Privacy Policy
Website and Workforce Health Intelligence Platform
11 September 2026
11 September 2026
1.1
This Privacy Policy explains how H360 WHIP collects, uses, stores, protects and discloses personal information through h360whip.com, related digital services and the H360 WHIP workforce health intelligence platform. It also explains the choices and rights available to website visitors, employer customers, authorised users, employees and other individuals whose information may be processed.
Health information is sensitive. H360 WHIP is designed so that employer-facing workforce insights are provided in aggregated or de-identified form, except where a different disclosure is lawfully required, expressly authorised by the individual, or clearly described in a separate written notice or agreement.
1. Scope and status of this Policy
This Policy applies to personal information processed in connection with the H360 WHIP website, contact and demonstration requests, customer onboarding, user accounts, support, billing and the workforce health intelligence platform, including screening questionnaires, risk indicators, workforce analytics and referral-related functions made available by H360 WHIP.
This Policy should be read with any employee participation notice, consent wording, customer agreement, data processing agreement, cookie notice and other service-specific notice presented at the point of collection. If a service-specific notice gives more detail about a particular processing activity, that notice applies to that activity. No provision of this Policy excludes or limits any right or remedy that cannot lawfully be excluded or limited.
This Policy does not govern an employer customer’s independent collection or use of personal information outside the H360 WHIP services, nor the privacy practices of third-party websites, healthcare providers, employee assistance programmes, insurers or other services that users may choose to access.
2. Who is responsible for personal information
“H360 WHIP”, “H360”, “we”, “us” and “our” refer to the operator of the H360 WHIP business and services accessible at https://h360whip.com/. Our principal contact address is The Pivot, Montecasino, Fourways, Sandton, 2055, South Africa. We can be contacted at info@h360whip.com or +27 (0) 10 085 0058.
For website enquiries, marketing, direct customer relationships, our own account administration and other purposes determined by H360, H360 acts as the “responsible party” under the Protection of Personal Information Act 4 of 2013 (“POPIA”), or as the controller under equivalent privacy legislation where applicable.
Where an employer or other customer determines why and how employee information will be processed and instructs H360 to process that information through the platform, the customer ordinarily acts as the responsible party and H360 acts as its operator. The customer remains responsible for establishing a lawful basis, providing required workplace notices, managing participation fairly and complying with employment, labour, equality and privacy laws. H360 processes such information only on documented instructions, subject to the customer agreement and applicable law.
H360 may act as a responsible party for limited platform-related processing where H360 independently determines the purpose and means, for example security monitoring, legal compliance, service integrity, fraud prevention, direct support, and the creation and use of lawfully de-identified statistical information. The allocation of roles in a signed agreement prevails to the extent it is more specific and lawful.
3. Our privacy commitments
H360 applies the conditions for lawful processing required by POPIA, including accountability, processing limitation, purpose specification, further-processing limitation, information quality, openness, security safeguards and data-subject participation. In practical terms, we seek to:
- collect personal information for specific, explicit and lawful purposes;
- limit collection to information that is adequate, relevant and not excessive;
- use an appropriate lawful justification for each processing activity;
- apply additional protection to health and other special personal information;
- keep information accurate where it is used to make or support decisions;
- retain identifiable information only for as long as it is lawfully required or reasonably necessary;
- restrict access according to role and legitimate need; and
- provide reasonable ways for individuals to exercise their rights.
4. Personal information we may process
4.1 Website and business information
Depending on how a person interacts with us, we may process names, work titles, employer or organisation details, email addresses, telephone numbers, physical or postal addresses, enquiry details, correspondence, demonstration requests, meeting information, account credentials, user permissions, contractual records, support records, billing details, payment status and transaction records. Payment card data may be collected and processed directly by an authorised payment service provider rather than stored by H360.
4.2 Platform identity and workforce information
To administer access and produce relevant workforce analysis, the platform may process an employee or participant identifier, age band or date of birth where justified, sex or gender where lawfully required and voluntarily supplied, work location, province, branch, department, job or work-environment category, shift pattern and other organisational attributes. Wherever reasonably practicable, direct identifiers are replaced with pseudonymous identifiers and separated from screening responses.
4.3 Health and wellness information
The platform may process information supplied in screening questionnaires about symptoms, diagnosed or suspected conditions, medication-related context, lifestyle and risk factors, mental health, stress, burnout, sleep, fatigue, musculoskeletal concerns, respiratory health, infectious and non-infectious disease indicators, disability or functional limitations, and other information relevant to health screening. Health information is “special personal information” under POPIA and receives enhanced protection.
H360 WHIP provides screening and risk information; it does not replace a consultation, clinical examination, diagnosis, treatment plan or emergency service. Users should obtain advice from a qualified healthcare professional and use the appropriate emergency services where urgent assistance is required.
4.4 Derived data and analytics
We may generate screening outcomes, referral indicators, risk bands, health risk scores, workforce health scores, trend data, estimated productivity or absence indicators, and similar analytical outputs. These are probabilistic or rules-based indicators derived from the information available at the time. They may be incomplete or inaccurate if source information is incomplete, inaccurate, outdated or not representative.
4.5 Device, usage and cookie information
When a person visits or uses our services, we may receive IP address, browser and device type, operating system, referring page, pages viewed, dates and times, language, approximate location derived from IP address, session identifiers, error logs, security events and cookie or similar technology identifiers. We use this information for essential operation, security, diagnostics, performance and, where lawfully enabled, analytics or marketing.
4.6 De-identified and aggregated information
We may create information that has been aggregated or de-identified so that it cannot reasonably be linked to an identifiable individual. We may use such information for workforce dashboards, benchmarking, service improvement, statistical analysis, research, reporting and planning. We do not attempt to re-identify lawfully de-identified information, and we require recipients not to do so. If information can reasonably be re-identified, we continue to treat it as personal information.
5 How we collect personal information
We may collect personal information:
- directly from a person who completes a form, creates an account, completes a screening, contacts support, communicates with us or uses the services;
- from an employer or other customer that provides limited workforce, account or eligibility information under a lawful mandate;
- from authorised representatives, resellers or implementation partners;
- automatically from browsers, devices, systems and security tools;
- from service providers involved in hosting, authentication, communications, payments, customer support or analytics; and
- from public sources, where collection and use are lawful and reasonable.
Where information is collected from a source other than the individual, H360 or the relevant customer will provide the information required by law unless a lawful exception applies.
6 Why we process personal information
We process personal information only where there is an applicable lawful justification, which may include informed consent, performance of a contract, compliance with a legal obligation, protection of a legitimate interest of the individual, or pursuit of a legitimate interest of H360 or a third party that does not unjustifiably override the individual’s rights. Purposes may include:
- providing, administering, configuring and supporting the website and platform;
- authenticating users and managing accounts, permissions, subscriptions and customer relationships;
- delivering health screening, risk information, referral prompts and user-requested reports;
- producing aggregated workforce health, productivity, absenteeism, presenteeism and trend analytics for authorised customers;
- responding to enquiries, requests, complaints and support incidents;
- maintaining service availability, safety, accuracy, quality and security;
- preventing misuse, fraud, unlawful access and threats;
- administering contracts, billing, payments, audit records and legal claims;
- complying with lawful requests, regulatory duties and applicable legislation;
- sending service communications and, where permitted, marketing communications; and
- developing and improving features using aggregated, de-identified or otherwise lawfully processed information.
Where consent is the applicable justification, consent must be voluntary, specific and informed and may be withdrawn. Withdrawal does not affect processing already lawfully undertaken, and it does not prevent processing that is justified on another lawful ground. Where particular information is required to provide a requested service, declining to provide it may prevent or limit that service; this consequence will be explained where reasonably practicable.
7. Health information and confidentiality
H360 processes health information only where an authorisation under POPIA and another lawful justification apply, including explicit informed consent where required, processing by or for an authorised healthcare or occupational-health function, processing necessary for lawful worker support or incapacity-related purposes, or another authorisation recognised by law. Health information is subject to confidentiality obligations arising from law, employment, profession, contract or written undertaking.
