Privacy Policy

This policy explains what personal information Health and Wealth (Pty) Ltd (“Health & Wealth”, “we”, “us”) collects through the Health & Wealth Systems distributor portal, its WhatsApp assistant, and its mobile app (together, the “Service”), why we collect it, and the choices you have. It applies to distributors who use the Service and to customers who interact with it through WhatsApp or a logged sale.

1. Information we collect

If you're a distributor:

• Your name, surname, cellphone number, and address
• Your APLGO member ID and a securely hashed password (we never store your actual password)
• Your sales, stock, and team records, and who referred you
• Whether your WhatsApp number has an active conversation with our assistant
• If you use the mobile app: a device token used to deliver push notifications (not yet active — see Section 3)
• Login activity: timestamp, success/failure, and IP address, kept for account security

If you're a customer of a distributor:

• Your name, surname, cellphone number, and delivery address, collected when a sale is logged
• Messages exchanged with our WhatsApp assistant, and your reply to a post-sale satisfaction check if you respond to one

2. How we use it

• To run the distributor network: logging sales, tracking stock, and managing teams
• To send WhatsApp messages you'd expect: order confirmations, delivery updates, follow-up check-ins, and account notifications
• To verify an address when logging a delivery, using a one-time address lookup (see Section 4)
• To keep accounts secure, including detecting unusual login activity
• To generate internal business reports for authorized administrators — these summarize records already described above, not new data collected about you

3. Push notifications

The mobile app can register your device to receive push notifications (for things like stock alerts or follow-up reminders). As of this version, sending notifications isn't switched on yet — registering only stores a device token against your account for when it is. You can decline the notification permission on your device at any time without losing access to the app.

4. Who we share it with

We don't sell personal information. We share it only with the service providers that make the Service work, each limited to what their function needs:

• Meta (WhatsApp Business Platform)— to send and receive the WhatsApp messages described above. Meta's own privacy policy also applies to that channel.
• Make.com — the automation platform that runs our WhatsApp assistant and stores the records it needs to hold a conversation.
• PayFast — a South African payment gateway that processes payments; we receive a payment reference and status, never your card details.
• OpenStreetMap (Nominatim) — a free address-lookup service used only to suggest and confirm a delivery address as you type one; the text you type is sent to it to get suggestions back.
• Anthropic — powers the in-portal assistant and the executive report builder. Prompts sent to it are limited to what you type into those tools and the business records needed to answer a report query.
• Vercel — hosts the Service and, like any web host, processes standard connection logs (IP address, timestamp) to serve pages and keep the Service running.
• Google / Apple push services (once push notifications are switched on) — deliver notifications to your device via Firebase Cloud Messaging or Apple Push Notification service.

We may also disclose information if required by law, or to protect the rights, property, or safety of Health & Wealth, our distributors, or the public.

5. How long we keep it

We keep distributor and sales records for as long as the account is active and for a reasonable period afterward for tax, accounting, and dispute-resolution purposes. Login security logs are kept only as long as needed to detect and investigate suspicious activity. If you close your account, we stop using your information for anything beyond what the law requires us to retain.

6. Your rights

Under South Africa's Protection of Personal Information Act (POPIA), you can ask us to confirm what personal information we hold about you, request a copy of it, ask us to correct or delete it, and object to how we use it, subject to the exceptions the Act allows (for example, records we're legally required to keep). To exercise any of these, contact us using the details in Section 9.

7. Security

Passwords are never stored in plain text. Access to administrative functions is restricted by account role, and sessions expire automatically after a period of inactivity. No system is perfectly secure, but we take reasonable technical and organizational measures to protect the information described in this policy.

8. Children

The Service is intended for adults operating or purchasing from a distributor business and isn't directed at children. We don't knowingly collect personal information from children.

9. Contact us

Questions about this policy, or a request relating to your information, can be sent to musa@gohealthsweets.co.za.

Information Officer: [name to be designated] — required under POPIA; update this line once someone is formally appointed.

10. Changes to this policy

If we change what we collect or how we use it, we'll update this page and change the effective date above. Continued use of the Service after a change means you accept the updated policy.