1. About this policy
Care Ops (the Platform) is an insurance administration platform operated by West Technology Group (Pty) Ltd (registration 2023/0672402/07), of 4 Montrose St, Newlands, Cape Town, 7700, South Africa (we, us). We provide it to insurance schemes, underwriters, administrators, brokers and employers (each a Tenant), who use it to administer cover for their members.
This policy applies to everybody whose personal information is on the Platform:
- Members: policyholders, their spouses, children and other dependants, and people who apply for cover, enrol through an employer or use the member portal.
- Employers: HR and payroll contacts who use the employer portal.
- Staff: people who sign in to manage policies for a Tenant, including brokers and agents.
Who is responsible for your information
For members and employers, the Tenant whose scheme or product you are on is the responsible party under the Protection of Personal Information Act 4 of 2013 (POPIA): it decides why and how your information is processed. We are its operator: we process your information only on its instructions and under a written agreement that requires the security measures in section 19 of POPIA. For staff accounts, the security of the Platform and the AI features described in section 5, we are also a responsible party in our own right.
The "In short" notes in this policy are there to help you find your way. They are not part of the policy; where a note and the text differ, the text applies.
2. Information we collect
Members and the people on a policy
- Names, title, sex, date of birth, and South African identity or passport number.
- Mobile number, email address, residential and postal address.
- Relationship to the main member, and the people a policyholder adds as beneficiaries.
- Policy details: scheme, product, plan, cover dates, status, premiums and payment history.
- Employment details where cover is through an employer: employee number and the rows of the payroll files the employer provides.
- Signatures on applications and declarations, with the time and device they were given on.
- Documents you or the scheme upload, messages you send and receive, and membership cards.
- Details of a third party who pays the premium, where somebody else pays for the cover.
Health information
Where a product needs it, the health questions record medical conditions (with diagnosis codes), medication, procedures, hospital admissions and pregnancy, a transcript of the health interview, and the risk analysis made from these answers. Health information is special personal information under POPIA and is processed only as section 5 describes.
Payments
Card payments are taken on Paystack's own secure form. We never see or store a full card number; we keep the token Paystack returns, the card type, the last digits and expiry date, and the payment email. For employers, we keep the bank account their premiums are collected from.
Employers and staff
- Name, work email, phone number, role, and the organisations and schemes you work for.
- Sign-in credentials: a password hash (never the password), second-factor settings and passkey public keys.
- Bank account details for brokers who are paid commission.
Collected automatically
- Your IP address, browser and device type, and the approximate country or network you sign in from, so that we can tell you about sign-ins from a new device or place.
- For staff only: a device fingerprint, used only for security, as described below.
- A record of what is viewed, changed, exported or unlocked, and by whom (the audit trail).
- For staff only: recordings of how the staff app is used, with all text and form fields masked, kept for 30 days to find and fix faults. Member, applicant and employer screens are never recorded.
Device fingerprinting, for security only
When you open the staff sign-in page, and once each time you open the staff app in a new tab, the Platform reads characteristics of your browser and device. These include your screen size, number of processor cores and memory, graphics hardware, installed fonts and system voices, timezone and language, the browser's version and features, and how your device draws a small test image and processes a silent test sound. Each characteristic is turned into a one-way code (a hash) on your device, before anything is sent. Together the codes make up a device fingerprint. The Platform also gives your browser a random device identifier, kept in the care-ops.device cookie.
These are used only to keep accounts secure:
- to recognise a device you have signed in from before, and tell you when an unfamiliar one signs in to your account;
- to notice a browser that is disguising what it is, or is being controlled by automation software rather than a person;
- to notice when a signed-in session is used on a different device from the one it was started on, which is what a stolen session looks like.
They are never used for advertising, analytics or profiling, or to recognise you on other websites. They are not shared with or sold to anyone, and they are not combined with information from outside the Platform. We store the codes and a few general details: the browser and operating system, the graphics hardware, the timezone and the screen size. The characteristics themselves are not stored. Member, applicant and employer sign-ins do not use device fingerprinting.
We do not collect information about race, religion, political views, trade union membership or sex life, and we do not use advertising or tracking technology. Device fingerprinting is a security measure, not tracking: it never leaves the Platform and is never used to follow you anywhere else.
3. Where it comes from
- From you, when you apply, enrol, sign in, answer the health questions or send us a message.
- From the main member, who gives the details of the people they add to a policy (see section 11).
- From your employer, in the employee and payroll files it provides for group cover.