H360 does not sell identifiable health information. H360 does not use identifiable employee health information for unrelated advertising. Except where an individual expressly requests a disclosure, a disclosure is required by law, or a separate lawful arrangement clearly provides otherwise, employer customers receive aggregated or de-identified workforce insights and do not receive an individual participant’s questionnaire answers, suspected conditions or personal screening report.
Customers may not use platform information to unfairly discriminate, retaliate, discipline, dismiss, deny a benefit, determine insurance eligibility or make another materially adverse decision about an identifiable person contrary to law. Customers remain independently responsible for lawful workplace decision-making and appropriate human review.
8. Artificial intelligence, profiling and automated processing
The platform may use algorithms, statistical methods, rules engines and artificial intelligence to analyse responses, identify patterns, estimate risk and produce screening or workforce insights. Such outputs support awareness, referral, planning and human decision-making. They are not a confirmed medical diagnosis and should not be treated as the sole basis for clinical, employment, insurance or other decisions that produce legal consequences or substantially affect an individual.
Where applicable law restricts solely automated decision-making, H360 and its customers must implement meaningful human involvement, allow the individual to make representations, and provide an appropriate method to seek review of a significant decision. H360 does not use identifiable health information to train a general-purpose third-party artificial intelligence model unless that use is separately disclosed, lawfully authorised and protected by an appropriate agreement.
9. Employer dashboards and reporting
Employer-facing dashboards are intended to identify patterns at workforce, province, branch, department, work-environment or similar group level. Aggregation and access controls are applied to reduce the risk that a report reveals an individual’s health information. Reports should not be filtered, combined or exported in a way that enables singling out or re-identification.
A customer must limit dashboard access to authorised personnel with a legitimate business need, train those personnel on confidentiality, and use insights for lawful health, safety, wellness and workforce-planning purposes. H360 may restrict or suspend a feature or access where we reasonably believe it creates an unacceptable privacy, security or re-identification risk.
10. Voluntary participation and fair workplace use
Unless participation is lawfully required and clearly explained by the responsible party, employee participation in a screening should be voluntary. A customer should not coerce participation, require an employee to disclose a personal result to management, or impose an adverse consequence merely because an employee declines an optional screening. Consent is not valid where it is obtained through undue pressure or where the individual has no genuine choice.
An employer customer is responsible for consulting or engaging with employees, organised labour, health and safety structures or other stakeholders where required, and for ensuring that its implementation complies with labour, employment equity, health and safety, medical testing and anti-discrimination laws.
11. When we disclose personal information
12. International transfers
We may disclose personal information only where reasonably necessary and lawful, including to:
- the relevant employer or customer, subject to the aggregation, de-identification, contractual and access limitations described above;
- hosting, cloud, cybersecurity, identity, communications, support, payment, professional and other service providers acting under written duties of confidentiality and data protection;
- a healthcare professional, clinic, referral service, emergency contact or other recipient selected or authorised by the individual;
- auditors, insurers, banks, legal advisers and other professional advisers where necessary for legitimate business, legal or risk-management purposes;
- regulators, courts, law-enforcement authorities or other persons where disclosure is required or authorised by law, a warrant, court order or lawful process;
- a prospective or actual purchaser, funder, investor or successor in connection with a bona fide corporate transaction, subject to appropriate safeguards; and
- another person where the individual has validly consented or directed us to disclose the information.
We do not permit an operator or service provider to use personal information for its own unrelated purposes merely because it has access to the information. Operators must process on authorised instructions, protect confidentiality, apply appropriate security and notify H360 of relevant security compromises.
Some service providers, systems or recipients may be located outside South Africa, or may store or access information from another country. H360 will transfer personal information across borders only where permitted by POPIA, including where the recipient is subject to a law, binding corporate rules or binding agreement providing an adequate level of protection; the individual consents after being properly informed; the transfer is necessary for a contract or the individual’s benefit; or another lawful ground applies.
