1.1.9 "Operator" means a person who processes personal information for Healthforce in terms of
a contract or mandate, without coming under the direct authority of Healthforce.

1.1.10 "Personal Information" means the information that relates to you, as the user of any o
our services, including your dependents, as defined in in the Protection of Personal Information
Act No. 4 of 2013. This includes, but is not limited to, information relating to your race,
gender, sex, pregnancy, age, physical or mental health, disability, medical, financial, and
employment history, and your contact information.

1.1.11 "Policy" means this privacy policy, as revised from time to time.

1.1.12 "POPIA" means the Protection of Personal Information Act No. 4 of 2013.

1.1.13 "Process" or "Processing" means any operation or activity, whether or not by automatic
means, concerning personal information, as defined POPIA. This includes, but is not limited
to, the collection, storage, use, and alteration of personal information.

1.1.14 "Record" means any recorded information, regardless of the form or medium, in the
possession or under the control of Healthforce, whether or not the record was created by
Healthforce, and regardless of when the record came into existence.

1.1.15 "Responsible Party" means a public or private body or any other person which, alone or in
conjunction with others, determines the purposes of and means for processing Personal
Information, as defined in POPIA. For the purposes of this Privacy Policy, Healthforce is the
Responsible Party.

1.1.16 "Telemedicine Consultation" means any consultation with a healthcare provider through an
application owned by Healthforce or through a third-party intermediary using Healthforce's
technology.

1.1.17 "Telemedicine Medical Service" means a healthcare-related service provided to you
directly through an application owned by Healthforce.

1.1.18 "Telemedicine Platform Service" means a healthcare-related service provided to you
through a third party intermediary using Healthforce's technology.

1.1.19 "Services" means all the products and services offered by Healthforce, including a
Telemedicine Platform Service, Telemedicine Medical Services and Medical Services and
the healthcare services provided through Dr Chantal Hadfield Inc.

1.1.20 "Special Personal Information" means information relating to your:

1.1.20.1 religious or philosophical beliefs, race or ethnic origin, trade union membership,
political persuasion, health or sex life or biometric information; or

1.1.20.2. criminal behaviour, to the extent that such information relates to the alleged
commission of any offence allegedly committed by you or the disposal of such
proceedings.

1.1.21 "We", "us" or "our" refers to Healthforce.

1.1.22 "You" or "yours" refers to you, as the user of any of our services, and includes your
dependents.

2 Purpose and scope of this Policy

2.1 This Policy governs and regulates how we Process Personal Information.

2.2 Healthforce, and all of our employees, are responsible for the processing and storage of your personal
information as set out in this Policy and in compliance with POPIA.

2.3 This policy also applies to other persons or entities that may Process and store Personal Information
on our behalf.

3 Who we are

3.1 Healthforce is a technology and Medical Services provider, registered as a private company in South
Africa, which provides access to a software system used by clinics, healthcare practitioners and
patients around South Africa.

3.2 Healthforce provides the following Services:

3.2.1 a Telemedicine Platform Service to a clinic or pharmacy to provide you with a telemedicine
consultation. The telemedicine consultation is provided to you as part of the clinic or
pharmacy business. The nurse, with whom you consult, is employed by the clinic or
pharmacy providing the Telemedicine Consultation. Any doctor that you meet or consult
with, as part of a Telemedicine Consultation, is not employed by the clinic or pharmacy but
is part of a separate independent medical practice, operated by Dr Chantal Hadfield
Incorporated;

3.2.2 a Telemedicine Medical Service through a direct-to-consumer application called "Kena
Health". The Healthcare Practitioners you consult with through the application are either
employed by Kena Health (Pty) Ltd or may form part of the separate independent affiliated
medical practice, operated by Dr Chantal Hadfield Inc; and

3.2.3 in addition to providing the technology for telemedicine consultations, we also host the
electronic medical records created by the healthcare practitioners with which you consult, if
you obtain Medical Services from them.

