Privacy Policy

2.1. “Affiliate” means a person or entity controlling, controlled by, or under common control with Universal;

2.2. “Applicable Law” means all data protection laws applicable to the gathering, storage and Processing of Personal Information on the one App Ecosystem, including the Constitution of the Republic of South Africa, 1996 (“the Constitution”), the Electronic Communications and Transactions Act, 2002 (No 25 of 2002) and the Accreditation Regulations promulgated in terms thereof (“ECTA”) and the Protection of Personal Information Act 2013 (No 4 of 2013) and the Regulations promulgated in terms thereof (“POPIA”);

2.3. “Authorised Administrative User” means a user authorised by the Client on written notice to Universal, to access the uWellness^® Program Overview via Universal’s Responsive Web Application and who has accepted the Terms of Use;

2.4. “Biometrics” means a technique of personal identification that is based on physical, physiological or behavioural characterisation, including facial recognition, blood typing, fingerprinting, DNA analysis, retinal scanning and voice recognition;

2.5. “Client” in respect of all Products (excluding uConsult™) means an employer group, a medical scheme, a health insurer or an occupational health product provider contracted to Universal and/or its Affiliates for access to such Products (excluding uConsult™);

2.6. “Data Subject” means the person to whom Personal Information relates;

2.7. “Disclosed Purpose” means the disclosed purpose as defined in paragraph 7 (DISCLOSED PURPOSE) below and where applicable, any additional disclosed purpose relevant to a specific Product as defined below;

2.8. “Personal Information” shall bear the meaning ascribed thereto in POPIA and includes any information relating to an identifiable, living, natural person, and where it is applicable, an identifiable, existing juristic person, including, but not limited to—
(a) information relating to the race, gender, sex, pregnancy, marital status, national, ethnic or social origin, colour, sexual orientation, age, physical or mental health, well-being, disability, religion, conscience, belief, culture, language and birth of the person; (b) information relating to the education or the medical, financial, criminal or employment history of the person; (c) any identifying number, symbol, e-mail address, physical address, telephone number, location information, online identifier or other particular assignment to the person; (d) Biometrics of the person; (e) the personal opinions, views or preferences of the person; (f) correspondence sent by the person that is implicitly or explicitly of a private or confidential nature or further correspondence that would reveal the contents of the original correspondence; (g) the views or opinions of another individual about the person; and (h) the name of the person if it appears with other personal information relating to the person or if the disclosure of the name itself would reveal information about the person;

2.9. “Policy” means this Data Protection and Privacy Policy of Universal;

2.10. “Processing” has the meaning given to it in POPIA and includes any operation or activity or any set of operations, whether or not by automatic means, concerning Personal Information, including- (a) the collection, receipt, recording, organisation, collation, storage, updating or modification, retrieval, alteration, consultation or use; (b) dissemination by means of transmission, distribution or making available in any other form; or (c) merging, linking, as well as restriction, degradation, erasure or destruction of information;

2.11. “Products” means the respective products and/or product features of the Universal.one App Ecosystem, namely the Membership App, uWellness®, uConsult™, uHealthChat™, uHealthCheck™, uSmartRecords™, uWellness® Program Overview, Health on Auto Pilot and Universal Rewards;

2.12. “Registered User” in respect of all Products (excluding uConsult™) means an adult person who has registered for the Products as selected by the Client in question and who has accepted the relevant Terms of Use, and in the instance of uConsult™ means an adult person who has registered for uConsult™ and who has accepted the relevant Terms of Use;

2.13. “RSA” means the Republic of South Africa;

2.14. “Special Personal Information” shall bear the meaning ascribed thereto in POPIA and includes any personal information concerning – (a) the religious or philosophical beliefs, race or ethnic origin, trade union membership, political persuasion, health or sex life or Biometrics of a Data Subject; or (b) the criminal behaviour of a Data Subject to the extent that such information relates to- (i) the alleged commission by a Data Subject of any offence; or (ii) any proceedings in respect of any offence allegedly committed by a Data Subject or the disposal of such proceedings;

2.15. “Terms of Use” means the terms on which a User may use the one App Ecosystem and any Products, as agreed and recorded and accessible on the Universal.one App Ecosystem;