- From the scheme, its administrator or broker, who enter or import policies and receive updates from their policy administration system.
- From your device, as section 2 describes.
4. Why it is used
| Purpose | Lawful basis (POPIA section 11) |
|---|---|
| Applying for, enrolling in, registering and administering cover | Necessary for the contract of cover you are party to |
| Assessing health answers for underwriting | Your consent (POPIA section 27), and section 32 for insurers assessing risk |
| Collecting premiums and handling payments | Necessary for the contract |
| Sign-in codes, policy updates, payment notices and reminders | Necessary for the contract |
| Paying broker commission | Necessary for the contract with the broker |
| Security: sign-in checks, device fingerprinting, the audit trail, fault finding and fraud prevention | Legitimate interest of the Tenant and of us |
| Keeping records the law requires (including insurance, tax and anti-money-laundering law) | Legal obligation |
We do not sell personal information, use it for advertising, or use it for any purpose other than these. Device fingerprints are used for security alone, and never for any other purpose in this table.
5. AI on the Platform
Draft, pending legal review (consent version 2026-10-draft-2).
The health questions
When cover needs health questions answered, they are asked by an AI assistant. The assistant is run by Anthropic PBC, in the United States, on our behalf.
The assistant is told:
- the first name, age, sex and relationship of each person on your policy; and
- the answers you give to the health questions.
It is never told surnames, ID numbers, contact details, addresses or dates of birth. If you type an ID number, an email address or a phone number into your answers, we remove it before it is stored or sent.
Why, and on what basis
The assistant uses this only to ask the right follow-up questions and to put your answers in order for the underwriter who assesses your cover. Your answers about health are special personal information, and sending them to the United States is a transfer outside South Africa under section 72 of POPIA. We rely on your consent for it, and Anthropic is bound by an agreement with us to protect the information, to use it only to provide the service, and not to use it to train its AI.
The AI does not decide your cover. A risk analysis of your answers, with names removed, helps the underwriter; the decision is made by a person, and you may ask for it to be explained and put your view (section 71 of POPIA).
Agreeing
By continuing past the first screen of a sign-up, you agree to this, for yourself and for each person you add to your policy, as their parent or guardian or with their agreement. Please add somebody only if you may agree for them.
If you don't agree, or change your mind
If you don't agree, the health questions are not asked online, and the scheme will help you answer them another way; your cover can start only once they are answered. You can withdraw at any time with the Withdraw consent link on the health questions screen, or by contacting the scheme or our Information Officer at matthew@w-tg.co.za. Withdrawing stops the AI from processing anything more; it does not undo what was processed before.
Other AI features that may involve your information
Staff and employers also use AI features that may touch your information. None of them runs for an organisation until it has accepted our AI operator agreement, and identity numbers and contact details are masked unless the person using the feature may see them.
| Feature | What is sent |
|---|---|
| Health risk analysis | Disclosed conditions, medications, procedures and risk flags, with each person's age, sex and relationship. No names: any name in the free text is replaced with the person's relationship, and typed ID numbers, email addresses and phone numbers are removed. |
| Staff assistant and workplace assistant | What staff or employer contacts type, and the records the assistant reads to answer: policies, members, payments, commission, groups. Identity numbers and contact details are masked unless the user may see them. |
| Assistant titles, routing and history compaction | The text of an assistant conversation. |
| Proxy mail summaries | The body of an email sent to a policy's proxy address. |
| ChatFlow AI steps | The text of a WhatsApp message a member sends to a flow with an AI step, up to 4,000 characters. |
| Policy import mapping and review | Column headings, distinct coded values (products, sex, relationships) and column profiles. Names, ID numbers, phone numbers, emails and free text are replaced with tokens before they are sent. |
| Dashboard copy | A staff member's role and a summary of which parts of the app they use most. |
Dictating to the staff assistant uses your browser's own speech recognition, which your browser's maker (for example Google or Apple) provides; the audio does not pass through the Platform. See section 8.1 of our PAIA and POPIA manual for the full list.
6. Who it is shared with
- The scheme, its underwriter, administrator and your broker, to the extent each needs it for your cover. Staff see only what their role allows; identity numbers, contact details and health information are hidden unless their role permits them and, where it requires, they confirm who they are again.
- Your employer, for group cover: who is covered, the plan and the premium. Your employer does not see your health answers.
- The policy administration system the scheme uses, which registers your cover and collects premiums. This includes the health answers the insurer needs to accept the cover.
- Our service providers, listed in section 7, each bound by a written agreement to process your information only for us and to keep it secure.
