Privacy Policy

Last updated: 21 July 2026 · Draft for review — to be finalised with your Information Officer and legal adviser before publication.

Who we are

VitalsDataLab™ is operated by House of Experts Group (“we”, “us”). LungSync™ is a clinical module of the VitalsDataLab platform. This policy explains how we process personal information in line with South Africa's Protection of Personal Information Act, 2013 (POPIA).

Information Officer: [ name ] · [ email ] · [ contact number ]. Our Information Officer is registered with the Information Regulator (South Africa).

What information we collect

• Enquiry / lead details you give us via our forms: name, company, position, province, email, phone, workforce size and areas of interest.
• Health information (Special Personal Information) is processed only inside the clinical portal, only after explicit consent, and only by authorised health practitioners. It is never collected through our public marketing or expo forms.
• Technical / analytics data (see our Cookie Policy) — only after you accept cookies.

Special Personal Information & consent

Health data is Special Personal Information under POPIA. We process it on the basis of the data subject's explicit, informed consent, captured and timestamped before any record is created. Consent can be withdrawn at any time. Access is strictly role-based:

• Clinicians see identified records for the workers in their care.
• Employers see de-identified aggregates only, never for a group smaller than 10 people.
• Workers see only their own data.

Every access to health data is written to an audit log for accountability. VitalsDataLab records and analyses readings taken by practitioners and self-reported by users; it does not diagnose, treat, or claim to measure any condition itself.

How we use your information

• To respond to enquiries and arrange workplace pilots and demonstrations.
• To deliver the respiratory-wellness programme where you are enrolled with consent.
• To meet legal, regulatory and occupational-health record-keeping obligations.

Sharing & processors

We use trusted processors under written agreements — including our hosting and database provider, transactional email provider, and CRM/automation tooling — solely to operate the service. Where data is processed outside South Africa, we rely on a lawful transfer basis.

Retention

We keep personal information only as long as necessary for the purposes above or as required by law, after which it is securely deleted or de-identified.

Your rights

You may request access to, correction or deletion of your personal information, object to processing, or lodge a complaint with the Information Regulator. Contact our Information Officer using the details above. Data-export and delete-my-data functions are available on request and, within the clinical portal, to administrators.

Contact

Questions about this policy? Email [ privacy@vitalsdatalab.com ] or write to [ postal address ].