Where required, H360 uses contractual safeguards, access restrictions, security assessments and data-minimisation measures. The laws of a recipient country may differ from South African law and, in limited circumstances, foreign authorities may lawfully request access.
13. Information security
H360 maintains appropriate and reasonable technical and organisational measures designed to preserve the integrity and confidentiality of personal information and to prevent loss, damage, unauthorised destruction, unlawful access or unlawful processing. Measures are selected having regard to the sensitivity, volume, context and risk of the information and may include:
- encryption in transit and, where appropriate, at rest;
- role-based access, least-privilege controls and authentication safeguards;
- segregation or pseudonymisation of identity and screening data where reasonably practicable;
- logging, monitoring, vulnerability management, backups and recovery procedures;
- confidentiality commitments, personnel controls and security awareness;
- supplier due diligence and written operator requirements; and
- risk assessments, testing and periodic review of safeguards.
No internet transmission or storage system can be guaranteed to be completely secure. Users must keep credentials confidential, use appropriate device security and notify H360 promptly of suspected unauthorised access. H360 may require password changes, suspend sessions or take other proportionate protective action.
14. Security compromises
H360 maintains procedures to identify, contain, investigate, remediate and document suspected personal-information security compromises. Where H360 acts as an operator, it will notify the responsible party without undue delay after becoming aware of a relevant compromise, so that the responsible party can meet its legal obligations. Where H360 acts as the responsible party, it will notify the Information Regulator and affected data subjects as soon as reasonably possible, subject to any lawful delay or direction.
A notification may describe what occurred, the information affected, likely consequences, measures taken or proposed, recommendations to reduce potential harm and, where known and lawful, the identity of an unauthorised person. Notification does not constitute an admission of fault or liability.
15. Retention, restriction and deletion
H360 retains personal information only for as long as reasonably necessary for the purpose for which it was collected, to perform a contract, comply with a legal or regulatory requirement, resolve disputes, establish or defend legal claims, maintain security and audit records, or protect legitimate interests. Retention periods differ according to the record type, sensitivity, risk, customer instructions and legal requirements.
At the end of the applicable retention period, H360 will securely delete or destroy the information, return it where contractually required, or de-identify it so that it cannot reasonably be re-identified. Backups may retain residual copies for a limited period under controlled access until overwritten in the ordinary course. Where deletion is disputed or temporarily prohibited, processing may be restricted rather than the information immediately erased.
A customer may determine retention for information for which it is the responsible party. Individuals may therefore need to direct a request to their employer or other relevant customer; H360 will provide reasonable assistance to that customer as required by law and contract.
16. Cookies and similar technologies
The website and platform may use cookies, local storage, pixels, embedded content and similar technologies. These may be operated by H360 or by service providers. Categories may include:
- strictly necessary technologies for security, network management, shopping-cart or checkout functions, login, session continuity and user preferences;
- functional technologies that remember optional settings and improve usability;
- analytics technologies that help measure traffic, performance and how features are used; and
- advertising or social-media technologies that measure campaigns or enable interaction with external services, where these are lawfully enabled.
Non-essential technologies should be activated only after an appropriate choice has been obtained where required. A visitor may use the cookie controls made available on the website and may also adjust browser settings. Blocking strictly necessary technologies may prevent parts of the services from functioning. Embedded content, including video or social-media content, may allow the relevant third party to receive device or usage information under its own privacy terms.
17. Direct marketing and service communications
We may send operational messages needed to provide or secure a service, administer an account, respond to a request or communicate a material policy or service change. These are not treated as optional marketing where they are necessary for the service or relationship.
We send electronic direct marketing only where permitted by law, including where valid consent has been obtained or an applicable existing-customer rule applies. Marketing will identify the sender and provide a reasonably accessible method to opt out. An opt-out request will be honoured without charging a fee, although we may retain a minimal suppression record to ensure that the person is not contacted again through the same channel. We do not condition a core health screening service on consent to unrelated marketing.