- Authorities, where a law, court order or regulator requires it.
- A buyer of our business, who would be bound by this policy.
7. Where it is stored, and transfers abroad
All personal information stored by the Platform, including its databases, files, backups and logs, is kept in Amazon Web Services' Cape Town, South Africa (af-south-1) region. It is copied across 3 separate data centres in that region so that the loss of one does not lose data, and backups stay in the same region. We do not copy it to another country.
Some services process information outside South Africa when you use them:
| Provider | What for | What it receives |
|---|---|---|
| Anthropic PBC | AI features (see section 5) | Only what each AI feature sends, minimised as described |
| Meta Platforms (WhatsApp Business) | WhatsApp messages, sign-in codes and conversations | Phone numbers, message text and attachments |
| Paystack | Card payments, subscriptions and bank account checks | Email address, payment details entered on Paystack's own form, employer bank account details |
| Address lookup, staff sign-in with Google, Google Wallet cards | Address text as it is typed, a staff member's Google identity, the name and number on a membership card | |
| Microsoft | Staff sign-in with Microsoft, importing files from OneDrive or SharePoint | A staff member's Microsoft identity; the file a staff member chooses to import |
| Apple | Apple Wallet membership cards | The name and number on a membership card |
We transfer information abroad only as section 72 of POPIA allows: under a binding agreement that gives protection substantially similar to POPIA, with your consent, or where the transfer is needed for your contract (for example sending a WhatsApp message you asked for).
8. How it is protected
- Encryption in transit: every connection to the Platform uses TLS 1.2 or higher. Our servers sit in a private network that cannot be reached from the internet.
- Encryption at rest: disks, files and backups are encrypted with AES-256 keys held in a key management service. Identity numbers, names, dates of birth, contact details, addresses, health answers, bank details, signatures and message contents are encrypted again, field by field, inside the database (AES-256-GCM), and identity numbers are searched without being decrypted.
- Sign-in: passwords are stored only as a salted hash (scrypt); staff can use passkeys and authenticator apps, and an organisation can require them. Members and employers sign in with a one-time code. Repeated attempts are slowed and blocked, and you are told about sign-ins from a new device or place. For staff, each session is tied to the device it was signed in on, using the device fingerprint in section 2, and you are told if the session is used anywhere else or if a sign-in looks automated or disguised.
- Need-to-know access: fine-grained permissions limit each person to the schemes, groups and records their role covers. Seeing unmasked personal information, exporting it or answering a privacy request needs a specific permission and, often, confirming who you are again.
- Audit trail: views of personal information, changes, exports and sign-ins are recorded, and the record cannot be altered or deleted by the application.
- Protection at the edge: a web application firewall, rate limits and strict browser security policies guard every page.
- Resilience: the database is copied continuously to a standby in another data centre, backed up daily with point-in-time recovery for 35 days, and restores are tested every week.
No system is perfectly secure. Section 14 explains what happens if something goes wrong.
9. How long it is kept
We keep personal information only as long as it is needed for the purposes in section 4, or as long as the law or the Tenant's record-keeping duties require (section 14 of POPIA). The Tenant may set different periods for its own records.
| Information | Kept for |
|---|---|
| Policy, member and beneficiary records, including health information | For as long as the cover lasts and afterwards for as long as the scheme must keep them, usually at least five years. Then deleted or anonymised on the scheme's instruction or a valid request. |
| Audit trail and sign-in activity | 7 years |
| Email, SMS and WhatsApp message logs | 2 years |
| Sign-in sessions, sign-up and enrolment journeys, signing links | 90 days after they end |
| One-time codes | 10 minutes (15 minutes for employer sign-in links) |
| Files uploaded to start an import | 7 days after the import ends |
| Staff screen recordings | 30 days |
| Staff browser error logs | 1 year |
| Recognised devices, device fingerprints and sign-in locations | 400 days after last seen |
| A device fingerprint from a sign-in page that was not used to sign in | 1 day |
| Server logs | 14 days, without the contents of database queries |
| Assistant conversations | Until the staff member deletes them, or the record they name is erased |
| Database backups | 35 days |
| Earlier versions of changed or deleted files | 30 days |
When information is erased, copies in backups and earlier file versions are not changed but are deleted as those age out, within 35 days.
10. Your rights
Under POPIA you may:
- Know whether we hold information about you, and get a copy of it.
- Correct information that is wrong, out of date or incomplete.
- Ask for it to be erased where it is no longer needed or was obtained unlawfully.