2.16. “Third-Party Data Providers” means data sources with whom Universal has integrated to obtain eligibility data (including membership and employee information), wearable data and healthcare data, including but not limited to Affiliates, Clients, wearable device providers, medical schemes, medical scheme administrators, managed care organisations, healthcare providers and system administration vendors;

2.17. “Universal” or “we” or “us” or “our” means Universal.one, Inc, a Delaware corporation with its administrative headquarters and corporate seat at 68 T.W. Alexander Drive, Research Triangle Park, North Carolina, 27709, USA and its principal place of business at Suite 1200, 1 Embarcadero Center, San Francisco, CA 94111, USA, who is also the proprietor of the Universal.one App Ecosystem and its Products;

2.18. “Universal.one App Ecosystem” means the Universal.one App Ecosystem consisting of the Products;

2.19. “User” means collectively Authorised Administrative Users and Registered Users;

2.20. “You” or “Your” means a natural person –

2.20.1. who is the User of any Products of the Universal.one App Ecosystem and who has been registered on the Universal.one App Ecosystem for use thereof in accordance with the Disclosed Purpose; and

2.20.2. where applicable, expressly consents to his/her/their Personal Information being shared with Universal and its Affiliates on the Universal.one App Ecosystem by Third-Party Data Providers for the Disclosed Purpose.

3.1. This Policy applies to any Users and Third Parties as the context indicates.

3.2. This Policy does not apply to Personal Information that has been anonymised or de-identified (i.e. not identifiable to any individual) to such extent that it is incapable of being converted into re-identified information.

4.2. This Policy applies to you if you engage with Universal physically at its offices or virtually through its website (www.universal.one), email, the mobile and web applications of the one App Ecosystem, social media platforms, over the phone or otherwise as may be the case from time to time.

5.1. The right of privacy is enshrined in the Constitution which expressly states that everyone has the right to privacy. Universal therefore respects and recognises the importance of protecting your privacy and data.

5.2. Universal is committed to protecting and respecting your privacy rights and as such, is committed to and undertakes to adhere to the principles set out in this Policy and Applicable Law in the gathering, Processing, storage and disclosure of your Personal Information.

5.3. From time to time, Universal may employ the services of third parties to assist with the hosting, delivery and management of certain of Universal’s products and services. Universal applies every effort to ensure that its third-party service providers comply with this Policy and widely accepted security standards and that they will be accountable for any non-compliance.

6.1. The provisions of ECTA and POPIA are applicable to any Products delivered and services rendered by or on behalf of Universal, and without limiting the generality of the aforegoing, specifically the following provisions:

6.1.1. the definitions of ‘consent’, ‘data subject’, ‘electronic communication’, ‘filing system’, ‘personal information’, ‘private body’, processing’, ‘responsible party’ and ‘special personal information’ as defined in section 1 of POPIA;

6.1.2. the legal requirements for Processing, recording, transferring and storing Personal Information by a service provider in a foreign country;

6.1.3. the principles or provisions relating to electronic communications;

6.1.4. the consumer protection measures, including the protection of Personal Information;

6.1.5. the limitation by agreement of the liability of Universal as your service provider.

6.1.6. The aforementioned provisions may be viewed or downloaded from:

6.1.6.1. https://www.gov.za/documents/electronic-communications-and-transactions-act; and

6.1.6.2. https://www.gov.za/documents/protection-personal-information-act.

6.2. It is your responsibility to ensure that the copies downloaded or viewed as per paragraph 1.6 are the most recent versions of ECTA and POPIA.

7.1. The purpose of the one App Ecosystem and its Products, and the use thereof:

7.1.1. is for Users, who are entitled to do so, to access the Universal.one App Ecosystem and its Products, provided they comply with the registration requirements and accept the Terms of Use applicable then;

7.1.2. is for Universal to transfer and store the Personal Information of Users with their express specific consent with a third-party service provider in a foreign country nominated by Universal in a manner which protects the Personal Information against disclosure to unauthorised third parties,

(“the Disclosed Purpose”).

