Your information stays confidential

1. Who is responsible

Denmyd is the responsible party for information it uses to run its website, handle enquiries and administer its customer and supplier relationships. This notice is guided by the Protection of Personal Information Act 4 of 2013 (POPIA).

Where Imatri processes patient or practice records on behalf of a healthcare practice, the practice generally determines the purpose of processing and Denmyd acts as its operator under the service agreement. The practice’s own privacy notice also applies. Our responsibilities depend on the actual activity, rather than a blanket claim to control every patient record.

2. What we collect and why

• Enquiries and demos: your name, contact details and message so we can respond and provide requested assistance.
• Orders and services: relevant billing, delivery, practice, account and transaction details to supply products, administer subscriptions, provide support and process refunds.
• Technical information: information such as IP addresses, request details and security logs processed by hosting and service providers to deliver and protect the service.
• Practice and patient records: only where needed to provide an authorised service under the practice’s instructions and an applicable lawful basis.

We normally obtain information directly from you or an authorised representative, practice or payment provider. Required form fields are identified. Without necessary contact or transaction details, we may be unable to answer or fulfil a request. Please do not put patient records, identity documents, passwords or full card details into the public contact or demo form.

3. Lawful and limited use

Depending on the activity, processing is necessary to conclude or perform an agreement, meet a legal obligation, protect a legitimate interest permitted by POPIA, or fulfil a purpose to which you have validly consented. We do not treat visiting this website as blanket consent to every use of your information.

We do not use customer or patient information for unrelated advertising, data brokerage or training general-purpose AI models. Any new purpose must be lawful and compatible with the original purpose, or separately authorised where required. We do not add people who enquire to a marketing list without the permission required by law.

4. Confidentiality and necessary sharing

Personal information is confidential. Access is limited to people and providers who need it for the relevant service or legal purpose, subject to appropriate confidentiality and security obligations.

Recipients may include authorised Denmyd staff, hosting and email providers, delivery providers for physical orders, professional advisers, and payment providers such as Paystack where used. We provide only the information needed for their role. We may disclose information when legally required, or to protect rights and investigate fraud where the law permits it.

Payment details entered into Paystack are handled under Paystack’s privacy notice. Denmyd uses transaction references and payment status for reconciliation and support; our public enquiry forms do not request card details. Necessary service-provider sharing is not a sale of your information.

5. Patient and other sensitive information

Health information needs additional protection under POPIA. A practice must have the required authority to collect and use patient information, including the applicable justification for special personal information and children’s information. Denmyd processes it only for authorised service purposes or as required by law.

For access to a clinical record, contact the treating practice first. If you contact us, we will help identify the appropriate responsible party. We will not disclose another person’s records merely because a requester knows an account or patient reference.

6. Security and security incidents

We are committed to reasonable technical and organisational safeguards appropriate to the sensitivity and risks of the information, as required by POPIA. These include limiting access, protecting information in transit and reviewing service-provider arrangements. Our data protection policy describes our security responsibilities.

No online service can promise absolute security. Report a suspected exposure to our contact address without including the exposed records. Where POPIA requires notification of a security compromise, we will notify the Information Regulator and affected people as soon as reasonably possible after discovery, subject to lawful exceptions and permitted delays. Where we act as an operator, we will notify the responsible practice immediately on the grounds required by POPIA.

7. Retention and international processing

We retain information only for as long as needed for its stated purpose, a legal retention obligation, an authorised agreement or the lawful establishment or defence of a claim. Enquiry records, financial records and patient records may therefore have different retention periods. Ask us for the period or criteria applicable to your records.

When retention is no longer justified, information must be securely deleted, destroyed or de-identified. Practice-record retention and service termination must account for professional and legal duties; a request to close an account does not override those duties.

Service providers may process information outside South Africa. Where this occurs, transfers must meet section 72 of POPIA, for example through an adequate level of protection under applicable law or a binding agreement, or another permitted basis. We do not promise that all data is hosted in one country. You may ask about the providers and locations relevant to your service.

8. Cookies and external content

This website does not intentionally use advertising trackers or add optional analytics cookies. Hosting and browser functions may process technical information needed to serve pages. You can control cookies and local storage through your browser settings.

The contact page offers an optional OpenStreetMap map. It loads only when you choose to show it; then your browser connects to OpenStreetMap and shares technical information such as your IP address under its privacy policy. External links are governed by the destination’s policies.

If optional tracking is introduced, we will update this notice and obtain any permission required before it is enabled.

9. Your rights and how to contact us

Subject to POPIA, you may ask whether we hold personal information about you, request access, correct inaccurate information, request deletion where retention is no longer lawful, object to eligible processing, or withdraw consent for future consent-based processing. Withdrawal does not undo earlier lawful processing. Some records must be retained despite a deletion request.

Email enquiries@denmyd.com, marked “Privacy request — Information Officer”. Describe the request without including unnecessary sensitive information. We may verify identity and authority proportionately, explain any lawful fee or restriction, and respond within applicable legal timeframes. See access to information for formal record requests.

You may complain directly to the Information Regulator (South Africa) using its published complaints process. You do not have to obtain our permission first.

10. Changes to this notice

The date above identifies this version. We will publish updates here and provide further notice where a material change or the law requires it. A policy update does not itself give us permission to use existing information for an unrelated purpose.