- Object to processing based on legitimate interest.
- Withdraw consent at any time where we rely on it, without affecting what was done before.
- Not be subject to a decision based solely on automated processing; see section 5.
- Complain to the Information Regulator (section 16).
How to ask
Ask the scheme, your broker or your employer, or email our Information Officer at matthew@w-tg.co.za. You can correct your contact details and address yourself in the member portal. We will confirm who you are before we act, record your request, and answer within 30 days.
- A copy of your information is given to you in a readable file (spreadsheet or JSON) covering every policy you are on with that scheme.
- Erasure is done by removing your identifying details and deleting your health answers, documents, messages and recordings. It cannot be done while you still have cover, because the cover cannot be administered without them, and the audit trail is kept for its full period because the law requires it.
Requests for records under the Promotion of Access to Information Act follow our PAIA and POPIA manual.
11. Children and people you add
The Platform is not meant for children to use. Children appear on policies because a parent or guardian adds them, and their information is processed with that person's consent (section 35 of POPIA). When you add a spouse or another adult, you confirm that they know and have agreed, or that you may act for them, and you should point them to this policy.
12. Cookies and browser storage
The Platform sets only first-party cookies that it needs to keep you signed in, finish a sign-in or keep your place in a form. They are sent only over encrypted connections. We do not use analytics, advertising or third-party tracking cookies, and pages load no outside tracking scripts.
Staff sign-in
| Cookie | Purpose | Lasts |
|---|---|---|
care-ops.session_token |
Keeps you signed in | 7 days |
care-ops.session_data |
Short cache of your session, to keep pages fast | 1 minute |
care-ops.accounts |
Remembers which accounts signed in on this browser | 90 days |
care-ops.device |
A random identifier for this browser, used only for sign-in security (see section 2) | 400 days |
care-ops.auth-intent |
Finishes a sign-in with Google or Microsoft | 30 minutes |
two_factor |
Carries a sign-in through its second step | 10 minutes |
pii_unlock_token |
Shows personal information you unlocked | 15 minutes |
secrets_unlock_token |
Shows settings you unlocked | 15 minutes |
co_db_primary |
Reads back a change you just saved | 5 seconds |
sidebar:state |
Remembers whether the side menu is open | 7 days |
Members and applicants
| Cookie | Purpose | Lasts |
|---|---|---|
member_portal |
Keeps you signed in to the member portal | 30 days |
retail_journey |
Keeps your place in an application for cover | 14 days |
enrol_session, enrol_link, enrol_invite |
Keeps your place in an enrolment through your employer | 14 days |
apply_session |
Keeps an employer's place in an application for group cover | 30 days |
Employers
| Cookie | Purpose | Lasts |
|---|---|---|
workplace |
Keeps you signed in to the employer portal | 30 days |
workplace_sign_in, workplace_hint |
Finishes a sign-in from an emailed link | Up to 1 hour |
workplace.accounts |
Remembers which accounts signed in on this browser | 90 days |
workplace_theme |
Remembers light or dark mode | 1 year |
The staff app also keeps small display preferences (such as panel positions) in your browser's storage, and an offline copy of the app's own files so that it loads quickly. Neither holds personal information about members.
13. Messages we send
On the scheme's behalf, the Platform sends sign-in codes, confirmations, policy and payment updates, and reminders about an application or enrolment you started. Codes go by WhatsApp first and by SMS if WhatsApp is not available. We do not send marketing on our own behalf. If a scheme sends you marketing, it must do so lawfully and let you opt out in every message.
14. If something goes wrong
If we have reason to believe personal information has been accessed or acquired by an unauthorised person, we tell the Tenant at once so that it can notify the Information Regulator and you, as section 22 of POPIA requires, and where we are the responsible party we notify them ourselves. The notice says what happened, what may be affected, what we are doing and what you can do to protect yourself.
15. Changes to this policy
We update this policy when what we do changes. We tell Tenant administrators about material changes by email at least 30 days before they take effect, unless a change is required sooner by law or for security. Where a change needs your consent, we will ask for it again. The current version is always on this page, and earlier versions can be read from its version history.
16. Contact and complaints
Information Officer, West Technology Group (Pty) Ltd
Matthew Nico van der Westhuizen
Email: matthew@w-tg.co.za
4 Montrose St, Newlands, Cape Town, 7700, South Africa
If you are not satisfied with our answer, you may complain to the Information Regulator; its details are in section 12 of our PAIA and POPIA manual.