8.1. The undermentioned disclosures are made by Universal as the owner of theone App Ecosystem and its Products, who Processes, transfers and retains the Personal Information:

8.1.1. disclosed by Users in terms of the registration process to be able to use the Universal.one App Ecosystem and its Products for its intended purpose; and

8.1.2. disclosed or created by Users while making use of the Universal.one App Ecosystem for any other purpose which may be made available by Universal via the Universal.one App Ecosystem from time to time, including but not limited to the updating of Personal Information.

9.1. You hereby agree that Universal may Process your Personal Information (including Special Personal Information) for the purpose of making the Universal.one App Ecosystem and its Products accessible to you and as necessary for pursuing any other legitimate business interests of Universal.

9.2. You furthermore understand that your Personal Information may from time to time reside outside the RSA and you hereby agree that your Personal Information may be transferred, stored and/or Processed in such locations for the purposes set out below.

9.3. Some of our Third-Party Data Providers are situated outside the RSA. You consent to your Personal Information (including account information, security credentials and personal health information) being transferred cross-border so that we can make the Universal.one App Ecosystem accessible to you.

9.4. You further agree that Universal may Process the following Personal Information about you:

9.4.1. registration and profile information: including name, surname, email address, physical home address (if applicable), cell phone number, date of birth, age, gender, emergency contact details (if applicable), medical scheme name (if applicable), medical scheme number (if applicable), profile picture (optional) and password, passkey and/or Biometrics you provide when you register to use the Universal.one App Ecosystem;

9.4.2. verification information: including identity number or passport number, medical scheme number (if applicable), employee number (if applicable), login credentials, and passwords;

9.4.3. demographic information: including date of birth and gender;

9.4.4. Membership App information: including membership profile, membership card information, benefits and plan information (for example real-time limits and balances & medical savings balances), claims submissions, tracking and history, location information for “close to me” features, authorisation request information, downloadable tax certificates, membership certificates and monthly and weekly statements;

9.4.5. wellness data integration information (uWellness®): including –

9.4.5.1. current and historic wearable information: including wearable device credentials; wearable data received from your wearable Third-Party Data Provider(s) such as activity data on steps / active minutes, exercise, height, weight, sleep, nutrition, blood pressure, heart rate, glucose, cholesterol, VO₂ max, body fat percentage;

9.4.5.2. goals information: including personalised goals to improve and maintain weight and hip measurements as well as your wellness such as completing a targeted number of steps within a set period;

9.4.5.3. consolidating lifestyle and vital readings from various other sources: including wellness days; and

9.4.5.4. self-reported information: including Personal Information reported using the mood checker and a range of wellness self-assessments and calculators addressing all 8 (eight) dimensions of wellness (namely emotional, physical, occupational, financial, intellectual, social, spiritual and environmental);

9.4.6. virtual consultation information (uConsult™): including consultation history information (including details of the specific provider visited, appointment dates, and times), clinical script information and certificate information (including electronic prescriptions and medical sick notes), referral letter information (including specialist referral letters and formal doctor correspondence), diagnostic request information (including request forms for pathology labs, radiology imaging and nuclear medicine) and financial information (including invoices and receipts for payment);

9.4.7. real-time nurse chat information (uHealthChat™): including personal health information disclosed by you to the nurse in the chat and the recommendations and/or referrals made by the nurse;

9.4.8. video-based health and wellness assessment tool information (uHealthCheck™): including a facial scan, vitals (including blood pressure & breathing rate), physiological indicators (including heart rate variability, vascular capacity & cardiac workload), mental health (including a mental stress index), physical indicators (including body mass index, facial skin age, waist-to-height ratio & body shape index), predictive blood markers (including Haemoglobin A1C Risk & fasting blood glucose risk), general health risks (including cardiovascular disease risk, heart attack risk & stroke risk), and metabolic risks (including hypertension, type 2 diabetes, hypercholesterolemia, hypertriglyceridemia & fatty liver disease);

9.4.9. current and historic healthcare information (uSmartRecords™): including vitals, dispensed medication, doctor consultations, hospital visits, laboratory services and results, radiology services and health risk assessment test results. Information displayed may include the medication, provider or tariff description, diagnosis, and service date;

