Privacy Notice

Aletia Index is an index of medical devices, not of people. Almost everything we publish comes from public regulatory registers and concerns products rather than individuals. This notice covers the narrow set of circumstances in which we do hold personal information — principally when someone claims a manufacturer listing or contacts us — and explains what we do with it.

It is written to meet section 18 of South Africa's Protection of Personal Information Act 4 of 2013 (POPIA).

The responsible party is Aletia Health (Pty) Ltd (registration number 2026/435000/07), of Plot 60, Kalkheuvel West, Lanseria, 1739, South Africa.

Our Information Officer is A Maidment. Any question, request or complaint about personal information should go to privacy@aletia-index.com.

We collect personal information in three situations, and no others.

• Claiming a listing. If you ask to take ownership of a manufacturer's entry, we collect your name, email address, your role at the organisation, and the company website you give us. We use these to verify that you are entitled to speak for that manufacturer, to send you a verification link, and to attach the claim to the listing.
• Holding an account. Completing a claim creates an account so you can manage the listing. We store your email address and an encrypted password.
• Using the site at all. Our hosting and database providers keep ordinary server logs — IP address, browser type, pages requested, timestamps — for security and diagnostics. We do not run analytics, advertising or tracking cookies. The only cookie we set is the session cookie that keeps you signed in.

Where a public regulatory register names an individual — for instance a manufacturer contact on a registration record — that information reaches us from the register, not from the person, and we publish only what the register itself publishes.

Supplying personal information is entirely voluntary. You can search, read and use the whole index without giving us anything. The only consequence of withholding it is that we cannot verify a claim, so the listing stays unclaimed and you cannot hold an account. No law obliges us to collect any of it.

We do not sell personal information, and we do not share it for marketing. Three service providers process it on our behalf, under contract and on our instructions:

• Supabase — database and authentication
• Vercel — website hosting
• Resend — sending the verification and notification emails

All three operate outside South Africa, so your information is transferred across borders. POPIA permits this where the receiving party is bound by rules that give comparable protection; each of these providers commits contractually to standards of that kind. We will otherwise disclose personal information only where the law requires it.

Claim requests are kept while the claim is being decided and for a reasonable period afterwards, so that we have a record of who was granted control of a listing and on what basis. Account details are kept while the account is open. Ask us to close your account and we will delete it, other than anything we must retain to show that a listing was properly claimed. Server logs are kept only as long as our providers retain them for security purposes.

Under POPIA you may:

• ask what personal information we hold about you, and receive a copy;
• ask us to correct or delete information that is wrong, misleading, excessive or out of date;
• object to our processing your information, on reasonable grounds;
• withdraw any consent you have given, without affecting what was lawful beforehand.

Write to privacy@aletia-index.com and we will respond as promptly as we reasonably can.

If you are not satisfied with how we have handled a request, you may complain to the Information Regulator (South Africa) — JD House, 27 Stiemens Street, Braamfontein, Johannesburg 2001; inforegulator.org.za.

Personal information is held in an access-controlled database with row-level security enabled, and administrative actions are recorded in an audit log. Passwords are stored as salted hashes by our authentication provider and are never visible to us. No system is perfect; if a breach ever affects your personal information, we will notify you and the Information Regulator as POPIA requires.

We will update this notice when what we do changes, and the date at the top will move. Material changes affecting people who hold accounts will be notified by email.