4 The Personal Information that we collect

4.1 In order to provide you with our services, it is necessary for us to collect the following Personal
Information about you and/or your dependants:

4.1.1 name, identity number, date of birth, customer number, passport number, address, age, race,
birth, language and religious beliefs;

4.1.2 employment details;

4.1.3 details of the Funders responsible for the payment of any accounts;

4.1.4 billing details and payment history, including information about payment defaults;

4.1.5 medical history, including the medical history of relevant family members;

4.1.6 health status, symptoms, diagnoses, prescribed or administered treatment and care as
well as procedures performed by relevant health care practitioners, prescribed medicines, findings
and results from examinations performed by relevant health care practitioners (including, but
not limited to, pathology laboratory results), blood type, prescribed or applied medical
devices, responses to treatment, adverse reactions to medicines, relevant behaviour
impacting on health status and treatment options, compliance with prescribed or
recommended treatment, other relevant clinical and other information that may affect your
clinical condition or treatment;

4.1.7 completed patient information forms, including terms and conditions and documents on
which consent is provided, views and opinions of practitioners about your condition(s);

4.1.8 motivations and reports provided to funders;

4.1.9 sick certificates, scripts and referral letters;

4.1.10 records of video consultations with medical practitioners (telemedicine);

4.1.11 records of our interactions or correspondence with you; and

4.1.12 utilisation of products and Medical Services of the pharmacy or clinic, if relevant and
appropriate as well as utilisation of any of our services.

4.2 The provision of information is voluntary, and we will continue to assist you to the extent possible
but it may affect the Services that we are able to provide to you as well as Medical Services that the
relevant healthcare providers are able to provide to you. If insufficient information is provided to
enable the provision of Services and Medical Services, we may refer you to an alternative service
provider.

5 How we collect Personal Information

5.1 We collect Personal Information directly from you in the following ways:

5.1.1 through our website;

5.1.2 when you provide your Personal Information to one of the pharmacies or clinics providing
Medical Services;

5.1.3 through your use of the Kena Health application; and

5.1.4 through the provision of our Services to you.

5.2 Healthforce makes every effort to collect Personal Information directly from you. However, in some
instances it may be necessary to collect Personal Information from other third party sources, which
may include the following:

5.2.1 other persons who are legally authorised to provide information on your behalf;

5.2.2 referring clinics, pharmacies and healthcare practitioners;

5.2.3 funders such as your medical scheme and its administrators and managed healthcare
providers; and

5.2.4 other entities or persons from whom we may lawfully collect information.

5.3 When collecting your Personal Information from a third party, we will do so, to the extent possible,
with your prior consent. Alternatively we will do so only where the collection of your Personal
Information from a third party does not prejudice your legitimate interests or maintains our legitimate
business and operational interest.

5.4 When providing us with Personal Information on behalf of someone else, you guarantee that you are
legally competent and authorised to do so.

6 The Purpose for Processing your Personal Information

6.1 We will only collect and Process your Personal Information for specific, explicitly defined and lawful
purposes that relate to a function or activity of Healthforce, which include the following:

6.1.1 to provide our Services to you;

6.1.2 for operational purposes including the creation, maintenance and storage of your Personal
Information in an electronic medical record;

6.1.3 to compile and maintain the newsletter database and for the purposes of direct marketing, to
which you consent;

6.1.4 to register and authenticate users of our website and applications;

6.1.5 to maintain information submitted by you in respect of competitions and promotions from
time to time;

6.1.6 to compile de-identified statistical information about browsing habits, click patterns and
access to our website(s);

6.1.7 to evaluate the use of our website(s) and Services;

6.1.8 to analyse the effectiveness of our advertisements, competitions and promotions;

6.1.9 to provide information to you and relevant funders on request, as authorised by you or
permitted in terms of the law;

6.1.10 to provide healthcare practitioners who use our technology platform access to your electronic
medical records with your consent;

6.1.11 to allow healthcare practitioners who have provided Medical Services to you to use the
information for billing purposes;

6.1.12 for historical, statistical and research purposes;

6.1.13 for auditing purposes;

6.1.14 to submit claims to medical schemes, health insurers and voucher providers for services
provided to you;

6.1.15 for compliance with legal obligations;

6.1.16 to notify you of any health-related information, updates or reminders that are relevant to you;
and

6.1.17 for any other purpose related to our functions or activities.

