Privacy Policy

1. INTRODUCTION

This Privacy Policy sets out how ALPHA PACK CANNA CLUB (PTY) LTD (“we”, “us”, or “our”), a SAHPRA-licensed entity, processes personal and health information. As a provider of health products/services, we are committed to the highest standards of data integrity and patient confidentiality required by the Protection of Personal Information Act (POPIA) and the Medicines and Related Substances Act (Act 101 of 1965).

2. SPECIAL PERSONAL INFORMATION (MEDICAL DATA)

We process information concerning your health and medical history, classified as “Special Personal Information” under Section 26 of POPIA.

  • Consent: We process this data only with your explicit, informed consent or where permitted by Section 32 for medical professionals and health facilities.

  • Purpose: This information is collected solely for [e.g., product safety monitoring, clinical oversight, or fulfilling health-related orders].

3. THIRD-PARTY OPERATORS (SECTION 21 COMPLIANCE)

In terms of Section 21, we engage with third-party “Operators” (e.g., medical couriers, laboratories, or secure data hosting).

  • Binding Agreements: All Operators are subject to a written contract requiring them to maintain medical-grade security.

  • Breach Notification: Under Section 21(2), any Operator who suspects a data breach must notify us immediately. Due to the sensitive nature of SAHPRA-regulated data, we treat “immediate” as within [e.g., 24 hours].

4. REGULATORY REPORTING & VIGILANCE

As a SAHPRA-registered entity, we have legal obligations that may supersede certain data deletion requests:

  • Pharmacovigilance: We are legally required to record and report adverse events to SAHPRA. This data may be retained for the lifetime of the product as required by law.

  • Traceability: In line with SAHPRA Traceability Guidelines, we maintain records of product distribution to ensure safety and recall capability.

5. DATA RETENTION & DE-IDENTIFICATION (SECTION 24)

  • Retention: We retain medical records for the minimum period required by the National Health Act and SAHPRA regulations (usually 5 to 10 years, depending on the record type).

  • De-identification: You may request that your data be de-identified. We will scrub all personal identifiers so the remaining data can no longer be linked to you. However, the clinical data may be kept in an anonymized format for regulatory safety reporting.

6. SECURITY SAFEGUARDS

We implement “medical-grade” security measures, including:

  • End-to-end encryption for health data.

  • Strict access controls (only authorized medical/compliance staff).

  • Regular independent security audits.

7. INFORMATION OFFICER & COMPLIANCE

For any queries regarding your health data or to submit a Section 24 Request for De-identification, contact our Information Officer:

  • Name: Lonwabo Nyhonyha

  • SAHPRA License No: S2100014148

  • Email:

  • Physical Address:

    34 PETER PLACE BRYANSTON  EXT7

    JOHANNESBURG

    GAUTENG

    2060