MedStreak Privacy Policy

Last updated: October 2026  ·  Version 1.3

Responsible party: Infynerva (Pty) Ltd, Cape Town, Western Cape, South Africa

Contact: support@medstreak.co.za

1. Introduction

Infynerva (Pty) Ltd ("MedStreak", "we", "us") is committed to protecting your personal information in accordance with the Protection of Personal Information Act 4 of 2013 (POPIA). This Privacy Policy explains what information we collect, why we collect it, how we protect it, and your rights as a data subject.

2. Information we collect

We collect only what you voluntarily provide:

• First name, last name, and date of birth
• Email address (for account authentication only)
• Medical aid name and member number
• Pharmacy contact details you choose to store
• Emergency contact details you choose to store
• Medication names, doses, and reminder times
• Self-reported medication adherence logs and pickup history
• If you subscribe to Pro: your plan, billing period and the PayFast payment reference
• Anonymous visit statistics (pages viewed, referring site, country and device type). These use no cookies and are not linked to your account
• Responses to our baseline compliance questionnaire
• Known allergies you choose to disclose
• Device push notification tokens (for reminder delivery)

We do not collect biometric data or any information beyond what you directly enter into the application. When you pay, your card details are entered on PayFast's secure payment page. They never reach MedStreak, and we cannot see or store them.

3. Why we collect your information

Your information is used solely to:

• Provide the MedStreak medication reminder and tracking service
• Send push notification reminders at your chosen times
• Generate your personal compliance statistics and streak data
• Pre-fill pharmacy notification messages on your behalf
• Track improvement in your adherence over time
• Improve the MedStreak service through anonymised, aggregated analytics

4. How your information is stored and protected

Your data is stored on Supabase, which operates on Amazon Web Services (AWS) infrastructure in Western Europe (the AWS eu-west region). This means your information is stored outside South Africa. All data is encrypted in transit (TLS) and at rest. Access to your data is restricted to you alone through Row Level Security. No other user can access your personal information.

5. Sharing of information

We do not share your personal information with any third parties except as follows: when you choose to send a pharmacy notification via WhatsApp or email, that message is sent directly from your own device using your own accounts. If you subscribe to Pro, our payment processor, PayFast (Pty) Ltd, receives your name, email address and the payment amount in order to process your payments. Anonymised, aggregated compliance data (with no personally identifiable information) may be shared with healthcare partners for research and programme evaluation purposes.

6. Service providers we use

We use the following providers to run MedStreak. We use them only to provide the service, and some of them process information outside South Africa.

• Supabase: stores your account, login and all the information you enter (Western Europe, as above).
• Vercel: hosts the MedStreak app and the servers that handle sign-in checks, payments and account deletion, and provides our anonymous visit statistics.
• Railway: runs our reminder server, which stores your device's notification details so it can send your reminders.
• PayFast: processes Pro subscription payments. Card details are entered on PayFast's own page and never reach us.
• Zoho Mail: handles the emails you send to support@medstreak.co.za.
• Your device's push service: Google, Apple or Mozilla, depending on your phone and browser, carries reminder notifications to your device.

7. Your rights under POPIA

As a data subject you have the right to:

• Access the personal information we hold about you
• Correct inaccurate personal information
• Request deletion of your personal information
• Object to the processing of your personal information
• Download a complete export of your data (available in the app under Profile → Account → My data)
• Lodge a complaint with the Information Regulator of South Africa

To exercise any of these rights, contact us at support@medstreak.co.za. Account deletion can also be initiated directly in the app under Profile → Account → Delete account.

8. Data retention

We retain your personal information for as long as your account is active or as needed to provide the service. If you delete your account in the app, your personal data and login are permanently removed when you confirm. If you ask us by email instead, we will remove it within 30 days of verifying your request. Anonymised, aggregated statistical data may be retained indefinitely as it cannot be linked to any individual.

9. Children

MedStreak is for adults aged 18 and over. We do not knowingly collect personal information from anyone under 18. If you believe a person under 18 has created an account, contact us at support@medstreak.co.za and we will delete it.

10. Changes to this policy

We may update this Privacy Policy from time to time. We will notify you of significant changes through the application. Continued use of MedStreak after changes constitutes acceptance of the updated policy.

11. Contact

For privacy-related queries: support@medstreak.co.za

Information Regulator South Africa: inforegulator.org.za

Infynerva (Pty) Ltd  ·  Reg. No. 2026/735446/07  ·  Cape Town, Western Cape, South Africa