6.2 To the extent practicable, Healthforce will only process your Personal Information if you consent to
such processing. Where it is not possible or practicable to obtain consent, Healthforce may justify
the processing of Personal Information on another ground, which may include one or more of the
following:

6.2.1 the Processing is necessary to carry out actions for the conclusion or performance of a
contract to which you are a party;

6.2.2 the Processing protects a legitimate interest of yours;

6.2.3 the Processing complies with an obligation imposed by law on Healthforce;

6.2.4 the Processing is necessary for pursuing the legitimate interests of Healthforce or of a third
party to whom the information is supplied.

7 Sharing your Personal Information

7.1 In order to provide you with our Services and Medical Services by relevant healthcare providers,
we are required to share your Personal Information with the following third-parties:

7.1.1 healthcare practitioners who treat you (with your consent);

7.1.2 relevant funders and voucher providers, if necessary, including Medical Schemes or their
administrators;

7.1.3 other persons, including family members, only if we are authorised to communicate with
them in terms of the law or otherwise with your consent;

7.1.4 any relevant third party in the course of an acquisition, sale, transfer, reorganisation, or
merger of parts of our business or our assets; and

7.1.5 our internal quality teams as part of our quality standards and oversight processes;

7.1.6 members of our internal support team; and

7.1.7 members of our development team.

7.2 We are further required to share your personal information with the following third parties who are
located in the European Union:

7.2.1 Amazon Web Services, including Heroku and Snowflake hosted on this service;

7.2.2 Doktor.se.

7.3 We are required to do so in order to safely process and store your Personal Information. All of the
parties listed in paragraph 16.1 are subject to agreements that provide an adequate level of protection
as required in terms of section 72 of POPIA.

7.4 We will not share your Personal Information with additional third parties unless authorised or
required in terms of the law.

8 Retention of Personal Information

8.1 Records of Personal Information will not be retained for longer than is necessary for achieving the
purpose for which it was collected or subsequently processed unless one or more of the following
applies:

8.1.1 retention of the record is required or authorised by law;

8.1.2 Healthforce reasonably requires the record for lawful purposes related to its functions or
activities;

8.1.3 retention of the record is required in terms of a contract between you and Healthforce;

8.1.4 you have consented to the retention; and/or

8.1.5 the record is used for historical, statistical, or research purposes by Healthforce.

8.2 Healthforce will facilitate the destruction or deletion of a record of Personal Information or de-
identify it as soon as reasonably practicable once Healthforce is no longer authorised to retain the
record.

9 Operators

9.1 From time to time, Healthforce may make use of Operators who Process Personal Information on
our behalf.

9.2 In such circumstances, Healthforce will enter into a contract with any such Operator to ensure that
they treat the Personal Information as confidential and maintain appropriate security safeguards.

9.3 All Operators are required to notify Healthforce immediately where there are reasonable grounds to
believe that the Personal Information in their possession or under their control has been accessed or
acquired by an unauthorised person.

10 Special Personal Information

10.1 In order for Healthforce to provide our Services and for the relevant healthcare providers to provide
you with Medical Services, it is necessary for us to collect and process Special Personal Information,
which includes information concerning your health.

10.2 To the extent practicable, Healthforce will only process your Special Personal Information where
you, as the data subject, consent to the processing or as provided for in terms of
the provisions of POPIA.