18 Data subject rights
Subject to POPIA, PAIA and any lawful limitations, a data subject may have the right to:
- be informed when personal information is collected or affected by a security compromise;
- ask whether H360 holds personal information about them and request access to it;
- request correction or deletion of inaccurate, irrelevant, excessive, outdated, incomplete, misleading or unlawfully obtained information;
- request destruction or deletion of a record H360 is no longer authorised to retain;
- object, on reasonable grounds, to certain processing based on legitimate interests;
- withdraw consent where processing depends on consent;
- object at any time to direct marketing;
- not be subject, in circumstances protected by law, to a materially significant decision based solely on automated processing; and
- lodge a complaint with H360 or the Information Regulator and institute lawful proceedings.
To exercise a right, contact info@h360whip.com and describe the request and the relevant service. We may require sufficient information to verify identity and authority, protect third-party rights, locate the information and prevent fraudulent requests. We will not request more verification information than reasonably necessary. Access may be subject to the procedures and permitted fees under PAIA.
If H360 processes information solely as an operator for a customer, we may refer the request to that customer and assist it in responding. We may refuse or limit a request only where permitted by law and will provide reasons where required. Certain information may need to be retained despite a deletion request, including where required by law, contract, security, audit or legal-claim obligations.
19. Children
The H360 WHIP workforce platform and website are not intended for use by children under 18 unless a specific service has been lawfully configured for children and is supported by the required authorisation, notice, safeguards and consent from a competent person. A child should not submit health or other personal information through the services without such arrangements. If we become aware that children’s information has been collected without a lawful basis, we will restrict or delete it as appropriate.
20. Third-party services and links
The services may link to, embed or integrate third-party websites, videos, social networks, payment services, maps, healthcare services or other platforms. H360 is not responsible for a third party’s independent privacy practices. Users should review the third party’s privacy information before providing personal information or enabling an integration. A link or integration does not by itself constitute an endorsement of the third party’s privacy or security practices.
21. Research, benchmarking and product improvement
H360 may use aggregated or lawfully de-identified information to develop benchmarks, identify population-level trends, validate or improve screening logic, evaluate service performance and support research or public-interest analysis. Outputs must be presented in a manner intended not to identify an individual. If a proposed research activity requires identifiable or re-identifiable information, H360 will establish a separate lawful basis, governance process and any required ethical, contractual or regulatory approval before proceeding.
22. European Union and United Kingdom privacy supplement
22.1. When this supplement applies
This section applies only where the European Union General Data Protection Regulation (“EU GDPR”), the United Kingdom General Data Protection Regulation (“UK GDPR”), or related European data-protection law applies to H360’s processing. This may occur, for example, where H360 has an applicable establishment, offers relevant services to individuals in the European Economic Area or United Kingdom, or monitors their behaviour within the meaning of the applicable law. Nothing in this section expands the territorial scope of those laws where they do not otherwise apply.
22.2 Controller and processor roles
H360 is a controller where it determines the purposes and means of processing. H360 is a processor where it processes personal data on documented instructions from an employer customer or another controller. Where H360 acts as a processor, the relevant customer’s privacy notice governs its controller activities and requests should ordinarily be directed to that customer. H360 will provide the controller with assistance required by the applicable data-processing agreement and law.
If Article 27 of the EU GDPR or UK GDPR requires H360 to appoint a local representative, the representative’s identity and contact details will be made available in the relevant service notice or on the website before the affected processing begins. The absence of representative details in this general Policy should not be interpreted as a waiver of that requirement.
22.3 Legal bases and special category data
Where the EU GDPR or UK GDPR applies, H360 identifies a legal basis under Article 6 for each processing activity. Depending on the context, this may be consent; performance of a contract or steps requested before entering a contract; compliance with a legal obligation; protection of vital interests; performance of a task in the public interest where legally authorised; or legitimate interests that are not overridden by the individual’s interests, rights and freedoms.
Health data and certain other information processed by the platform are special category data. H360 processes such data only where an applicable condition under Article 9 is satisfied, which may include explicit consent, obligations or rights in employment and social-protection law, occupational or preventive medicine under professional secrecy, protection of vital interests, substantial public interest under law, healthcare management, public health, or appropriately safeguarded scientific or statistical purposes. The condition used depends on the service, jurisdiction and allocation of responsibilities; it must be documented before processing.
