MediGrid respects your privacy and is committed to protecting your personal information in accordance with applicable South African law, including the Protection of Personal Information Act, 2013 (“POPIA”). This Privacy Policy explains how MediGrid collects, uses, stores, shares, and protects your personal information when you use our website, place an order, contact us, upload documents, or otherwise interact with us. This Privacy Policy should be read together with our PAIA Manual, which is available separately on request and, where published, on our website.
1. Who We Are
In this Privacy Policy, “MediGrid”, “we”, “us” and “our” means MediGrid and its website, services, systems, and related business operations.
For any privacy-related questions, PAIA requests, POPIA rights requests, or complaints, you can contact us at:
We may collect and process the following categories of personal information:
2.1 Information you provide to us
Full name
Email address
Phone number
Delivery address
Billing details
Account login details
Order information
Payment confirmations
Messages, emails, or support queries you send to us
2.2 Health or regulated information
Where relevant to products or services offered through MediGrid, we may collect:
Prescription uploads
Medicine-related order information
Health-related information you choose to provide to us in connection with an enquiry, order, or support request
Health information is treated as special personal information and is handled with additional care and restricted access.
2.3 Automatically collected information
When you use our website, we may automatically collect:
IP address
Browser type
Device type
Operating system
Pages viewed
Referral URLs
Session activity
Cookie and analytics data
Similar online identifiers and usage information
3. How We Collect Information
We collect personal information:
Directly from you
Automatically when you use our website
From payment providers involved in a transaction
From courier, fulfilment, or logistics partners
From service providers acting on our behalf
From lawful public or regulatory sources where necessary
4. Why We Process Personal Information
We process personal information only for lawful, specific, and business-related purposes, including to:
Create and manage user accounts
Process and fulfil orders
Confirm payments
Provide customer support
Arrange delivery, returns, refunds, or cancellations
Communicate with you about your account or order
Prevent fraud, misuse, and security incidents
Maintain and improve our website, systems, and services
Comply with legal, tax, audit, regulatory, and record-keeping obligations
Respond to PAIA, POPIA, or regulatory requests
Send service-related notices
Send marketing communications where permitted by law
5. Lawful Basis for Processing
We process personal information where:
you have consented;
processing is necessary to provide requested services or fulfil a contract;
processing is necessary to comply with a legal obligation;
processing is necessary to protect a legitimate interest of MediGrid, the customer, or another party, where lawful; or
processing is otherwise permitted under POPIA.
6. Special Personal Information
Where MediGrid processes information concerning health, prescriptions, or similar sensitive data, we will do so only where permitted by law and where reasonably necessary for the relevant purpose. Access to such information is limited to authorised persons, service providers, or partners who require it for a lawful and necessary purpose.
7. How We Share Personal Information
We may share personal information with:
Payment service providers
Banks or payment processors
Courier, logistics, and fulfilment partners
Website hosting and technology providers
Analytics and security providers
Professional advisers
Regulators, courts, law enforcement, or public authorities where required by law
Business partners or suppliers involved in fulfilling your request or order
We do not sell personal information.
Where third parties process personal information on our behalf, we require them to use appropriate confidentiality, security, and data protection measures.
8. Cookies, Analytics, and Google Services
MediGrid may use cookies, pixels, tags, web beacons, IP logging, and similar technologies to operate the website, improve user experience, analyse website performance, measure marketing effectiveness, and protect the website against abuse or fraud. Google requires advertisers and publishers using its products to maintain a clear and prominent privacy policy that discloses data collection, sharing, and usage, including technologies such as cookies, web beacons, IP addresses, and other identifiers.
If we use Google Analytics, Google Ads, or Google Analytics Advertising Features, those tools may collect information about your interaction with our website using first-party cookies, third-party cookies, identifiers, or similar technologies. Where Google Analytics Advertising Features are used, Google requires that we disclose:
which Google Analytics Advertising Features we use;
how first-party and third-party cookies or identifiers are used together; and
how users can opt out of those features, including through available browser controls, Google Ads Settings, or other available opt-out tools.
MediGrid does not use prescription information, health-condition information, or other special personal information to create personalised advertising audiences in a manner that would conflict with applicable healthcare advertising restrictions. Google’s healthcare and medicines policies place additional restrictions on pharmacy, prescription drug, and healthcare-related advertising.
You can manage cookies through your browser settings. Disabling some cookies may affect website functionality.
9. Marketing Communications
Where permitted by law, MediGrid may send you marketing or promotional communications. You may opt out of receiving marketing communications at any time by following the unsubscribe instructions in the communication or by contacting us at complaints@medigrid.co.za. We may still send you important service, order, payment, or legal notices even if you opt out of marketing.
10. Cross-Border Processing
Some of our technology providers or service providers may process or store personal information outside South Africa. Where cross-border transfers occur, we will take reasonable steps to ensure that the transfer is lawful and that appropriate protection or safeguards are in place.
11. Security of Personal Information
We take reasonable technical and organisational steps to protect personal information against loss, misuse, unauthorised access, disclosure, alteration, or destruction. These measures may include:
Access controls
Password protection
Secure hosting
System monitoring
Vendor controls
Internal process controls
Backup and recovery procedures
No system is completely secure, but MediGrid takes reasonable steps to protect the personal information in its possession or under its control.
12. Retention of Information
We retain personal information only for as long as reasonably necessary for the purpose for which it was collected, or as required or permitted by law, including for legal, tax, regulatory, fraud-prevention, dispute-resolution, or business record purposes.
When personal information is no longer needed, we may delete, destroy, anonymise, or de-identify it where appropriate and lawful.
13. Your Rights
Subject to applicable law, you may have the right to:
request access to personal information we hold about you;
request correction of inaccurate, incomplete, or outdated personal information;
object to certain processing;
request deletion where lawful and appropriate;
withdraw consent where processing is based on consent;
lodge a complaint regarding the handling of your personal information.
The Information Regulator states that POPIA complaints may include unauthorised sharing of personal information, failure to secure data, unlawful collection, unlawful processing of special personal information, or failure to respond to rights requests.
MediGrid maintains a PAIA Manual separately from this Privacy Policy. That manual explains the categories of records held by MediGrid and the process for requesting access to records in terms of PAIA. This Privacy Policy does not replace the PAIA Manual. Under PAIA, private bodies are expected to make their manuals publicly available, and access requests are made using the prescribed Form 2 to the relevant contact point for the private body.
To request a copy of our PAIA Manual or to submit a request relating to access to records, email: complaints@medigrid.co.za
15. Third-Party Websites and Services
Our website may contain links to third-party websites, service providers, or platforms. MediGrid is not responsible for the privacy practices, content, or security of third-party websites or services. You should review their privacy policies separately.
16. Children’s Information
MediGrid does not knowingly collect personal information from children except where it is lawfully provided by a parent, guardian, or authorised person, or where otherwise permitted by applicable law.
17. Changes to this Privacy Policy
We may update this Privacy Policy from time to time to reflect changes in law, technology, operations, or business practices. The updated version will be published on our website with the revised effective date.
18. Contact Us
If you have any questions, complaints, rights requests, PAIA requests, or concerns about this Privacy Policy or the way your personal information is handled, contact us at:
