1. Responsible party
Rashik Singh trading as Pryse determines why and how the information described here is processed and is the “responsible party” under the Protection of Personal Information Act 4 of 2013 (POPIA).
- Trading name
- Pryse
- Owner
- Rashik Singh
- Privacy contact
- rsm.venture.cap@gmail.com
2. What we collect
- An optional first name or nickname, used only to address you in this browser session. It is not sent with saved questionnaires, plan-preview requests or payment records.
- Who is on your plan and their ages, province, income range, cover history, preferred providers and budget.
- Only with clear permission: selected long-term conditions and medicines. These are special personal information under POPIA.
- Your consent choices, document versions, dates and times, and a random Supabase user ID rather than your name.
- Security and service logs that may include your IP address, device and request details, and errors.
- If you start a paid unlock: a random comparison identifier, the pseudonymous Supabase user identifier linked to it, and a short non-health label containing the number of adults, the number of children where present, and province.
- A purchase record containing its status, PayFast payment reference, amount in cents, ZAR currency, creation time, and payment time once payment is confirmed.
Apart from the optional display name, the questionnaire does not ask for identity numbers, contact details, smoking status, weight, or exact home addresses. Do not type those details into medicine search. A purchase label never includes a condition, medicine, income, budget, or other health information.
3. Where it comes from and your choices
You provide the information, including any details you have permission to share for other people on your plan. You must accept the User Agreement to use the comparison. Cloud saving, health questions and permission to improve our cost model are optional and off by default. Without cloud saving, your answers stay in this browser session. Without health answers, we cannot estimate costs for your medicines.
Starting a paid checkout is optional. If you do, Pryse generates the comparison and pseudonymous user identifiers, creates the pending purchase record, and derives its non-health label from household counts and province already in the comparison. PayFast returns the payment status, Pryse-issued reference, and confirmed amount through its transaction notification. This processing is needed to complete and deliver the purchase and cannot be switched off while buying an unlock.
4. Why we use it and our legal basis
- Comparison: use your answers in the browser to provide the comparison you request.
- Optional storage: save your answers under a random account ID only with your permission.
- Health and children's data: use only with clear permission from that person or someone legally able to consent for them.
- Model development: prepare data that cannot identify you to improve cost calculations, only after separate permission.
- Paid unlock: create and verify the transaction, link it to the comparison, deliver the purchased figures, prevent a payment being reused, and handle support or refunds as necessary to perform the transaction.
- Security and compliance: prevent abuse, protect data, respond to rights requests, and keep a minimal consent record based on legal duties and legitimate interests.
Your questionnaire answers are never used for direct marketing, advertising profiles, or sale. They are not sent to an advertiser, and no advertiser can read them. Advertising on the site is described separately in section 7; it does not draw on anything in this list.
5. Model-development permission
Permission covers development and validation of statistical or machine-learning models for medical-aid cost comparisons. It does not permit advertising, sale of responses, training third-party general-purpose AI models, health underwriting, or decisions about whether you receive cover.
Raw and pseudonymous responses must stay out of a training run. Before use, an authorised process must remove persistent identifiers and apply aggregation and re-identification controls. You may withdraw while a response is still identifiable or pseudonymous. Once information has been irreversibly de-identified so that Pryse cannot reconnect it to you, POPIA no longer treats it as personal information and it cannot be located for individual deletion. No model pipeline is enabled by this build.
6. Who receives your information
Supabase provides authentication, database, backup, and hosting services as an operator under written data-protection terms. Access inside Pryse must be limited to authorised people who need it for security, privacy administration, or an approved de-identification process. Supabase also stores the random account ID and paid-access record needed to recognise a paid unlock. Information may also be disclosed when lawfully required.
PayFast hosts the payment page. Pryse sends it the item name “Pryse comparison”, the signed payment reference, amount, and merchant return and notification details. PayFast independently collects the card and other payment details entered on its page under its own privacy terms. It returns transaction data needed to verify payment. Pryse does not receive or store card details.
Google is a recipient of a different kind, and only in the narrow way section 7 describes: it is not an operator acting on Pryse's instructions. Pryse does not send Google a stored questionnaire, household purchase label, payment reference, or paid-access record. Those records are not shared with schemes, brokers, advertisers, or general-purpose AI providers.
7. Cookies, browser storage, and advertising
Pryse sets no cookie for its own purposes. What it keeps in your browser is your questionnaire, held in session storage and discarded by the browser when the tab closes, and, where advertising or measurement is switched on, your choice about them, held in local storage. Pryse does not send either value to an advertiser.