9.4.10. reminder system information as set up by the Registered User or automated based on the Registered User’s Personal Information (Health on Auto Pilot): including provider and test reminder information as set up by a Registered User (including information regarding upcoming consultations and diagnostic test dates (for example pathology or radiology appointments), and provider details, medication reminder information (including the names, dosages and schedules of prescribed medications or supplements your input into the system), lifestyle and well-being reminder information (including self-reported lifestyle tracking metrics, such as hydration, physical activity schedules, or general wellness habits) and automated reminder information based on the Registered User’s Personal Information;

9.4.11. rewards program information (Universal Rewards Product): the Registered User can opt in for access to and direct marketing of the Universal Rewards Program using the Universal Rewards Product; and

9.4.12. any other Personal Information, as defined in POPIA, of a User required for the Disclosed Purpose.

9.5. Automated decision-making: We may facilitate the Processing of your Personal Information using automated means (without human intervention in the decision-making process) for a Client to make a decision about you or your application for any product or service of a Client of Universal. You may query the decision made about you.

9.6. Aggregated Data: Universal may also Process, collect, store and/or use aggregated data, which may include historical or statistical data (“Aggregated Data“) for any purpose, including for know-how, marketing, statistical and academic research purposes and to customise our products and services to meet your needs. Aggregated Data may be derived from your Personal Information but is not always considered Personal Information, as this data does not directly or indirectly reveal your identity. However, if we combine or connect Aggregated Data with your Personal Information in a manner that has the result that it can directly or indirectly identify you, we will treat the combined data as Personal Information, which will be managed in accordance with this Policy.

9.7. In addition, we may disclose your Personal Information to law enforcement, other government officials, or other third parties as may be necessary in connection with an investigation of fraud, intellectual property infringements, cyber crime, or other activity that is illegal or may expose us to legal liability.

9.8. Your privacy is important to us and we will therefore not sell, rent or provide your Personal Information to unauthorised third parties for their independent use, without your consent.

9.9. If we want to share your Personal Information for any other reason, we will do so only with your permission.

Where applicable and to the extent appropriate, to provide access to the Universal.one App Ecosystem, we need to share your Personal Information with the parties listed below, subject to the provisions of paragraph 13 (SECURITY SAFEGUARDS) and in addition to any legal justifications contained in Applicable Law. You consent to the sharing of your Personal Information with the following parties:

10.1. Universal Affiliates

10.1.1. We may share your Personal Information with our Affiliates, for purposes consistent with this Privacy Policy and subject to Applicable Law and data sharing agreements, including for the purposes of:

10.1.1.1. administration;

10.1.1.2. fraud prevention; and

10.1.1.3. the provision of services (currently provided through the one App Ecosystem as well as any additional services that may be provided through the Universal.one App Ecosystem from time to time).

10.2. Healthcare Providers

10.2.1. If you use the uConsult™ Product as a patient, we may share your Personal Information with your selected healthcare provider.

10.2.2. If you use the uHealthChat™ Product, we may share your Personal Information with the nurse accessible through the online real-time nurse chat.

10.3.Contracted Service Providers

10.3.1. We may share your Personal Information with contracted service providers that provide services on our behalf or help us operate the Universal.one App Ecosystem (including hosting, analytics, email and SMS delivery services).

10.3.2. These third parties may use your Personal Information only as directed or authorised by us and in a manner consistent with this Policy and data sharing agreements and are prohibited from using or disclosing your Personal Information for any other purpose.

11.1. Universal has a duty to take all reasonably practicable steps to ensure that your Personal Information is complete, accurate, not misleading and updated on a regular basis. To enable this, Universal will always endeavour to obtain Personal Information from you directly. Where Universal is unable to do so, it will make use of verifiable independent third-party data sources.

