Privacy Policy

1. Introduction

RAZICE respects your privacy and is committed to processing personal information responsibly and in accordance with applicable data protection law, including the Protection of Personal Information Act, 4 of 2013 (“POPIA”), where applicable.

This Privacy Policy explains what personal information we may collect, why we process it, how it may be used or shared, how we protect it, and the choices and rights available to you.

2. Who This Policy Applies To

This Policy applies to users of the RAZICE websites, applications, QR-enabled products and related services, as well as people whose information is placed on a RAZICE profile by an authorised parent, guardian, representative or organisation.

3. Information We May Collect

Depending on how you use RAZICE, we may process:

• Account information, such as your name, email address, telephone number and login details.
• Identification information supplied for a RAZICE profile.
• Emergency contact information, including names, relationships and contact details.
• Health and medical information, such as medical conditions, allergies, medications, blood group, medical history and other information you choose to provide.
• Information about children or dependants where supplied by an authorised parent, guardian or representative.
• Product and QR information, including identifiers associated with a RAZICE tag, bracelet, card or other product.
• Technical and usage information, such as IP address, browser or device information, security logs, timestamps and information about interactions with our Services.
• Transaction information relating to purchases, subscriptions, delivery and payments. Full payment-card information may be processed directly by our payment provider rather than stored by RAZICE.
• Communications you send to us, including support requests and other correspondence.

4. Special Personal Information

Health and medical information may constitute special personal information under applicable law. RAZICE processes this information only where there is an appropriate lawful basis or authorisation to do so.

Because a core purpose of RAZICE is to make selected emergency information accessible when needed, users should carefully choose what health or other sensitive information they place in a profile and what they make accessible through a QR code.

5. Why We Process Personal Information

We may process personal information to create and manage accounts and profiles; associate QR-enabled products with profiles; make user-selected emergency information accessible; provide customer support; process orders and payments; communicate service and security notices; prevent fraud and misuse; maintain, secure and improve the Services; comply with legal obligations; and establish, exercise or defend legal rights.

6. Legal Basis and Authorisation

Where applicable law requires a lawful basis or authorisation for processing, RAZICE will rely on the basis appropriate to the circumstances. This may include consent, performance of an agreement, compliance with a legal obligation, protection of legitimate interests permitted by law, or another basis recognised by applicable law.

Consent is not necessarily the legal basis for every processing activity. Where consent is specifically required, it will be requested in an appropriate manner.

7. Emergency Access and QR Codes

A key feature of RAZICE is the ability to make selected information accessible by scanning a QR code or using another identifier. Information configured for this purpose may be viewed by a person who scans or otherwise accesses that identifier.

You should therefore treat a physical RAZICE QR code as potentially accessible to anyone who encounters it and avoid making information available that you do not want accessible in this way. Where privacy controls are provided, you are responsible for selecting settings appropriate to your circumstances.

8. Information About Other People

If you provide personal information about another person, you must have the legal authority or other lawful basis required to do so. This includes emergency contact details and profiles created for children, dependants or other persons.

Where reasonably appropriate, you should ensure that the person concerned knows that their information has been supplied to RAZICE.

9. Children

Where RAZICE permits information about a child to be stored, the profile must be created or managed by a parent, legal guardian or other person legally authorised to act on the child's behalf, unless applicable law permits otherwise.

We may introduce additional age, consent or verification controls where required by law or appropriate to the Services.

10. How We May Share Information

We do not sell personal information. We may disclose personal information where reasonably necessary to:

• make user-selected emergency information available through the RAZICE service;
• work with service providers that support hosting, infrastructure, email, communications, payment processing, delivery, analytics, security or customer support;
• comply with a legal obligation, court order or lawful request;
• investigate fraud, security incidents or misuse;
• protect the rights, safety or security of users, RAZICE or others where permitted by law; or
• complete a legitimate corporate transaction, subject to appropriate legal and privacy safeguards.

Service providers are expected to process information only for authorised purposes and subject to appropriate contractual and security requirements where required.

11. International Processing and Transfers

Some technology or service providers may process information outside South Africa. Where personal information is transferred across borders, RAZICE will take steps required by applicable law to ensure that the transfer has an appropriate legal basis and level of protection.

12. Information Security

RAZICE uses reasonable technical and organisational safeguards designed to protect personal information against loss, unauthorised access, interference, alteration, disclosure or destruction.

Measures may include access controls, authentication, encryption where appropriate, logging, backups, secure infrastructure, vulnerability management and restrictions on access to personal information. No online system can, however, guarantee absolute security.

13. Data Breaches and Security Incidents

If a security compromise affecting personal information occurs, RAZICE will investigate and take reasonable steps to contain and remediate it. Where notification to affected persons or a regulator is required by applicable law, we will make the required notifications in accordance with that law.

14. Retention

We retain personal information only for as long as reasonably necessary for the purpose for which it was collected, to provide the Services, meet legal or regulatory requirements, resolve disputes, maintain appropriate business records or establish, exercise or defend legal rights.

Information may be retained for a limited period in backups or security records after deletion from active systems where reasonably necessary and permitted by law.

15. Your Rights

Subject to applicable law and any relevant exceptions, you may have the right to request access to personal information we hold about you; request correction or updating of inaccurate information; request deletion or destruction where legally applicable; object to certain processing; withdraw consent where processing depends on consent; and complain to the relevant data protection regulator.

We may need to verify your identity before acting on a privacy request, particularly where medical or other sensitive information is involved.

16. Updating Your Information

Where account functionality permits, you may update information directly through your RAZICE account. You should keep emergency and medical information current because outdated information may reduce the usefulness of the service in an emergency.

17. Cookies and Similar Technologies

RAZICE may use cookies or similar technologies that are necessary for authentication, security, preferences and operation of the Services. Where analytics, advertising or other non-essential technologies are introduced, additional information and consent choices will be provided where required by law.

18. Marketing

RAZICE may send marketing communications where permitted by law. Where consent is required, we will request it. You may opt out of marketing communications using the unsubscribe mechanism provided or by contacting us. Service, transactional and security communications may still be sent where necessary.

19. Third-Party Websites and Services

Our Services may contain links to or integrate with third-party services. Their handling of personal information is governed by their own privacy practices. We encourage you to review those policies before providing information directly to a third party.

20. Automated Decision-Making

RAZICE does not intend information displayed through an emergency profile to constitute an automated medical diagnosis or treatment decision. Healthcare and emergency decisions remain the responsibility of appropriately qualified or authorised persons.

21. Changes to This Privacy Policy

We may update this Privacy Policy as our Services, legal obligations or data practices change. The current version will be published on our website with its last-updated date. We will provide additional notice of material changes where required by law.

22. Information Regulator

If you believe that your personal information has been processed in a manner that infringes applicable South African data protection law, you may have the right to lodge a complaint with South Africa's Information Regulator. You may also contact RAZICE first so that we can investigate and attempt to address your concern.