POPIA Compliance

Last updated: 19 March 2026

Devonbosch Pharmacy, trading as DOSIST®, is committed to complying with the Protection of Personal Information Act, 2013 (Act 4 of 2013) (“POPIA”). This document outlines how we process and protect personal information in accordance with POPIA's requirements.

1. Responsible Party

The responsible party for the processing of personal information is:

Devonbosch Pharmacy
Brickfield Studios, Stellenbosch, South Africa
Email: hello@dosist.co.za

2. Information Officer

In accordance with Section 55 of POPIA, Devonbosch Pharmacy has designated an Information Officer responsible for ensuring compliance with POPIA and for handling all requests relating to personal information.

Information Officer
Devonbosch Pharmacy
Email: hello@dosist.co.za
Address: Brickfield Studios, Stellenbosch, South Africa

The Information Officer is registered with the Information Regulator of South Africa as required by POPIA.

3. Lawful Basis for Processing

We process personal information on the following lawful grounds as defined in Section 11 of POPIA:

  • Consent: You provide voluntary, specific, and informed consent when completing our eligibility quiz, booking a telehealth consultation, or placing an order.
  • Contractual necessity: Processing is necessary to fulfil our contractual obligations to you, including dispensing compounded medicines and processing payments.
  • Legal obligation: We are required by law to retain certain records, including clinical and prescription records under the Pharmacy Act, the Health Professions Act, and tax legislation.
  • Legitimate interest: Processing is necessary for our legitimate interests, such as improving our services and preventing fraud, provided these interests do not override your fundamental rights and freedoms.

4. Categories of Personal Information Processed

We process the following categories of personal information:

  • Identity information: Full name, date of birth, ID number, gender.
  • Contact information: Email address, phone number, physical address.
  • Health information (special personal information): Medical history, current medications, allergies, consultation notes, prescription details, eligibility quiz responses. This is processed with your explicit consent as required by Section 26 of POPIA.
  • Financial information: Payment transaction records (processed via PayFast; we do not store card details directly).
  • Technical information: IP address, browser type, device information, website usage data.

5. Purpose of Processing

Personal information is processed for the following specific purposes:

  • Facilitating telehealth consultations with registered medical practitioners.
  • Compounding and dispensing prescription peptide therapy products.
  • Processing payments and managing orders.
  • Communicating order status, delivery updates, and treatment-related information.
  • Complying with regulatory requirements of SAHPRA, SAPC, and HPCSA.
  • Maintaining records as required by the Pharmacy Act and Good Pharmacy Practice standards.
  • Improving our website and services through anonymised analytics.
  • Preventing and detecting fraud or unlawful activity.

6. Data Subject Rights

Under POPIA, you have the following rights regarding your personal information:

  • Right of access (Section 23): You may request confirmation of whether we hold personal information about you and request access to that information.
  • Right to correction (Section 24): You may request that we correct or update inaccurate, incomplete, or misleading personal information.
  • Right to deletion (Section 24): You may request that we delete your personal information where it is no longer necessary for the purpose it was collected, subject to our legal retention obligations.
  • Right to object (Section 11(3)): You may object to the processing of your personal information on reasonable grounds, unless legislation provides for such processing.
  • Right to withdraw consent: Where processing is based on consent, you may withdraw your consent at any time. Please note that withdrawal of consent may affect our ability to provide you with treatment or services.
  • Right not to be subject to automated decision-making (Section 71): You have the right not to be subject to a decision based solely on automated processing that produces legal effects or significantly affects you.

To exercise any of these rights, please submit a written request to hello@dosist.co.za. We will respond within 30 days. We may require verification of your identity before processing your request.

7. Cross-Border Transfers

Your personal information may be transferred to and stored on servers located outside of South Africa, specifically through our use of Google Workspace (Google LLC) for data storage and email services.

In accordance with Section 72 of POPIA, we ensure that any cross-border transfer of personal information is subject to adequate safeguards, including:

  • The recipient country having adequate data protection legislation.
  • Binding contractual agreements (such as Google's Data Processing Amendment) that ensure a comparable level of protection.
  • Your consent to the transfer where required.

8. Security Measures

In accordance with Section 19 of POPIA, we implement appropriate technical and organisational measures to secure the integrity and confidentiality of personal information, including:

  • Encryption of data in transit (HTTPS/TLS) and at rest where applicable.
  • Access controls limiting personal information access to authorised personnel only.
  • Secure password policies and multi-factor authentication for internal systems.
  • Regular review of data handling and storage practices.
  • Staff training on data protection and POPIA obligations.
  • Use of PCI DSS-compliant payment processing (PayFast) — we do not store credit card details on our systems.

9. Data Breach Notification

In the event of a data breach that compromises the confidentiality or integrity of your personal information, we will, in accordance with Section 22 of POPIA:

  • Notify the Information Regulator as soon as reasonably possible after becoming aware of the breach.
  • Notify affected data subjects as soon as reasonably possible, providing details of the breach, the categories of information affected, and the measures taken to address it.
  • Take immediate steps to mitigate the breach, investigate its cause, and implement measures to prevent recurrence.

10. Retention of Personal Information

We retain personal information only for as long as is necessary to fulfil the purposes for which it was collected, or as required by applicable law:

  • Clinical and prescription records: Minimum 6 years after the last consultation (Health Professions Act; GPP standards).
  • Financial and tax records: 5 years (Tax Administration Act).
  • Consent records: Duration of the service relationship plus 1 year.
  • Website analytics: Stored in anonymised form (not personal information once anonymised).

After the applicable retention period, personal information is securely deleted or permanently anonymised.

11. Lodging a Complaint

If you believe that your personal information has been processed in violation of POPIA, you have the right to lodge a complaint with:

Step 1: Contact Us Directly

We encourage you to contact our Information Officer first so we can attempt to resolve the matter:
Email: hello@dosist.co.za

Step 2: The Information Regulator

If you are not satisfied with our response, or if you wish to lodge a complaint directly, you may contact the Information Regulator of South Africa:

12. Updates to This Notice

This POPIA Compliance notice may be updated from time to time to reflect changes in legislation or our data processing practices. The latest version will always be available on this page with an updated effective date.

13. Contact Us

For any questions, requests, or concerns relating to the processing of your personal information or this POPIA Compliance notice, please contact:

Devonbosch Pharmacy — Information Officer
Email: hello@dosist.co.za
Address: Brickfield Studios, Stellenbosch, South Africa