11.2. Universal shall, as far as possible, always collect Personal Information about you directly from you, except in the following circumstances:

11.2.1. where Personal Information is collected from a public record, or from another source if the information has already been made public by you;

11.2.2. where you have given your written consent to Universal to collect your Personal Information from another source, including Third-Party Data Providers;

11.2.3. where the collection of your Personal Information from another source will not prejudice any of your legitimate interests;

11.2.4. where the collection of Personal Information from another source is necessary to maintain Universal’s legitimate interests or those of any third party it intends sharing the information with;

11.2.5. where the collection of Personal Information directly from you would prejudice the purpose for the collection; and/or

11.2.6. where the collection of Personal Information directly from you is not reasonably practicable in the circumstances.

11.3. If Universal collects Personal Information from a source other than you, it shall record in writing the details of that source, including the full names and contact details of that source where applicable.

11.4. Apart from you giving us Personal Information about you, there are other sources that Universal may also get information from, such as Third-Party Data Providers. These sources are bound by their own promise to look after your information and make sure it is used in the correct way.

12.1. Universal shall not Process your Personal Information for any purpose not previously specified, except in the following circumstances:

12.1.1. where you have consented to such further Processing;

12.1.2. where the further Processing is necessary for the exercise of any contractual rights or the fulfilment of any obligations between Universal and yourself;

12.1.3. where the further Processing activities are linked to or compatible with the original purpose;

12.1.4. where the further Processing is necessary for the prevention, detection, investigation, prosecution and punishment of an offence;

12.1.5. where the further Processing is necessary to enforce any law;

12.1.6. where the further Processing is necessary for the conduct of legal proceedings in any court or tribunal that have commenced or are reasonably contemplated;

12.1.7. where the further Processing is necessary to prevent or mitigate a serious and imminent threat to your life or health or another individual; and/or

12.1.8. where the further Processing is necessary for historical, statistical or research purposes.

12.2. Your Personal Information will not be sold for commercial purposes. Your privacy is important to Universal and Universal will therefore not sell, rent or provide your Personal Information to unauthorised third parties for their independent use, without your consent.

12.3. Universal shall ensure that if it intends Processing Personal Information for other purposes not previously specified, it shall notify you of such further purposes and the possible consequences of the intended further Processing for you.

13.1. Universal will take appropriate, reasonable technical and organisational measures having regard to generally accepted practices and procedures, including, without limitation, all appropriate technical and organisational safeguards and controls it employs with respect to information of its own that it regards as confidential and proprietary, to: 

13.1.1. preserve and protect the integrity and confidentiality or proprietary nature of your Personal Information, and to prevent it from falling into the public domain or into the possession of persons not bound to maintain its confidentiality; and

13.1.2. prevent loss of, damage to or unauthorised destruction of your Personal Information.

13.2. Notwithstanding any other provision of this Policy, you acknowledge that the transmission of information, including Personal Information, whether in person, via the internet or through any other electronic means, is not completely secure and may be vulnerable to interception, loss, misuse or alteration.

13.3. While Universal has implemented appropriate, reasonable technical and organisational measures to safeguard the integrity and confidentiality of the Personal Information it Processes, as contemplated in paragraph 1 above and Applicable Laws, no method of transmission, storage or Processing of information can be guaranteed to be completely secure or error-free.

13.4. Users transmit information to Universal at their own risk, provided that nothing in this Policy excludes or limits any rights or remedies that may not lawfully be excluded or limited under Applicable Law.

13.5. Universal shall not be held responsible and by accepting the Terms of Use to which this Policy relates, you agree to indemnify and hold Universal harmless for any security breaches as a result of the aforesaid transmission, which may potentially expose the Personal Information in Universal’s possession to unauthorised access and/or the unlawful Processing of such Personal Information by any third party.

14.1. Universal and its Affiliates operate globally. Accordingly, Personal Information may be transferred to, stored in (including within data centres), and Processed in countries other than the country in which the Personal Information was originally collected or in which the User resides.

14.2. Universal and its Affiliates have implemented binding corporate rules, intra-group agreements and other appropriate legally enforceable safeguards to govern the transfer and Processing of Personal Information within the Universal group of companies, including cross-border transfers of Personal Information. These safeguards are designed to ensure that Personal Information receives a level of protection substantially equivalent to that required under Applicable Law.