Where you enable cloud storage or start a paid checkout, a pseudonymous Supabase session is kept in local storage. Starting checkout also creates a random comparison identifier in local storage and sends that identifier to Pryse so the purchase can be linked to the correct comparison. These browser values identify the purchase, while the active household answers remain in session storage and can be lost when that browser session ends. Clearing site data or moving to another browser can remove the browser's link to the unlock; it does not by itself delete the server-side purchase record. Keep the PayFast reference so support can trace the transaction if that link is lost.
Two pages, the comparison and the medicine checker, may carry advertising supplied by Google. Google acts as an independent third party there, not as an operator following Pryse's instructions: it chooses what to show, and it sets and reads its own cookies in your browser, including cookies on google.com and doubleclick.net, to serve and measure advertising and to detect invalid traffic. Google may use those cookies together with your IP address to personalise what it shows you. What Google does with that information is governed by Google's terms, and is explained at policies.google.com/technologies/partner-sites.
Your answers never reach an advertiser. Household composition, income band, chronic conditions and medicines are processed in your browser. They are not placed in an ad request, not written into a page address, and not readable by any advertising script. Advertising never appears on the questionnaire, on the consent step, or inside the comparison table.
Your choice, and how to change it. No advertising script loads and no advertising cookie is set until you allow it. A notice asks once; declining costs you nothing, and Pryse shows its own promotional units instead. Withdrawing is as easy as allowing: use the advertising control at the top of this page at any time. Blocking third-party cookies in your browser settings has the same effect for advertising. Personalised advertising can also be switched off across every site at myadcenter.google.com.
Pryse does not serve advertising to visitors in the European Economic Area, the United Kingdom, or Switzerland. Serving there requires a Google-certified consent platform, which Pryse does not operate, so those visitors are shown Pryse's own promotional units and no third-party script loads at all.
8. Cross-border processing
Optional cloud questionnaire storage is not active. Before enabling it, Pryse will publish the primary hosting region, review each relevant subprocessor, and document the applicable POPIA section 72 transfer safeguards and any required prior authorisation.
9. Retention and deletion
Saved raw questionnaires receive an expiry timestamp and are deleted from the active database within 12 months. A daily retention job enforces that limit. Minimal consent and deletion events (document versions, choices, timestamp, and pseudonymous identifier) are retained for up to 36 months to demonstrate and resolve consent or privacy issues, then deleted unless law requires longer retention. Provider backups age out under the contracted backup cycle and are not used for ordinary processing.
Paid-unlock records do not use the questionnaire expiry because they record an unlock intended to remain available. They are retained while needed to provide that unlock and to meet accounting, dispute, refund, fraud-prevention, and legal obligations, and must be deleted or de-identified when no longer authorised. PayFast retains its own transaction records under its terms and legal obligations.
The controls above delete saved questionnaires and withdraw their optional permissions. They do not delete the anonymous Supabase account, comparison identifier, paid-access record or transaction record. Clearing browser storage removes the local link but does not send a deletion request to Pryse.
10. Security
Controls include encrypted transport, provider encryption at rest, separate publishable and secret keys, pseudonymous authentication, least-privilege grants, row-level access policies, input constraints, consent-gated database functions, and automatic expiry. Secret/service-role keys must never be shipped to the browser. No internet system is risk-free; Pryse must maintain an incident plan and notify the Information Regulator and affected people when POPIA requires it.
11. Your rights
Subject to POPIA and identity verification, you may ask whether we hold your information, request access or correction, object or withdraw consent, request restriction, or ask for deletion when retention is no longer authorised. The controls on this page provide browser-linked export, withdrawal, and deletion for saved questionnaire data; the export does not currently include paid-unlock records.
For a purchase-record request, contact the Information Officer at rsm.venture.cap@gmail.com and include the PayFast reference if available. Keep the questionnaire receipt and any PayFast payment reference because either can help locate a pseudonymous record if the browser link is lost. A receipt or reference is not, by itself, proof of identity, and some transaction records may have to be retained while a legal or accounting duty applies.
12. Automatic calculations
Pryse uses stated calculation settings to estimate costs. It does not make decisions with legal or similarly significant effects, decide who can join a scheme or set prices based on health. Any future use for significant decisions made entirely by a computer would need a new assessment, notice, legal basis, safeguards and a way for you to challenge the decision.
13. Complaints and changes
Raise a concern with the Information Officer first so Pryse can investigate. You may also complain to the Information Regulator of South Africa. Material changes receive a new version and fresh acceptance before new cloud collection; we do not treat silence as consent.
Information Regulator contact details: complaints at POPIAComplaints@inforegulator.org.za, general enquiries at enquiries@inforegulator.org.za, telephone 010 023 5200, toll-free 0800 017 160, Woodmead North Office Park, 54 Maxwell Drive, Woodmead, Johannesburg, 2191.