22.4 European privacy rights
Subject to lawful conditions and exemptions, an individual may request access, rectification, erasure, restriction, portability of data supplied to H360, or objection to processing based on legitimate interests or direct marketing. An individual may withdraw consent at any time where consent is relied upon, without affecting earlier lawful processing. An individual may also request safeguards relating to a decision based solely on automated processing that produces legal or similarly significant effects, including human intervention and an opportunity to express a point of view or contest the decision where applicable.
A request may be sent to info@h360whip.com. H360 will respond within the period required by applicable law and may extend that period where legally permitted after giving notice. Individuals may lodge a complaint with the data-protection authority in the country of habitual residence, place of work or alleged infringement. H360 encourages individuals to contact us first but does not require them to do so.
22.5 International transfers from Europe
Where European personal data is transferred to a country not recognised as providing adequate protection, H360 will use an applicable safeguard, such as the European Commission’s Standard Contractual Clauses, the United Kingdom International Data Transfer Agreement or UK Addendum, binding corporate rules, or a permitted statutory derogation. H360 will assess transfer risks and apply supplementary technical, contractual or organisational measures where required. A person may request information about the relevant safeguard, subject to protection of confidential and security-sensitive information.
23. United States privacy supplement
23.1. Scope and applicable law
This section applies to individuals in the United States to the extent that a federal or state privacy, consumer-health, employment, biometric, breach-notification or consumer-protection law governs the relevant processing. United States privacy requirements vary by state and may apply only after statutory thresholds or other jurisdictional conditions are met. H360 will provide a more specific notice where a particular state or service requires disclosures beyond this Policy.
23.2. Categories of United States personal information
During the preceding 12 months, or from the date H360 first begins processing information about a United States individual if later, H360 may collect the categories described in section 4. Under United States terminology, these may include identifiers; customer-record information; characteristics protected by law; commercial and transaction information; internet or electronic-network activity; approximate geolocation; audio, visual or communications information; professional, employment and organisational information; sensitive personal information; consumer health data; and inferences, risk indicators or profiles derived from other information.
Sources may include the individual, an employer customer, an authorised representative, the person’s browser or device, service providers, integration partners and lawful public sources. H360 uses these categories for the purposes in section 6 and may disclose them to the recipient categories in section 11. H360 does not collect every category from every person and will not collect sensitive information merely because a category is listed in this Policy.
23.3. Sale, targeted advertising and sensitive data
H360 does not sell identifiable health information or consumer health data for money or other valuable consideration. H360 does not disclose identifiable health screening information for cross-context behavioural advertising or targeted advertising. If H360 engages in another disclosure that applicable United States law defines as a “sale,” “sharing” or targeted advertising, H360 will provide any required notice, consent mechanism, “Your Privacy Choices” link and opt-out method before or when that practice begins.
Where required, H360 will recognise a valid universal opt-out mechanism, including a legally recognised browser-based opt-out preference signal. H360 will process sensitive personal information only for disclosed and reasonably necessary purposes, or with consent where the law requires it, and will provide a right to limit sensitive-data use if a covered practice falls outside legally permitted purposes.
23.4. Consumer health data
Certain United States state laws define consumer health data broadly and may cover information that identifies or can be reasonably linked to an individual’s physical or mental health status, symptoms, diagnoses, treatment, medication, reproductive or sexual health, biometric or genetic information, precise location associated with health services, or inferences drawn from other data. Where such a law applies, H360 will maintain any separately required consumer health data privacy notice and obtain consent before collecting or sharing consumer health data when consent is required.
H360 does not sell consumer health data. If a future transaction is legally treated as a sale of consumer health data, H360 will not proceed without the separate, specific and signed authorisation required by applicable law. H360 does not use geofencing around a healthcare facility to identify or track a person seeking healthcare, collect consumer health data, or deliver health-related advertising where prohibited.