14.3. By accessing or using the Universal.one App Ecosystem or any Products made available through the Universal.one App Ecosystem, and by providing your Personal Information to Universal, you acknowledge and consent, where consent is required by Applicable Law, to the transfer, storage and Processing of your Personal Information in other jurisdictions, subject to appropriate security safeguards and the aforementioned binding corporate rules and intra-group agreements.

14.4. In addition, you acknowledge that certain cross-border transfers of Personal Information may be necessary for the performance of the contract concluded between you and Universal in connection with your registration for, access to, or use of the Universal.one App Ecosystem and the Products.

14.5. Personal Information may be hosted and Processed in, amongst other jurisdictions, the United Kingdom, the United States of America and the RSA. Universal will ensure that any cross-border transfer of Personal Information is carried out in accordance with Applicable Law and is subject to appropriate safeguards designed to protect the privacy, confidentiality, integrity and security of such Personal Information.

Where Universal is required to collect Personal Information from you by law or in order to fulfil a legitimate business purpose of Universal and you fail to provide such Personal Information, Universal may, on notice to you, decline to render the Products and associated services without any liability to you.

16.1. Universal uses cookies and similar technologies, including web beacons, pixels, tags, software development kits (“SDKs”) and other tracking technologies (collectively, “Cookies“), to collect and Process information relating to your use of the Universal.one App Ecosystem and its Products.

16.2. Cookies are small text files or similar technologies that are stored on your device when you access or use the Universal.one App Ecosystem and its Products. Cookies help us to recognise your device, improve functionality, enhance security, analyse usage patterns and provide a more personalised User experience.

16.3. We may use the following categories of Cookies:

16.3.1. Strictly Necessary Cookies: These Cookies are necessary for the operation, security and administration of the Universal.one App Ecosystem and Products and cannot be disabled without affecting their functionality.

16.3.2. Functional Cookies: These Cookies enable enhanced functionality and personalisation, such as remembering your preferences, settings and login details.

16.3.3. Analytics and Performance Cookies: These Cookies help us understand how Users interact with the Universal.one App Ecosystem and Products, including information relating to usage patterns, performance, navigation and system effectiveness. The information collected is generally aggregated and used to improve our Products and services.

16.3.4. Third-Party Cookies: Certain Cookies may be placed by third-party service providers that assist us with hosting, analytics, security, communication, content delivery or other services. Such third parties may collect and Process information in accordance with their own privacy policies and applicable laws.

16.4. You may manage, restrict, disable or delete Cookies through your browser, device or application settings. However, disabling certain Cookies may affect the functionality, availability or performance of the Universal.one App Ecosystem and Products.

16.5. Where required by Applicable Law, Universal will obtain your consent before placing non-essential Cookies on your device. You may withdraw your consent at any time by adjusting your Cookie preferences or browser settings, provided that such withdrawal will not affect the lawfulness of any Processing undertaken prior to such withdrawal.

16.6. By continuing to use the Universal.one App Ecosystem and Products, you acknowledge that Cookies may be used in accordance with this Policy and any Cookie preferences selected by you.

17.2. Universal acknowledges that it may only use Personal Information to contact you for purposes of direct marketing where Universal has complied with the provisions of POPIA and when it is generally permissible to do so in terms of Applicable Law.

17.3. Universal has the right to communicate with you electronically pertaining to our Products that you have access to.

17.4. Universal will ensure that a reasonable opportunity is given to you to object (opt-out) to the use of your Personal Information for Universal’s marketing purposes when collecting the Personal Information and on the occasion of each communication to you for purposes of direct marketing. Universal will store your Personal Information in order to action your request and complete this in a reasonable amount of time without any undue delay.

17.5. The option to opt out of direct marketing and/or where applicable, electronic communications or the communication type, is available:

17.5.1. If applicable, via the web application for the Product;

17.5..2. If applicable, via the mobile application for the Product.

17.6. For the avoidance of doubt, it is recorded that in order to continue to use the Products and services of Universal, you may not unsubscribe from system security communications, including but not limited to password reset emails and one-time pins received by email and SMS from Universal.

