professional guidance
5.3 Deletion
- Request deletion of your personal information
- Close your account and have data removed (subject to legal retention requirements)
- Withdraw consent for data processing (where legally permitted)
5.4 Portability
- Request your data in a commonly used format
- Transfer your information to another service provider
- Receive copies of your mental health records
5.5 Objection
- Object to direct marketing communications
- Withdraw consent for data processing (where consent is the legal basis)
- Request restriction of processing in certain circumstances
6. SPECIAL PROTECTIONS FOR MINORS
6.1 Users Under 18
- Parental consent is required for users under 18
- Parents have access to their minor child’s account information
- Special protections apply to prevent unauthorized disclosure
- Crisis intervention procedures include parent/guardian notification
6.2 School Programs
- Student data is protected with enhanced privacy measures
- Parents are notified of participation in school wellness programs
- Individual student information is never shared with school administrators
- Anonymous aggregate data may be provided to schools for program evaluation
7. INTERNATIONAL DATA TRANSFERS
If we transfer your data outside South Africa:
- We ensure adequate protection through approved transfer mechanisms
- We comply with POPIA requirements for international transfers
- You will be notified of any transfers to countries without adequate protection
- Your consent will be obtained where required by law
8. COOKIES AND TRACKING
8.1 Website Cookies Our website uses cookies to:
- Remember your login preferences
- Analyze website usage patterns
- Provide personalized content
- Ensure website security
8.2 Mobile App Analytics Our mobile app collects:
- Usage statistics and feature engagement
- Performance data and error reports
- Anonymized behavioral patterns
- Device compatibility information
You can disable cookies through your browser settings, though this may limit website functionality.
9. THIRD-PARTY SERVICES
9.1 WhatsApp
- Messages are subject to WhatsApp’s privacy policy
- We do not store message content on our servers
- Delivery metadata is collected for service improvement
- End-to-end encryption protects message content
9.2 Payment Processors
- Credit card information is processed by PCI-compliant payment providers
- We do not store full payment card details
- Transaction records are kept for billing and fraud prevention
10. DATA BREACHES
In the event of a data breach:
- We will notify affected users within 72 hours
- The Information Regulator will be notified as required by POPIA
- We will provide details about the breach and steps being taken
- Affected individuals will receive guidance on protective measures
11. CHANGES TO THIS POLICY
We may update this Privacy Policy:
- Users will be notified of material changes via email or platform notification
- Continued use after changes constitutes acceptance
- Previous versions will be available upon request
- We will obtain consent for changes that expand data use
13. CONSENT
By using our Service, you consent to:
- The collection and use of your information as described in this policy
- The sharing of information with mental health professionals for care purposes
- The use of aggregated, anonymized data for research and service improvement
- International transfers where necessary for service provision
14. WITHDRAWAL OF CONSENT
You may withdraw consent at any time by:
- Contacting our Data Protection Officer
- Using account settings in our mobile app
- Sending a written request to privacy@koruhealth.com
Note: Withdrawal of consent may limit our ability to provide services and may not affect processing already completed.
Last Updated: January 06, 2026