Subject to applicable law, a United States consumer may request access to consumer health data, a list of categories or sources, confirmation of collection or sharing, withdrawal of consent, and deletion from H360 and relevant processors. Deletion may be subject to lawful exceptions and may take additional time to propagate through archived or backup systems maintained under a documented retention schedule.
23.5. California privacy rights
Where the California Consumer Privacy Act, as amended (“CCPA”), applies to H360, a California resident may have the right to know the categories and specific pieces of personal information collected; know the categories of sources, purposes and recipients; request deletion; request correction; opt out of sale or sharing; limit certain uses and disclosures of sensitive personal information; receive equal service and pricing without unlawful discrimination; and use an authorised agent. These rights may be subject to verification and statutory exceptions.
California requests may be submitted at info@h360whip.com or through any privacy-request form made available on h360whip.com. H360 will provide any additional submission method, toll-free number, website link or response procedure required if and when H360 is a business subject to those CCPA requirements. H360 will honour a qualifying opt-out preference signal where legally required. H360 does not offer a financial incentive in exchange for personal information unless a separate notice describing the material terms and value calculation is provided.
23.6. Rights under other United States state laws
Where another comprehensive state privacy law applies, residents may have rights to confirm processing, access, correct, delete or obtain a portable copy of personal data; opt out of targeted advertising, sale or certain profiling; withdraw consent to sensitive-data processing; and appeal a refusal. A request or appeal may be sent to info@h360whip.com with the subject line “United States Privacy Request.” H360 will authenticate the request, respond within the legally required period and provide a method to contact the relevant state attorney general or regulator where required.
23.7. HIPAA and other United States health laws
The Health Insurance Portability and Accountability Act and its implementing rules (“HIPAA”) do not automatically apply to all health or wellness platforms. HIPAA applies to protected health information handled by a covered entity or business associate within the scope of a regulated function. Where H360 processes protected health information as a business associate, H360 will do so under an appropriate business associate agreement and the relevant covered entity’s HIPAA Notice of Privacy Practices may also apply. Where H360 is not acting as a covered entity or business associate, other federal and state privacy, security, breach-notification and consumer-health laws may apply instead.
Where H360 is a vendor of personal health records, a related entity or a relevant service provider within the scope of the Federal Trade Commission’s Health Breach Notification Rule, H360 will provide breach notifications in the form, manner and time required by that Rule. H360 will also comply with applicable state breach-notification duties. Nothing in this Policy represents that all information processed by H360 is protected health information under HIPAA.
23.8. Children in the United States
The services are not directed to children under 13 in the United States. H360 does not knowingly collect personal information online from a child under 13 without verifiable parental consent or another lawful basis required by the Children’s Online Privacy Protection Act. Additional protections, consent requirements and opt-in rights may apply to minors under state law. If H360 learns that information was collected from a child contrary to applicable law, H360 will restrict or delete it and take other required action.
24. Changes to this Policy
We may update this Policy to reflect changes in law, technology, services, vendors or processing practices. The current version will be published on the website with an updated effective date. Where a change materially affects how previously collected personal information is used, we will take additional steps required by law, which may include a prominent notice, direct communication or renewed consent. Continued use does not constitute consent where the law requires an express choice.
25. Contact H360 WHIP
Questions, objections, requests or complaints about this Policy or H360’s processing of personal information may be directed to:
H360 WHIP
The Information Officer, H360 WHIP
info@h360whip.com
+27 (0) 10 085 0058
The Pivot, Montecasino, Fourways, Sandton, 2055, South Africa
26. Complaints to the Information Regulator
We encourage a person to contact H360 first so that we can attempt to resolve the concern. A person may also lodge a complaint with the Information Regulator South Africa:
Information Regulator South Africa
POPIAComplaints@inforegulator.org.za
enquiries@inforegulator.org.za
0800 017 160 or 010 023 5200
Woodmead North Office Park, 54 Maxwell Drive, Woodmead, Johannesburg, 2191, South Africa
Information Regulator contact details may change. Current information and complaint forms are available at https://inforegulator.org.za/.