11 Personal Information relating to Children

11.1 Healthforce will take additional care and caution when processing Personal Information relating to
a Child.

11.2 To the extent practicable, Healthforce will only process Personal Information relating to a Child if
the processing is carried out with the prior consent of a competent person on behalf of the Child, or
as required in terms of the Children's Act No. 38 of 2005.

11.3 Where it is not possible or practicable to obtain the prior consent of a competent person, Healthforce
will only process such Personal Information if one or more of the following is applicable:

11.3.1 the Processing is necessary for the establishment, exercise or defence of a right or obligation
in law;

11.3.2 the Processing pertains to Personal Information that has deliberately been made public by
the child with the consent of a competent person;

11.3.3 the Processing:

11.3.3.1 is for historical, statistical or research purposes, to the extent that the purpose
serves a public interest and the processing is necessary for the purpose concerned;
or

11.3.3.2 it appears to be impossible or would involve a disproportionate effort to ask for
consent, and

11.3.3.3 there are sufficient guarantees to ensure that the processing does not adversely
affect the individual privacy of the child to a disproportionate extent.

12 Security Safeguards

12.1 Healthforce will secure the integrity and confidentiality of Personal Information in its possession or
under its control by taking appropriate, reasonable technical, and organisational measures to prevent
loss, damage, unauthorised destruction, or unlawful access to Personal Information.

12.2 Healthforce will take reasonable measures to:

12.2.1 identify all reasonably foreseeable internal and external risks to Personal Information in its
possession or under its control;

12.2.2 establish and maintain appropriate safeguards against the risks identified;

12.2.3 regularly verify that the safeguards are effectively implemented; and

12.2.4 ensure that the safeguards are continually updated in response to new risks or deficiencies in
previously implemented safeguards.

12.3 Where there are reasonable grounds to believe that your Personal Information has been accessed or
acquired by an unauthorised person, Healthforce will take steps, as soon as reasonably possible, to
notify you and the Information Regulator.

13 Your Rights

13.1 Healthforce aims to give effect to your rights concerning Personal Information, and to the extent
practicable, will assist you in the exercise of these rights, which include:

13.1.1 the right to be notified that your Personal Information is being collected;

13.1.2 the right to be notified in the event that your Personal Information has been accessed or
acquired by an unauthorised person;

13.1.3 the right to establish whether or not Healthforce holds Personal Information about you, and,
if so, to request access to any such Personal Information;

13.1.4 the right to request, where necessary and lawful, the correction, destruction, or deletion of
your Personal Information;

13.1.5 the right to object, on reasonable grounds, to Healthforce processing your Personal
Information;

13.1.6 the right to submit a complaint to the Information Regulator, using the following details:
JD House,
27 Stiemens Street
Braamfontein
Johannesburg 2001
Email: POPIAComplaints@inforegulator.org.za

13.2 In order to exercise any of your rights, lay a complaint about the processing of your Personal
Information, or for further information concerning this Privacy Policy, you can contact our
information officer, as detailed below:
Information Officer: Saul Kornik
Email: care@healthforce.io
Website: www.healthforce.io

14 Changes to this Privacy Policy

14.1 We may revise or supplement this Privacy Policy in our sole discretion from time to time to reflect,
for example, any changes in our business, the law and the introduction of any new technology.

14.2 We will publish the updated Privacy Policy on our website at www.healthforce.io and a most recent
version of this Privacy Policy will also be available at our business premises.

14.3 Any revised version of the Privacy Policy will be effective as of the date of posting on our website.
As such, you should always refer back to our website for the latest version.

14.4 Your continued use of our Services and hosting of your electronic medical records following the
posting of a new version of the Privacy Policy on our website will constitute your acceptance of the
updated policy. It is your responsibility to make sure that you are satisfied with any changes before
continuing to use our Services.

15 The applicability of law

15.1 This Privacy Policy is governed by the laws of the Republic of South Africa and you consent to the
jurisdiction of the South African courts in respect of any dispute that may arise out of or in connection
with this Privacy Policy.