Androlab Privacy Policy

Last updated: 1 September 2026

Preamble

Androlab (Pty) Ltd (“Androlab”, “us”, “we” and “our”) respects your privacy and takes the protection of your Personal Information seriously. Your use of our website signifies your agreement to this Privacy Policy (“Privacy Policy”), which forms part of the Terms and Conditions applicable to this website. We ask that you read the Terms and Conditions together with this Privacy Policy. Terms defined in the Terms and Conditions bear the meanings given to them there, unless the context clearly indicates otherwise.

Androlab is a telehealth service. We collect health information so that a registered medical practitioner can assess whether treatment is appropriate for you, and so that a registered pharmacy can dispense any medicine prescribed to you. This Privacy Policy explains what we collect, why we collect it, who we share it with, and what rights you have.

While all reasonable steps are taken to protect your Personal Information and your payment details, no system is completely secure and we do not guarantee the absolute security of any information you exchange with us.

Who we are and how to contact us

  • Responsible party: Androlab (Pty) Ltd, registration number 2022/336290/07
  • Registered address: 2 Arbroath Avenue, Hurlingham, Sandton, Gauteng, 2196
  • Information Officer: the head of Androlab (Pty) Ltd acts as Information Officer for the purposes of POPIA and can be reached at info@androlab.co.za
  • Email: info@androlab.co.za
  • Sales: +27 60 017 8139 Patient support: +27 65 619 5884
  • Support hours: Monday to Friday, 08:00 – 17:00 SAST (excluding public holidays)

Personal Information

“Personal Information” in this Privacy Policy means “personal information” as defined in the Protection of Personal Information Act 4 of 2013 (“POPIA”).

Information that cannot reasonably be linked to your identity (for example, aggregated visitor numbers or de-identified usage statistics) does not constitute Personal Information for the purposes of this Privacy Policy.

Androlab collects and stores certain Personal Information about its patients, customers, medical and allied healthcare professionals, and members of the public. The Personal Information we collect relates primarily to our products and services. If you wish to register for our services, we will ask you for your name and other personal details. You are free to decide whether or not to supply this information. However, if you choose not to provide it, this may affect our ability to provide our products and services to you. The Personal Information collected may vary depending on your particular interaction with Androlab, but will be limited to the information necessary to record and manage our interaction with you, or as permitted or required in terms of Applicable Law.

By providing Personal Information to us, and by continuing to engage with Androlab, you consent to your Personal Information being collected, used and disclosed in accordance with this Privacy Policy.

Collection of information

Each time you visit our website, our web servers automatically record the name of your browser and operating system, your IP address, your internet service provider, the website from which you accessed our website, the pages you visit and the date and time of your visit. Androlab’s servers record this information for security and analytics purposes. We may also evaluate anonymous or de-identified data sets for statistical purposes.

Personal Information may be collected through our website (for example, through online forms and the medical questionnaire), by telephone or WhatsApp enquiry, by email, or through an adverse reaction report.

The Personal Information we may collect about you includes:

  • your name and contact details, including your delivery address, telephone number and email address;
  • health information you provide in the online medical questionnaire, including your age, sex, medical history, current medication and relevant measurements;
  • laboratory and pathology results where you have completed blood testing as part of your assessment;
  • clinical information generated by the treating practitioner, including consultation notes and prescriptions;
  • your order, subscription and delivery history; and
  • the nature of any enquiry, complaint or adverse reaction report you submit.

Payment card details are collected and processed directly by our payment service provider and are not stored on Androlab’s systems.

If you contact us by telephone, your information may be recorded as a voice message where our staff are temporarily unavailable to answer the call and you choose to leave one. You can contact us using the details set out above or on our Contact page.

1. Use of information

By disclosing or submitting your Personal Information to us, you consent to us processing it for the purposes described in this Privacy Policy and as permitted in terms of Applicable Law. These purposes include, where applicable:

  • providing you with the medical assessment, treatment and programme for which you have signed up with Androlab;
  • maintaining a record of medical enquiries, product complaints and adverse events, and complying with our reporting obligations to the relevant regulatory authorities;
  • monitoring, assessing and improving our products and services;
  • providing further information regarding our products or services, including advice, that you have requested;
  • providing you with material about our activities and products that may be of interest to you, which you may opt out of receiving at any time;
  • notifying you of matters that we are required in terms of Applicable Law to notify you of, such as product recalls;
  • monitoring and reviewing our compliance with relevant legislation and codes of conduct; and
  • generating customer lists for the purposes of market research.

Health information is “special personal information” under section 26 of POPIA. We process it on the basis of your express consent under section 27(1)(a) of POPIA, and on the basis of section 32(1)(a) of POPIA, which permits the processing of information concerning a person’s health by medical professionals and healthcare institutions where such processing is necessary for the proper treatment and care of the patient. Everyone who processes this information on our behalf is bound by a duty of confidentiality.

