Privacy Policy

Introduction

Flourish (Pty) Ltd ("Flourish", "we", "us", or "our") is committed to protecting your privacy and handling your personal information responsibly. This Privacy Policy explains what information we collect when you use the Flourish platform (the website flourishweightloss.com and the Flourish mobile application), why we collect it, how we use it, and your rights in respect of it.

This policy is governed by the Protection of Personal Information Act 4 of 2013 ("POPIA") and applies to all users in South Africa.

Who We Are

Flourish (Pty) Ltd is the responsible party for personal information collected through the Flourish platform. Doctor consultations are provided by a separate legal entity (Flourish Medical (Pty) Ltd or its designated practitioners) and that entity may process your health information as a responsible party in its own right for clinical purposes.

Our Information Officer can be contacted at privacy@flourishweightloss.com.

Personal Information We Collect

We collect the following categories of personal information:

• Identity information: name, email address, and date of birth.
• Contact information: email address and, where provided, phone number.
• Health information (special personal information under POPIA): weight, body measurements, medical history, current medications, injection history, side-effect logs, and dietary data that you record in the app.
• Payment information: processed by our payment gateway; we do not store full card details.
• Device and usage information: device type, operating system version, app version, and feature-usage analytics collected through our analytics provider.
• Communications: messages you send through the FIA AI coach interface and any support requests.

Why We Collect Your Information

We use your personal information for the following purposes:

• To provide and personalise the Flourish service, including generating your nutrition plan and enabling your AI coach (FIA).
• To facilitate doctor consultations and communicate your relevant health data to your assigned clinician.
• To process subscription payments and manage your account.
• To send service notifications (appointment reminders, plan updates, medication reminders) via push notification and email.
• To improve the platform through aggregate, anonymised analytics.
• To comply with our legal obligations.

Lawful Basis for Processing (POPIA)

Under POPIA we rely on the following grounds to process your personal information:

• Consent: you give explicit consent when you create an account and accept this policy. For special personal information (health data) we obtain express consent before collection.
• Contractual necessity: processing is necessary to deliver the subscription service you have agreed to.
• Legitimate interest: aggregate usage analytics to improve the platform, provided these interests are not overridden by your rights.
• Legal obligation: where required by South African law.

Third-Party Processors

We share your personal information only with service providers who process it on our behalf under written data-processing agreements consistent with POPIA:

• Supabase Inc — database hosting and authentication. Your data is stored on servers in accordance with our data-residency requirements.
• Paystack (Stripe Technology Europe) / PayFast — payment processing for app subscriptions and consultation fees respectively.
• Cal.com — appointment scheduling for doctor consultations.
• Push notification provider (e.g. Expo / FCM / APNs) — delivery of in-app and device notifications.
• Analytics provider — anonymised, aggregated usage data to measure feature engagement.
• Anthropic — AI inference for the FIA coaching feature. Conversation content may be processed by Anthropic in accordance with their privacy commitments.

Data Retention

We retain your personal information for as long as your account is active and for a reasonable period thereafter to comply with our legal obligations, resolve disputes, and enforce our agreements. Health records are retained in accordance with any applicable South African legislative requirements for medical records.

When you request deletion of your account, we will delete or anonymise your personal information within 30 days, except where retention is required by law.

Cross-Border Transfers

Some of our third-party processors are located outside South Africa. Where personal information is transferred outside South Africa, we ensure that the recipient is subject to a law, binding corporate rules, or a binding agreement that provides an adequate level of protection as required by POPIA section 72.

Your Rights Under POPIA

You have the right to:

• Access: request a copy of the personal information we hold about you.
• Correction: request that we correct inaccurate or incomplete personal information.
• Deletion: request that we delete your personal information, subject to our legal retention obligations.
• Objection: object to the processing of your personal information on grounds relating to your particular situation.
• Withdrawal of consent: withdraw any consent you have given at any time, without affecting the lawfulness of processing before withdrawal.
• Complaint: lodge a complaint with the Information Regulator (South Africa) at www.justice.gov.za/inforeg if you believe we have infringed POPIA.

Account Deletion

To request deletion of your account and associated personal information, please email privacy@flourishweightloss.com with the subject line "Account Deletion Request". We will process your request within 30 days and confirm when deletion is complete. Note that some anonymised records may be retained for aggregate statistical purposes.

You may also initiate account deletion from within the Flourish app under Settings → Account → Delete Account.

Contact

For any privacy-related queries or to exercise your rights, contact our Information Officer:

Email: privacy@flourishweightloss.com Postal: Flourish (Pty) Ltd, [Address — to be confirmed], South Africa.