Privacy Notice

1. Who we are MedPoint-Consulting (Pty) Ltd (registration number 2026/672906/07, registered with the South African Companies and Intellectual Property Commission) provides MedStock and is the data controller for personal data processed through the Service. Contact us at hello@medpoint.health.

2. Personal data we collect - **Account data** — name, display name, email address, organisation, role and login credentials. - **Usage data** — pages viewed, actions taken, counting and movement activity, and the audit trail that records who performed each action. - **Technical data** — IP address, device and browser identifiers, and diagnostic logs. - **Support data** — messages, attachments and correspondence you send us.

We do not collect card details. Payments are handled by Paddle as Merchant of Record.

3. Why we use it and our legal basis - Creating and administering accounts, and providing the Service — performance of our contract with you. - Maintaining the audit trail and enforcing access controls — legal obligation and our legitimate interest in traceable stock records. - Security, fraud prevention and abuse detection — legitimate interests. - Support and service communications — performance of contract. - Product improvement and aggregated analytics — legitimate interests. - Marketing emails, where applicable — consent, which you may withdraw at any time.

4. Who we share it with - **Service providers and subprocessors** — hosting, database, email delivery, error monitoring and support tooling, acting on our instructions. - **Paddle.com**, our Merchant of Record, for sale of subscriptions, subscription management, payments, tax compliance and invoicing. - **Professional advisers** — legal, accounting and audit. - **Authorities** — where required by law or to establish or defend legal claims.

We do not sell personal data.

5. International transfers Where personal data is transferred outside the UK or EEA, we rely on adequacy decisions or Standard Contractual Clauses together with appropriate technical safeguards.

6. Retention Account and audit data is kept for as long as your organisation holds an account, and for up to 12 months afterwards to meet legal, tax and dispute-resolution needs. Diagnostic logs are kept for a shorter period. Data is deleted or anonymised when it is no longer needed.

7. Your rights Subject to applicable law you may request access to your data, correction, erasure, restriction, portability, and object to processing based on legitimate interests. Where processing relies on consent, you can withdraw it at any time. Contact hello@medpoint.health; we respond within one month. You also have the right to complain to your data protection supervisory authority.

8. Security We apply appropriate technical and organisational measures, including encryption in transit, encryption at rest, row-level database isolation between organisations, role-based access control and audit logging.

9. Cookies We use essential cookies and local storage to keep you signed in and to remember interface preferences. Any analytics or marketing cookies are only set where permitted, and you can manage preferences through your browser settings.

10. Changes We will post updates to this notice here and, where the change is material, notify you in the app or by email.