Privacy Policy

About the platform

As a digital rewards ecosystem, Ovitoz allows members to earn, redeem and manage rewards while using digital wellness, lifestyle, shopping, and partner services.

What this policy covers

This Privacy Policy explains who we are, what information we collect, how we use it, who we share it with, how long we retain it, how we protect it and the rights available to you.

When this policy applies

This Privacy Policy forms part of the Ovitoz operational Terms and Conditions and applies whenever you:

• register for an Ovitoz account;
• join the Ovitoz Rewards Programme;
• use our website or mobile application;
• interact with our WhatsApp support or chatbot;
• link wearable devices;
• upload photographs or body measurements;
• connect third-party accounts;
• interact with participating rewards partners; and/or
• elect to opt in through any of our platforms, social media accounts or Messenger sites.

Deleting your account and erasing your data in the app

You can erase your account directly in the Ovitoz app, without contacting us. Open Settings, select "Delete account & erase data", and type DELETE to confirm the request. Deletion is permanent and cannot be undone. It removes your profile, your Early Access application, your activities and health telemetry, your OVI balance and ledger history, your vouchers, your referral records, your communication consents and any photographs you uploaded, and it deletes your sign-in record. Merchant till and settlement records are retained for accounting and audit purposes, but with your name and contact details removed (anonymised).

If you cannot sign in, or you prefer not to use the in-app process, you may submit a deletion request through our web link at https://app.ovitoz.co.za/delete-account, or email privacy@ovitoz.co.za instead. The Information Officer will verify your identity and carry out the erasure on your behalf.

Categories of Personal Information

Connected health platforms

The current release accepts activity through the following methods:

• Apple Health: manual export-file upload only. The export is parsed on your device; selected daily steps, distance, active calories and maximum heart rate, where available, are sent to Ovitoz after your consent and confirmation. The raw export is not uploaded.
• Strava: an optional authorised connection that imports activities.
• Automatic Apple HealthKit and Google Health Connect access is not available in this release. Ovitoz does not request native Health read or write permission.

Strava

If you choose to connect Strava, Ovitoz uses Strava's official OAuth 2.0 authorisation flow in your device browser. You sign in on Strava's own page — Ovitoz never sees or stores your Strava password.

• We request read access to your activities only (scope activity:read_all). Ovitoz cannot post, edit or delete anything on Strava.
• We read activity type, start time, duration, distance, cadence, calories and heart-rate summaries, and we store the derived step, workout and OVI records needed to calculate rewards.
• Strava data is never sold, licensed or shared with insurers, medical schemes, merchants or data brokers, and is never used for advertising.
• Strava data is never used in artificial intelligence, machine learning or generative AI features, and is never used to train any model.
• Strava workouts are shown only to you, inside your own signed-in account, and never in public feeds or to other members.
• Ovitoz subscribes to Strava webhooks so updates arrive as events rather than by repeatedly polling Strava.
• You may disconnect at any time in Settings, or revoke Ovitoz in your Strava account settings. Either action deletes the stored Strava tokens and your imported Strava activities immediately; OVI already earned stays in your reward balance.
• Strava access and refresh tokens are stored encrypted (AES-256-GCM) and are only used server-side.
• Imported Strava workout details are kept for no longer than 7 days. After that, only Ovitoz's own reward record (date, activity type and OVI earned) is kept. Workouts you delete on Strava are removed from Ovitoz automatically.
• Strava may collect usage data about how Ovitoz uses Strava's services, in line with Strava's own privacy policy.

Health platform authorisations

Apple Health export imports require your affirmative health-data consent and confirmation of the selected daily records. Strava imports require your authorised connection. You can withdraw consent or disconnect in Settings. When permission is withdrawn, Ovitoz does not save new health data. No automatic Apple Health or Google Health Connect access is enabled in this release.

