Privacy Policy

1. Who We Are

Workmedix ("we", "our", "us") is a South African occupational health screening service provider. We are the Responsible Party for your personal information as defined under the Protection of Personal Information Act 4 of 2013 (POPIA).

Contact: info@workmedix.co.za  |  074 716 3079  |  Johannesburg, Gauteng, South Africa

2. Information We Collect

We collect only the personal information necessary to provide our services:

• Account data: name, email address, company name, password (hashed — never stored in plain text)
• Contact enquiries: name, company, email, phone number, service interest, message content
• Screening records: health screening results, medical certificates, and related occupational health documents uploaded by authorised users
• Usage data: standard server logs (IP address, browser type, pages visited) for security and performance monitoring

3. How We Use Your Information

Your information is used exclusively to:

• Provide and manage occupational health screening services
• Respond to your enquiries and communicate with you
• Maintain and secure your client portal account
• Comply with legal and regulatory obligations (including the Occupational Health and Safety Act)
• Improve the performance and security of our platform

We do not sell, rent, or trade your personal information to any third party.

4. Legal Basis for Processing

We process your personal information on the following lawful grounds under POPIA:

• Contract: to fulfil our service agreement with you
• Legitimate interest: to maintain platform security and communicate relevant service updates
• Consent: for optional communications (you may withdraw consent at any time)
• Legal obligation: where required by South African law

5. Data Storage & Security

Your data is stored on secure cloud infrastructure (Railway, hosted in managed data centres). We implement industry-standard safeguards including:

• HTTPS/TLS encryption for all data in transit
• Bcrypt password hashing (cost factor 12)
• HTTP-only, secure, SameSite session cookies
• Strict security headers (CSP, HSTS, X-Frame-Options)
• Rate limiting on authentication and contact endpoints
• Role-based access control (admin vs. client)

6. Data Retention

We retain personal information only for as long as necessary:

• Account data: for the duration of your account plus 3 years after closure
• Screening records: as required by applicable occupational health regulations (typically 5–40 years depending on record type)
• Contact enquiries: 2 years
• Server logs: 90 days

7. Your Rights Under POPIA

You have the right to:

• Request access to your personal information
• Request correction of inaccurate information
• Request deletion of your information (subject to legal retention obligations)
• Object to processing of your information
• Lodge a complaint with the Information Regulator of South Africa at inforegulator.org.za

To exercise any right, email us at info@workmedix.co.za. We will respond within 30 days.

8. Cookies

We use only one cookie: a session cookie (wm.sid) to maintain your logged-in state. It is HTTP-only, secure, and expires after 24 hours. We do not use tracking cookies, advertising cookies, or third-party analytics.

9. Third-Party Services

We use the following trusted services:

• Railway: cloud hosting infrastructure
• Google Fonts: typography (loaded client-side)
• Resend / SMTP: transactional email delivery only

10. Children's Privacy

Our services are directed at corporate clients and are not intended for individuals under 18. We do not knowingly collect information from minors.

11. Changes to This Policy

We may update this policy from time to time. The "Last updated" date at the top reflects the most recent revision. Continued use of the platform after changes constitutes acceptance.

12. Contact & Complaints

For any privacy-related query or to exercise your rights:

Workmedix
Email: info@workmedix.co.za
Phone: 074 716 3079
Johannesburg, Gauteng, South Africa