Privacy Policy

About the platform

As a digital rewards ecosystem, Ovitoz allows members to earn, redeem and manage rewards while using digital wellness, lifestyle, shopping, and partner services.

What this policy covers

This Privacy Policy explains who we are, what information we collect, how we use it, who we share it with, how long we retain it, how we protect it and the rights available to you.

When this policy applies

This Privacy Policy forms part of the Ovitoz operational Terms and Conditions and applies whenever you:

• register for an Ovitoz account;
• join the Ovitoz Rewards Programme;
• use our website or mobile application;
• interact with our WhatsApp support or chatbot;
• link wearable devices;
• upload photographs or body measurements;
• connect third-party accounts;
• interact with participating rewards partners; and/or
• elect to opt in through any of our platforms, social media accounts or Messenger sites.

Categories of Personal Information

Connected health platforms

Where enabled by you, Ovitoz may synchronise information from:

• Apple HealthKit
• Google Health Connect
• Samsung Health
• Garmin
• Fitbit
• Polar
• Huawei Health
• Strava
• other compatible wearable devices.

Health telemetry

• daily steps
• walking distance
• running distance
• cycling distance
• calories burned
• active minutes
• sports participation
• exercise sessions
• workout history
• heart rate
• resting heart rate
• VO₂ Max
• sleep metrics
• movement trends

Health Telemetry — Background Synchronisation

• Where you enable background synchronisation, you expressly authorise Ovitoz to periodically access and synchronise your health information from authorised devices and connected health platforms without requiring you to manually upload the information each time.
• Synchronisation may occur automatically while the application is installed; frequency may vary depending on your device settings.
• Synchronisation may continue until you revoke the relevant permissions or disable the feature.
• You may disable synchronisation at any time through either device permissions and/or Ovitoz application settings.
• Background location tracking only occurs where expressly authorised; permission may be withdrawn at any time.
• Operators are contractually required to maintain confidentiality, implement appropriate security, process information only on our instructions, and comply with applicable privacy legislation.

Strictly necessary cookies

Used for functions that are required to operate, secure and deliver the Platform, including authentication, session management, security and fraud prevention. Where such cookies are technically necessary to provide a service requested by you, they may operate without optional tracking consent. They are not used for third-party behavioural advertising.

Functional and preference cookies

Remember settings, preferences and login-related choices to improve the operation and usability of the Platform. Where these technologies are not strictly necessary, they will only be activated in accordance with your cookie preferences.

Analytics cookies

Measure how users interact with the Platform and help Ovitoz understand and improve performance. Where analytics technologies transmit Personal Information or online identifiers to a third party, they will not be activated until the required prior consent has been obtained.

Marketing and advertising cookies

Pixels and similar tracking technologies are used to measure campaign performance, attribute conversions and, where applicable, support audience or advertising functions. These technologies are optional and are disabled by default until you provide explicit, affirmative consent.

Meta Pixel and related Meta technologies

Ovitoz may use the Meta Pixel and related cookies or technologies supplied by Meta Platforms, Inc. and/or its relevant affiliates ("Meta"). Where enabled, these technologies may process information such as cookie identifiers, device and browser information, IP address, pages or events viewed, interactions with Ovitoz advertisements or webpages, and conversion events. Ovitoz uses this tracking principally to measure and attribute conversions for its B2C waitlist engine, evaluate campaign effectiveness and understand whether advertising results in relevant Platform actions.

Cookie and Tracking Consent Banner

When you first visit the Ovitoz web Platform, and where renewed consent is required, Ovitoz will display a prominent consent banner before any non-essential marketing or third-party tracking technology is activated. The banner operates as a technical gatekeeper: non-essential tracking scripts and cookies, including the Meta Pixel, remain blocked unless and until you make an affirmative choice to accept the relevant category of tracking. Consent will not be inferred from silence, continued browsing, pre-ticked boxes or inactivity. Rejecting optional tracking will not prevent access to the core functionality of the Platform. You may withdraw or change your consent at any time through the cookie preference centre or equivalent privacy controls.

Cross-Border Transfers

While Ovitoz itself does not process Personal Information outside of South Africa, certain Operators such as Brand Partners may do so. Where this occurs, Ovitoz will ensure that adequate contractual or statutory safeguards protect your Personal Information, consistent with POPIA requirements.

Security

Ovitoz maintains industry-standard safeguards including secure APIs, access controls, penetration testing, vulnerability management, audit logging and monitoring.

Retention

Personal Information is retained only while your account remains active, for legal compliance, for contractual purposes, to resolve disputes and for legitimate business purposes. Information is securely deleted or anonymised when no longer required.

Data Breach Response

Where a security compromise occurs, Ovitoz will investigate the incident and contain the breach while assessing the affected information. Affected users will be notified where a breach is material or notification is otherwise required. Where material or otherwise required, the Information Regulator will be notified where legally required. Corrective measures will be implemented and internal controls reviewed.

Messaging and Chatbot Consent

By selecting "I Agree", clicking "Start Chat", sending a message or continuing a chatbot conversation, you expressly consent to Ovitoz collecting information contained within messages, storing conversation history, processing your information using AI technologies, analysing messages to improve services, using conversations to resolve support requests, and transferring messages to human support agents where necessary.

• chatbot conversations may be generated using artificial intelligence;
• conversations may be quality-reviewed;
• messaging service providers process message metadata;
• conversations may be securely retained.

Marketing communications will only be sent where you have separately opted in or where otherwise permitted by applicable law. You may withdraw Chatbot consent at any time.

Cookie, Pixel and Third-Party Tracking Consent

Optional marketing and attribution tracking is subject to a separate opt-in. Before Ovitoz activates the Meta Pixel or another non-essential third-party tracking technology that transmits Personal Information or online identifiers for marketing or attribution purposes, you will be asked to make an affirmative choice through the cookie consent banner or preference centre. For the avoidance of doubt, creating an Ovitoz account, joining the rewards Programme, continuing to browse the Platform or accepting the general Privacy Policy does not, in itself, constitute consent to Meta Pixel or other optional third-party marketing tracking. Such consent must be obtained separately before the relevant processing begins.

Special Personal Information Consent (Sections 26, 27 and 32 of POPIA)

This Health-Related Data Processing Consent applies to all users of the Ovitoz Platform who choose to access wellness, health, fitness, rewards or AI-powered health functionality. By creating an Ovitoz account, joining the rewards Programme, enabling health telemetry, permitting location services, linking third-party accounts, interacting with AI-powered services or chatbots, or otherwise using the Platform, you acknowledge that you have read and understood this Privacy Policy and consent to the processing of your Personal Information to the extent that consent is the applicable lawful basis under POPIA.