Heart-rate zones and Daily 2x Boost

Ovitoz treats your heart-rate zone (Zone 1 to Zone 5) and your Daily 2x Boost usage as processed health telemetry. We use them only to calculate your rewards, including the tiered daily cap: up to 15 OVI a day on standard activity, and up to 25 OVI on a day with verified Zone 3+ activity or an activated Daily 2x Boost. “Verified” means heart-rate data imported from Strava or from an uploaded health-data export; heart rate you type in by hand is stored for your records but never multiplies your earnings and does not raise the daily limit. Streak bonuses do not count towards either limit.

Referral codes and network click identifiers

When you arrive through a referral link or a partner deal link, Ovitoz records referral codes and network click identifiers (for example, campaign tags in the link). We use them to credit referral rewards correctly and to confirm which partner deal a member followed. They are never sold.

Email campaign participation and link clicks

For individual member engagement emails, Ovitoz records the recipient's account identifier, campaign, subject and send time to maintain a send history and avoid repeat sends. When a recipient follows a campaign link, we record which fixed destination was clicked, the click count and first-click time against that email record. Authorised administrators use these account-linked records to measure campaign engagement and follow up on support feedback. This feature measures clicks, not email opens; it does not use an email-open pixel. Marketing emails require the applicable separate consent. These records are not sold or used to track you across other companies' apps or websites.

Cookie consent choices

Our cookie consent banner separates essential cookies (always on, needed for sign-in and security) from analytics cookies and marketing cookies (off until you agree). We store your choice as a consent record, and you can change it at any time.

Health telemetry

• daily steps
• walking distance
• running distance
• cycling distance
• calories burned
• active minutes
• sports participation
• exercise sessions
• workout history
• heart rate
• resting heart rate
• VO₂ Max
• sleep metrics
• movement trends

Activity imports and background updates

• Connected Strava activities may import through server-side updates after you authorise Strava. You can stop those imports by disconnecting Strava in Settings or revoking Ovitoz access in Strava.
• Apple Health data is imported only when you upload an export, grant the applicable consent and confirm the records. Ovitoz does not read Apple Health or Google Health Connect automatically in this release.
• Operators are contractually required to maintain confidentiality, implement appropriate security, process information only on our instructions, and comply with applicable privacy legislation.

Strictly necessary cookies

Used for functions that are required to operate, secure and deliver the Platform, including authentication, session management, security and fraud prevention. Where such cookies are technically necessary to provide a service requested by you, they may operate without optional tracking consent. They are not used for third-party behavioural advertising.

Functional and preference cookies

Remember settings, preferences and login-related choices to improve the operation and usability of the Platform. Where these technologies are not strictly necessary, they will only be activated in accordance with your cookie preferences.

Analytics cookies

Measure how users interact with the Platform and help Ovitoz understand and improve performance. Where analytics technologies transmit Personal Information or online identifiers to a third party, they will not be activated until the required prior consent has been obtained.

Marketing and advertising cookies

Pixels and similar tracking technologies are used to measure campaign performance, attribute conversions and, where applicable, support audience or advertising functions. These technologies are optional and are disabled by default until you provide explicit, affirmative consent.

Meta Pixel and related Meta technologies

Ovitoz may use the Meta Pixel and related cookies or technologies supplied by Meta Platforms, Inc. and/or its relevant affiliates ("Meta"). Where enabled, these technologies may process information such as cookie identifiers, device and browser information, IP address, pages or events viewed, interactions with Ovitoz advertisements or webpages, and conversion events. Ovitoz uses this tracking principally to measure and attribute conversions for its B2C waitlist engine, evaluate campaign effectiveness and understand whether advertising results in relevant Platform actions.

Cookie and Tracking Consent Banner

When you first visit the Ovitoz web Platform, and where renewed consent is required, Ovitoz will display a prominent consent banner before any non-essential marketing or third-party tracking technology is activated. The banner operates as a technical gatekeeper: non-essential tracking scripts and cookies, including the Meta Pixel, remain blocked unless and until you make an affirmative choice to accept the relevant category of tracking. Consent will not be inferred from silence, continued browsing, pre-ticked boxes or inactivity. Rejecting optional tracking will not prevent access to the core functionality of the Platform. You may withdraw or change your consent at any time through the cookie preference centre or equivalent privacy controls.