18.1. Universal provides User and technical support through our online chat interface and email ().

18.2. Any Personal Information shared during these interactions is Processed solely to resolve your inquiry.

19.2. We will keep your Personal Information for as long as you are an active User on the Universal.one App Ecosystem.

19.3. Personal Information will only be retained for as long as is necessary to fulfil the purposes for which it was collected and Processed, unless a longer retention period is required or permitted by Applicable Law.

19.4. Where you cease to be an active User of the Universal.one App Ecosystem, Universal will take reasonable steps to delete, destroy or de-identify your Personal Information within 5 (five) years of you no longer being an active User on the Universal.one App Ecosystem, unless:

19.4.1. retention is required or permitted by Applicable Law;

19.4.2. retention is necessary for the establishment, exercise or defence of legal claims;

19.4.3. retention is required to resolve disputes, investigate complaints or enforce agreements; or

19.4.4. the information has been de-identified in accordance with Applicable Law.

19.5. You may request the deletion of your Personal Information or the closure of your account at any time, subject to any legal or regulatory obligations requiring Universal to retain certain Personal Information. Where deletion is requested, Universal will take reasonable steps to delete, destroy or de-identify the relevant Personal Information within a reasonable period, unless retention is required or permitted by Applicable Law.

19.6. Where Universal is unable to permanently delete Personal Information from backup systems, archives or disaster recovery environments, Universal will ensure that such Personal Information remains protected by appropriate technical and organisational security measures and will be securely deleted in accordance with applicable retention schedules when such backup or archive data is overwritten or otherwise becomes eligible for deletion.

19.7. Where a User objects to the Processing of Personal Information, lodges a complaint, exercises a Data Subject right or submits an enquiry relating to the Processing of Personal Information, Universal may retain such Personal Information for as long as is reasonably necessary to investigate, respond to and resolve the matter, and to demonstrate compliance with Applicable Law.

19.8. Universal may retain Personal Information that has been de-identified, anonymised or aggregated so that it can no longer reasonably be linked to an identifiable individual. Such information may be used for legitimate business purposes, including statistical analysis, service improvement, research, product development, reporting and historical record-keeping. Universal will implement appropriate safeguards designed to prevent such information from being re-identified or used in a manner inconsistent with Applicable Law.

20.1. By law, Users have a number of rights (subject to certain conditions) when it comes to their Personal Information. Further information and advice about the rights of Users can be obtained from the Information Regulator (South Africa), established in terms of section 39 of POPIA (“Information Regulator”). Users can exercise any of these rights by contacting Universal through their details below. These rights include the following:

20.1.1. The right to object to Processing: Users have the right to object to the Processing of their User Personal Information on reasonable grounds relating to their particular situation, unless legislation provides for such Processing;

20.1.2. The right to be informed: Users have the right to be informed that Personal Information about them is being collected, where the information is being collected from and the purpose for which the information is being collected;

20.1.3. The right of access: Users have the right to know what Personal Information Universal holds about them. Users have the right to access their Personal Information, subject to certain rights of the discloser to refuse access to this information in terms of the Promotion of Access to Information Act, 2000 (No. 2 of 2000) (“PAIA”). If you wish to receive this information, please submit a request for access to a record of a private body as prescribed in PAIA and specify the information you would like. Universal will provide you with any such Personal Information to the extent required by Applicable Law and subject to and in accordance with the provisions of Universal’s PAIA Manual (published in terms of section 51 of PAIA, which PAIA Manual can be sourced on Universal’s website at https://universal.co.za/. Universal will take all reasonable steps to confirm your identity before providing details of your Personal Information. In terms of PAIA Universal is entitled to charge a fee for this service and will inform you of the amount at the time of your request;

20.1.4. The right to correction, destruction or deletion: Users are entitled to have their Personal Information corrected if it is inaccurate or incomplete, destroyed and/or deleted subject to Applicable Law. There may be some information that we are required by Applicable Law to retain;

20.1.5. The right to lodge a complaint: Users have the right to lodge a complaint about the way Universal handles or Processes their Personal Information with the Information Regulator; and

20.1.6. The right to withdraw consent: If Users have given their consent to anything Universal does with their Personal Information, they have the right to withdraw their consent at any time (although if Users do so, it does not mean that anything Universal has done with their information with their consent up to that point is unlawful). Note that such withdrawal in certain circumstances may mean that Users can no longer continue to use the Universal.one App Ecosystem and its Products.