For one or more of the purposes above, Androlab may disclose your Personal Information to:

  • a South African registered medical practitioner who assesses your suitability for treatment, monitors your health and issues any prescription;
  • a South African registered pharmacy that dispenses the medicine prescribed to you;
  • a pathology laboratory that processes any blood tests forming part of your assessment;
  • our delivery and courier partners, for the purposes of delivering your order;
  • our payment service provider, for the purposes of processing payment;
  • service providers that host our systems, manage our patient communications and provide analytics, subject to the safeguards described in section 13; and
  • regulatory authorities, within or outside South Africa, where required in terms of Applicable Law.

We will only use information that is not Personal Information, such as aggregated IP data, for security purposes, systems administration, to enforce compliance with our terms and conditions and to protect our products, services and website. De-identified information may also be used to comply with any reporting obligations required in terms of Applicable Law.

Our staff, partners and service providers who handle or obtain Personal Information are subject to appropriate and legally binding obligations of confidentiality and privacy in relation to your Personal Information.

You may opt out of any direct marketing from Androlab at any time: see section 14 below.

2. Cookies and similar technologies

Cookies are small data files placed on your device by a web server when you visit a website. Similar technologies include pixels, tags and tracking scripts.

We use:

  • strictly necessary cookies, which are required for the website, your account and the checkout to function;
  • analytics cookies, which help us understand how the website is used, including Google Analytics; and
  • advertising and measurement technologies, which allow us to measure the performance of our advertising and to show relevant advertising, including the Meta (Facebook and Instagram) pixel, the TikTok pixel and Hyros tracking.

Some of these technologies collect information that can identify you or your device, such as your IP address, device and browser identifiers, and, where you have given it to us, a hashed version of your email address or telephone number. Where that is the case, the information is Personal Information and is treated in accordance with this Privacy Policy.

We do not share your medical questionnaire answers, laboratory results, diagnosis, prescription details or the specific medicine you are prescribed with any advertising or analytics platform.

Most browsers accept cookies automatically. You can turn off the “save cookies” function, delete cookies already stored, or set your browser to notify you when cookies are transmitted. Blocking strictly necessary cookies may prevent parts of the website from working.

3. Session IDs

Session IDs allow us to recognise your browsing session as you move between pages on our website. They are used to keep you signed in and to keep the contents of your basket, and they expire when your session ends.

4. Security

Androlab uses a range of technical and organisational measures to secure the data it holds. The security of our systems is reviewed regularly to protect against damage, loss and unauthorised access, and our security precautions are updated in line with technical developments. Unfortunately, no transmission of data over the internet can be guaranteed to be completely secure, so we cannot give an absolute assurance that the information you provide to us will be secure at all times. To the extent permitted in terms of Applicable Law, Androlab will not be responsible for unauthorised access to your Personal Information, and any liability that might otherwise have attached to Androlab as a result of such unauthorised access is excluded. Nothing in this section limits our obligations under section 15 below.

5. Safe information handling

All sensitive information you send us is encrypted in transit using industry-standard Transport Layer Security (TLS). Card payments are processed by our payment service provider, Paystack, on payment infrastructure that complies with the Payment Card Industry Data Security Standard (PCI-DSS). Androlab does not store your full card number on its systems.

6. Safe information storage

We secure our servers using current software and networking technologies to prevent unauthorised access to our systems, and access to patient records is restricted to authorised personnel.

7. Security practices

We follow recognised security practices, including:

  • using only third parties that satisfy our security standards; and
  • applying network security measures such as firewalls, encrypted connections and access controls.

8. Access, correction and deletion rights

You have the right, in terms of POPIA, to:

  • obtain confirmation of, and access to, the Personal Information Androlab holds about you;
  • request the correction, destruction or deletion of your Personal Information held by Androlab; and
  • object, on reasonable grounds, to the processing of your Personal Information.

To exercise any of these rights, contact our Information Officer at info@androlab.co.za. We may ask you to verify your identity before acting on a request. Requests are handled in the form and manner prescribed by POPIA and, where applicable, in accordance with our PAIA Manual.

If you wish to stop receiving communications from us and have your Personal Information deleted, please let us know and we will take all reasonable steps to do so, unless we are required to retain the information for legal, regulatory or clinical record-keeping reasons (see section 9 below).

If you have any concerns about how your Personal Information has been collected, used or disclosed, you can contact us using the details in this Privacy Policy and we will do our best to address them.

Personal Information that is obsolete and no longer required will be destroyed, except where it is retained for statistical or research purposes, in which case it will be de-identified.

If you are not satisfied with the way Androlab has handled your Personal Information, you have the right to lodge a complaint with the Information Regulator of South Africa at POPIAComplaints@inforegulator.org.za. Further details on how to lodge a complaint are available at https://inforegulator.org.za.