Cross-Border Transfers

While Ovitoz itself does not process Personal Information outside of South Africa, certain Operators such as Brand Partners may do so. Where this occurs, Ovitoz will ensure that adequate contractual or statutory safeguards protect your Personal Information, consistent with POPIA requirements.

Security

Ovitoz maintains industry-standard safeguards including secure APIs, access controls, penetration testing, vulnerability management, audit logging and monitoring.

Retention

Personal Information is retained only while your account remains active, for legal compliance, for contractual purposes, to resolve disputes and for legitimate business purposes. Information is securely deleted or anonymised when no longer required.

Data Breach Response

Where a security compromise occurs, Ovitoz will investigate the incident and contain the breach while assessing the affected information. Affected users will be notified where a breach is material or notification is otherwise required. Where material or otherwise required, the Information Regulator will be notified where legally required. Corrective measures will be implemented and internal controls reviewed.

Messaging and Chatbot Consent

By selecting "I Agree", clicking "Start Chat", sending a message or continuing a chatbot conversation, you expressly consent to Ovitoz collecting information contained within messages, storing conversation history, processing your information using AI technologies, analysing messages to improve services, using conversations to resolve support requests, and transferring messages to human support agents where necessary.

• chatbot conversations may be generated using artificial intelligence;
• conversations may be quality-reviewed;
• messaging service providers process message metadata;
• conversations may be securely retained.

Marketing communications will only be sent where you have separately opted in or where otherwise permitted by applicable law. You may withdraw Chatbot consent at any time.

Cookie, Pixel and Third-Party Tracking Consent

Optional marketing and attribution tracking is subject to a separate opt-in. Before Ovitoz activates the Meta Pixel or another non-essential third-party tracking technology that transmits Personal Information or online identifiers for marketing or attribution purposes, you will be asked to make an affirmative choice through the cookie consent banner or preference centre. For the avoidance of doubt, creating an Ovitoz account, joining the rewards Programme, continuing to browse the Platform or accepting the general Privacy Policy does not, in itself, constitute consent to Meta Pixel or other optional third-party marketing tracking. Such consent must be obtained separately before the relevant processing begins.

Special Personal Information Consent (Sections 26, 27 and 32 of POPIA)

This Health-Related Data Processing Consent applies to all users of the Ovitoz Platform who choose to access wellness, health, fitness, rewards or AI-powered health functionality. By creating an Ovitoz account, joining the rewards Programme, enabling health telemetry, permitting location services, linking third-party accounts, interacting with AI-powered services or chatbots, or otherwise using the Platform, you acknowledge that you have read and understood this Privacy Policy and consent to the processing of your Personal Information to the extent that consent is the applicable lawful basis under POPIA.

What we collect

When you use the Chat Hub we process and store the messages you send, the groups you create or join, your group role (member, admin or creator), and the display name and profile photograph you choose to show other members.

Message reports

Any member can report a message using the "Report Message" option. When a message is reported we store the reported message content, the reason selected (Spam, Discrimination, Explicit Content or Harassment), the identity of the reporter and the identity of the author, so that moderators can review the report.

Automated content screening

Messages are screened automatically before they are posted. The screening checks for hate speech and racial discrimination (including obfuscated spellings), explicit or sexual content, spam and phishing links (only approved domains are permitted; link shorteners and suspicious domains are blocked), promotional scam patterns, message flooding and duplicate messages. Messages that fail screening are blocked and the sender is shown a notice that the message was blocked under the Ovitoz Community Guidelines.

Moderation actions and records

Group creators, admins and Ovitoz moderators can review reported and auto-blocked content in a moderation queue and may warn, mute or ban a member, or dismiss a report. We retain moderation records (reports, blocks and the actions taken) for as long as needed to enforce the Community Guidelines, resolve disputes and meet legal obligations, after which they are securely deleted or anonymised.

Your responsibility

You remain responsible for the content you post. Do not share personal information about yourself or others in group messages that you are not comfortable other members seeing. Message content is visible to members of the groups you join.