POPIA notice
This notice explains how Dermal Health Science (Pty) Ltd processes your personal information under the Protection of Personal Information Act 4 of 2013 (POPIA). It sits alongside our privacy policy, which describes our practices generally. Where the two differ on a point of South African law, this notice governs.
Who is responsible
The responsible party is:
Dermal Health Science (Pty) Ltd.
Registration: 2017/269563/07
Menlyn Square Office Park, 134 Aramist Avenue, Newlands, Pretoria, Gauteng, 0181, South Africa
Telephone: +27 (0) 12 004 1791
Email info@dermalhealth.co.za
Information Officer: Trinette Eckard — trinette@dermalhealth.co.za
Under POPIA, the Information Officer of a private body is by default its head. This appointment must be registered with the Information Regulator, and an Information Officer may take up their duties only once that registration is in place.
The health information you give us
This is the part of this notice that matters most, so we have put it first.
When you complete the Dermal Diagnosis assessment, you tell us about your skin: conditions such as acne, rosacea, dermatitis and pigmentation, your reactions and allergies, whether you are pregnant, and in some cases your age and medication. Under section 26 of POPIA, information about your health is special personal information, and processing it is prohibited unless a specific exclusion applies.
We rely on your consent under section 27(1)(a). That means:
- We ask for the assessment answers only when you choose to take the assessment. You are never required to complete it in order to buy from us.
- We tell you before you start what the assessment is for.
- You may withdraw your consent at any time, and we will delete the assessment record. Withdrawing does not affect anything lawfully done before you withdrew, and it does not affect an order you have already placed.
Two things we deliberately do not do with it. We do not use your assessment answers to target advertising to you, on this site or anywhere else. And we do not put clinical answers into the address bar of your results page — your result reaches you through a private link that carries a reference, not your health information.
What else we process, and why
| Information | Why we process it | Our lawful basis |
|---|---|---|
| Name, email, delivery address, phone number | To take, fulfill and deliver your order and to contact you about it | Performance of your contract with us (s11(1)(b)) |
| Payment details | To take payment. Card details are handled by our payment providers and are never stored by us | Performance of contract; legal obligation |
| Order and returns history | To handle returns, refunds and adverse reaction reports, and to meet our record-keeping duties | Legal obligation (s11(1)(c)); our legitimate interests (s11(1)(f)) |
| Dermal Diagnosis answers and the resulting skin profile | To produce your skin profile and regimen, and to improve the assessment | Your consent (s27(1)(a)) |
| Adverse reaction reports | To help you, to trace a batch, and to notice a pattern across reports | Consent; our legitimate interests in product safety |
| Reviews you submit | To publish them and to show aggregate ratings | Your consent |
| Marketing email preferences | To send you what you asked for, and to stop when you ask us to | Consent, or the existing-customer basis in s69(3) |
| Website usage and device data | To keep the site working, measure how it is used and reduce fraud | Our legitimate interests; consent for non-essential cookies |
| Practitioner and stockist details | To manage our dispensing relationships | Performance of contract |
Direct marketing
We only send marketing emails to people who asked for it, or to customers about products similar to ones they have bought, as section 69(3) allows. Every message carries a one-click unsubscribe, and we act on it immediately. We do not sell your details to anyone, and we do not use your skin assessment to decide what marketing to send you.
Who processes your information for us
We use operators — service providers who process personal information on our instruction, under contract, and who may not use it for their own purposes:
- Shopify — our store, checkout and customer records
- Payment providers and banks — to take payment
- Couriers — to deliver your order; they receive your name, address and phone number only
- Klaviyo — email and marketing communications
- Cloudflare — hosting for our content and assessment services
- Judge.me — collecting and publishing product reviews
- Jotform — form capture for parts of the assessment
- Analytics and advertising platforms — as described in our cookie policy, and only where you have accepted non-essential cookies
- Dispensing practices — where you asked to be referred to one, or bought through one
We also disclose information where the law requires it, or to establish, exercise or defend a legal claim.
Information sent outside South Africa
Several of the operators above process information outside South Africa, including in the European Union and the United States. Section 72 permits this where the recipient is subject to a law, binding agreement or corporate rule that provides an adequate level of protection, or where you consent. We rely on the contractual protections in our agreements with these providers, including standard data protection terms.
How long we keep it
- Order, tax and financial records — five years from the end of the relevant tax period, as South African tax and companies legislation requires.
- Assessment records and skin profiles — kept while you have an account or a live regimen with us, because the value of the record is being able to compare where your skin was against where it is now. You may ask us to delete it at any time.
- Adverse reaction reports — kept as a product safety record.
- Marketing preferences — kept until you unsubscribe, and then we keep the fact that you unsubscribed so that we do not contact you again.
When a retention period ends, we delete or de-identify the information.
How we protect it
Section 19 requires appropriate, reasonable technical and organizational measures. Ours include encryption in transit, access controls limiting who on our team can see what, separation of the assessment record from the public web address that reaches it, and contractual security obligations on our operators. If a security compromise affects your personal information, we will notify you and the Information Regulator as section 22 requires.
Your rights
You may:
- ask what personal information we hold about you, and be given a copy;
- ask us to correct or delete information that is inaccurate, irrelevant, excessive, out of date, incomplete, misleading or obtained unlawfully;
- object to processing that relies on legitimate interests;
- withdraw consent, including consent to the health information described above;
- opt out of direct marketing at any time;
- complain to the Information Regulator.
To exercise any of these, email info@dermalhealth.co.za. A request for access is made on Form 2 under PAIA — our PAIA manual explains how, and we will help you complete it if that is easier. We will respond within 30 days.
Complaints to the Regulator
If you are not satisfied with how we have handled your information, you may complain directly to:
The Information Regulator (South Africa)
Woodmead North Office Park, 54 Maxwell Drive, Woodmead, Johannesburg, 2191
Telephone 010 023 5200 · Toll free 0800 017 160
POPIA complaints: POPIAComplaints@inforegulator.org.za
General inquiries: enquiries@inforegulator.org.za
inforegulator.org.za
You are welcome to raise it with us first, but you do not have to.
Changes
We will update this notice when our processing changes. The date at the top of the page tells you when it last changed.