21.1. If you have created an account within the Universal.one App Ecosystem, you have the right to request the deletion of your account at any time.

21.2. You can initiate a deletion request via the following methods:

21.2.1. In-App: Navigate to Settings > Delete Account; or

21.2.2. Email:

21.3. Upon receiving your verified request, we will ordinarily delete or de-identify account profile information, login credentials, user preferences and other Personal Information that is no longer required for the provision of the Universal.one App Ecosystem. However, Universal may retain limited categories of Personal Information, including transaction records, audit logs, security records, records relating to wellness or healthcare services provided through the Universal.one App Ecosystem, records required for legal or regulatory compliance, and records necessary for the establishment, exercise or defence of legal claims, for the periods required by Applicable Law or legitimate business requirements.

22.1. Where there are reasonable grounds to believe that the Personal Information of a User has been accessed or acquired by any unauthorised person, Universal will notify the User and the Information Regulator which is appointed in terms of POPIA, as soon as reasonably possible after the discovery of the compromise, taking into account the legitimate needs of law enforcement or any measures reasonably necessary to determine the scope of the compromise and to restore the integrity of the Universal.one App Ecosystem and Products.

22.2. Universal will delay in notifying the User of the unauthorised access or acquisition of the User’s Personal Information, if a public body responsible for the prevention, detection or investigation of offences or the Information Regulator informs Universal that notifying the User will impede a criminal investigation.

22.3. When Universal notifies the User of the compromise to the security of the User’s Personal Information, Universal will provide the User with sufficient information to allow the User to take protective measures against the potential consequences of the compromise.

We are committed to protecting the privacy of children. The Universal.one App Ecosystem and Products are not intended or designed for children under the age of 18 (eighteen).

The staff of Universal and its Affiliates are bound by comprehensive confidentiality obligations. Our staff are given access only to the Personal Information they are required to see in order for them to fulfil their responsibilities. In all cases we provide access to the minimum amount of information.

Universal does not exercise control over the privacy policies of Third-Party Data Providers and you should refer to their privacy policies to see how they protect your privacy. 

If we become involved in any merger, acquisition, consolidation, or sale of our assets and this involves the sharing in any way of your Personal Information, we will ensure the confidentiality of such information and let you know before your Personal Information is transferred and becomes subject to a different privacy policy. Should you not wish for your Personal Information to be so transferred, you may terminate your use of the Universal.one App Ecosystem and Products by closing your account, which will result in the deletion of your Personal Information in accordance with the provisions of paragraph 21 (USER ACCOUNT DELETION).

27.2. If you are not satisfied after this process, you have the right to lodge a complaint with the Information Regulator in terms of POPIA.

27.3. The contact particulars of the Information Regulator are:

27.3.1. The Information Regulator (South Africa)
27.3.2. Physical address: Woodmead North Office Park, 54 Maxwell Drive, Woodmead, Johannesburg, 2191
27.3.3. Postal address: P.O Box 31533, Braamfontein, Johannesburg, 2017
27.3.4. Telephone number: 010 023 5200
27.3.5. E-mail:

Our chosen address for the service of any legal notice or process is:

68 T.W. Alexander Drive, Research Triangle Park, North Carolina, 27709, USA

30.1. Universal keeps this Policy under regular review and reserves the right in its sole discretion, to vary or amend this Policy from time to time or introduce additional terms relating to this Policy. Any such amendment will come into effect when published on the Universal.one App Ecosystem and Universal’s website. 

30.2. The latest version of this Policy will govern the respective rights and obligations between you and Universal pertaining to the Processing of your Personal Information, each time that you access and use the Universal.one App Ecosystem and any of its Products.

30.3. You must ensure that you obtain the latest version of this Policy before any action is taken based hereon. It is your responsibility to check the Universal.one App Ecosystem and Universal’s website often.

30.4. Your continued use of the Universal.one App Ecosystem and any of its Products, following publication of a new version of this Policy, will constitute your consent to the terms of the new version of this Policy.

Our Privacy Policy was last updated on 10 June 2026.