9. Patient health records and retention

Androlab holds patient health information in connection with the telehealth services provided through its platform. This includes medical questionnaires, laboratory results, prescription records, consultation notes and related clinical correspondence. Androlab’s services are available only to patients who are 18 years of age or older.

Patient health records are retained for a minimum period of six years from the date of the last entry in the record, in line with the National Health Act 61 of 2003 and the Health Professions Council of South Africa’s guidelines on the keeping of patient records. Where a longer retention period is required by law, records are retained for that longer period.

On expiry of the applicable retention period, patient health records and associated health information are securely destroyed or permanently de-identified, unless:

  • retention is required for ongoing legal, regulatory or compliance purposes;
  • the patient has an active, ongoing treatment relationship with Androlab; or
  • Androlab is required by law to retain the information for a longer period.

All patient health information is stored and processed in compliance with POPIA and the National Health Act 61 of 2003. Access to patient health records is restricted to authorised clinical and administrative personnel, each of whom is bound by a duty of confidentiality. Patients may request access to their records, or request the correction or deletion of their information, in accordance with section 8 of this Privacy Policy, subject to the minimum retention obligations set out in this section.

10. Hyperlinks to other websites

Third party operators of websites that may be accessed via hyperlinks from our website may gather and store Personal Information as soon as you access their websites. We do not accept liability for those third party operators in the event that your Personal Information is collected, used, disclosed or shared by them. We encourage you to read their privacy policies separately.

11. Amendments to this Privacy Policy

Androlab may, in its sole discretion, change or replace this Privacy Policy at any time. The date at the top of this page shows when it was last updated. It is your responsibility to check this Privacy Policy from time to time and to satisfy yourself that you are comfortable with any changes. If you are not, you must not place any further orders on, or otherwise use, the website.

Any change applies only to your use of this website after the change is displayed on the website. If you use the website after an amended Privacy Policy has been displayed, you will be deemed to have accepted the change.

12. Legal

All provisions of this Privacy Policy are, notwithstanding the manner in which they have been grouped together or linked grammatically, severable from each other. Any provision of this Privacy Policy which is or becomes unenforceable, whether due to voidness, invalidity, illegality, unlawfulness or for any other reason, will, only to the extent that it is unenforceable, be treated as pro non scripto, and the remaining provisions of this Privacy Policy will remain of full force and effect. You agree that the intention is that this Privacy Policy would have been agreed to without such unenforceable provisions had that unenforceability been known at the time you agreed to it.

13. Transfers outside South Africa

Androlab treats only patients resident in South Africa, and our website and its database are hosted in South Africa on Cloudways infrastructure. Some of the service providers that support the service nevertheless store or process information outside the Republic of South Africa.

Where Personal Information is transferred outside South Africa, we do so only in accordance with section 72 of POPIA, that is, where the recipient is subject to a law, binding corporate rules or a binding agreement that provides a level of protection substantially similar to POPIA, where the transfer is necessary for the performance of our contract with you, or where you have consented to the transfer.

Held in South Africa:

  • our website, your account, and your order and subscription records, on Cloudways infrastructure located in South Africa.

Processed outside South Africa:

  • our patient communication and customer relationship platform, GoHighLevel, which holds your contact details, your message history with us and your medical questionnaire answers;
  • our payment service provider, Paystack, which processes payment information; and
  • website analytics and advertising measurement providers, including Google, Meta, TikTok and Hyros, which process the technical identifiers described in section 2.

Because your medical questionnaire answers are held on our customer relationship platform, health information is transferred outside South Africa. We rely on section 72(1)(b) of POPIA for that transfer: the provider is bound by a written agreement with Androlab to protect the information on terms that give effect to the principles in POPIA, and processes it only on our instructions and for the purposes set out in this Privacy Policy. It is not used for advertising, and it is not shared with any advertising or analytics platform.

These providers may in turn engage their own sub-processors, for example for hosting, messaging or support. Each maintains a current list of those sub-processors, and we can provide the relevant list on request.

14. Direct marketing

We will only send you direct marketing by electronic communication where you are an existing customer whose contact details we obtained in the course of a sale and the marketing relates to similar products or services, or where you have consented to receiving it, as permitted by section 69 of POPIA.

Every marketing message includes a way to opt out. You may also opt out at any time by emailing info@androlab.co.za or by replying “STOP” to a marketing SMS or WhatsApp message. Opting out of marketing does not stop transactional, clinical, delivery or account messages, which are necessary for us to provide the service to you.

15. Notification of a security compromise

If there are reasonable grounds to believe that your Personal Information has been accessed or acquired by an unauthorised person, we will notify the Information Regulator and you as soon as reasonably possible after becoming aware of the compromise, in accordance with section 22 of POPIA.

Contact us

Questions about this Privacy Policy, or about the Personal Information we hold about you, can be sent to our Information Officer at info@androlab.co.za, or to Androlab (Pty) Ltd, 2 Arbroath Avenue, Hurlingham, Sandton, Gauteng, 2196.