BioWell
BioWell
BioWell is a South African online medical platform providing structured metabolic weight and wellness management under the guidance of Dr GL Vosloo and a qualified clinical team.
BioWell acts as a practice management solution and operates as a private company registered in South Africa under the name Bio Well (PTY) LTD Reg number: 2025/921670/07.
For purposes of the Protection of Personal Information Act 4 of 2013 (POPIA), the responsible party in respect of personal information processed through the BioWell website and patient platform is Dr GL Vosloo.
All clinical services are delivered within a formal medical practice framework. All prescribing decisions are made by registered medical practitioners. BioWell does not operate as a pharmacy, a product reseller, or a marketplace for medical products.
BioWell's website is accessible at https://www.bio-well.co.za, and the secure patient platform is hosted on infrastructure located in South Africa.
BioWell processes personal information in the course of providing regulated medical services. Health information collected through the platform constitutes special personal information under POPIA and is treated accordingly.
BioWell recognises that the personal information it processes includes sensitive medical and health information. BioWell therefore commits to processing all personal information lawfully, fairly, and transparently in accordance with POPIA, applicable health records legislation, and the ethical rules of the Health Professions Council of South Africa (HPCSA).
This privacy policy records the principles that govern how personal information is collected, used, stored, disclosed, and protected in the course of delivering medical services through the BioWell website and patient platform. It is intended to provide clarity on the scope of processing activities and the safeguards applied to protect data subjects.
BioWell limits the collection of personal information to what is necessary for clinical assessment, treatment, prescription management, regulatory compliance, and related administrative functions. Personal information is not collected for speculative, unrelated, or excessive purposes.
BioWell does not treat personal information as a commercial asset. Personal information, particularly health information, is processed solely within the context of professional medical services and subject to strict confidentiality obligations.
BioWell maintains internal governance structures to ensure that personal information is handled in a manner consistent with statutory requirements, professional secrecy obligations, and accepted standards of medical confidentiality.
This policy sets out the principles that govern how personal information is handled across the BioWell website and patient platform. It is intended to provide clarity regarding BioWell's approach to privacy, accountability, and regulatory compliance.
This policy applies to:
This policy does not extend to third-party websites, platforms, or services that are not owned or controlled by BioWell, even where such platforms are linked from the BioWell website. Those entities are responsible for their own privacy practices.
This policy must be read together with any applicable terms of use, consent forms, and clinical documentation provided to patients during the course of treatment.
This policy applies to the responsible party identified in section 1 of this document, being Dr GL Vosloo, and to the processing of personal information carried out in the course of delivering medical services through the BioWell website and patient platform.
Where BioWell operates as a practice management, personal information processed in the course of clinical care is processed under the authority and oversight of the responsible party identified above.
Persons and entities bound by this policy include:
Where external service providers process personal information for or on behalf of BioWell, they do so under written agreements that require compliance with POPIA and impose appropriate confidentiality and data protection obligations.
Nothing in this policy alters the professional obligations of registered medical practitioners. Clinical records remain subject to applicable medical, ethical, and statutory duties independent of this policy.
BioWell has appointed an information officer in accordance with POPIA.
The information officer is responsible for overseeing compliance with applicable data protection laws, monitoring internal processing practices, responding to data subject requests, and serving as the point of contact for the Information Regulator.
The appointed information officer is Dr GL Vosloo.
Information officer email address: gerhard@bio-well.co.za.
All requests relating to personal information, including access, correction, or complaints, must be directed to the information officer in writing.
For purposes of this policy, the following terms bear the meanings assigned to them below. These definitions apply throughout this document unless the context indicates otherwise:
Singular terms include the plural and vice versa, where the context requires. References to legislation include amendments and subordinate legislation issued under that legislation.
A data subject whose personal information is processed by or on behalf of BioWell is entitled to exercise the rights afforded under POPIA and other applicable law. These rights are subject to statutory limitations, professional obligations, and lawful retention requirements.
A data subject has the right to:
The exercise of these rights is subject to the verification procedures set out in this policy and may be limited where disclosure would infringe the rights of another person, compromise professional confidentiality, or conflict with legal obligations.
Note: The summary below is provided for clarity and accessibility. It does not replace POPIA or limit any rights afforded to data subjects under the Act. In the event of any inconsistency between this policy and POPIA, the provisions of POPIA will prevail. Data subjects are encouraged to consult the most recent version of POPIA for the full statutory framework.
Where BioWell processes personal information in the course of providing medical services, each patient, as a data subject, has the following rights, subject to the limitations and conditions set out in POPIA and in applicable health records legislation:
A data subject has the right to be notified that personal information is being collected and to be informed of the purpose of collection, the categories of information collected, and any other information required by POPIA.
Where there are reasonable grounds to believe that personal information has been accessed or acquired by an unauthorised person, BioWell must notify the affected data subject and the Information Regulator.
A data subject has the right to request confirmation as to whether BioWell holds personal information about them and to request access to that information, subject to lawful limitations, including those relating to professional confidentiality, third-party rights, and clinical considerations.
A data subject may request correction, destruction, or deletion of personal information that is inaccurate, irrelevant, excessive, out of date, incomplete, misleading, or obtained unlawfully. BioWell will consider such requests in accordance with POPIA and applicable medical record retention requirements. Where the law requires retention of medical records, deletion may not be possible.
A data subject may object, on reasonable grounds relating to their particular situation, to the processing of personal information where processing is based on legitimate interests or public interest grounds, as contemplated in POPIA.
A data subject has the right not to be subject to a decision based solely on automated processing of personal information which produces legal consequences for them or significantly affects them, unless permitted under POPIA.
A data subject has the right to lodge a complaint with the Information Regulator if they believe that there has been interference with the protection of their personal information.
A data subject has the right to institute civil proceedings in respect of an alleged interference with the protection of their personal information, as provided for in POPIA.
All rights are exercised in accordance with POPIA and other applicable laws governing medical records and professional conduct. The procedures for exercising these rights, including verification requirements and response timeframes, are set out later in this policy.
BioWell processes personal information only to the extent necessary to provide regulated medical services and to operate its website and secure patient platform. The categories of personal information collected depend on the nature of the interaction with BioWell and whether an individual proceeds to clinical consultation and treatment.
BioWell may collect the following categories of personal information:
Information used to verify and confirm identity, including full name, identity number or passport number, date of birth, gender, and any other information required to establish a patient record.
Residential address, postal address, email address, mobile number, and other contact details required for communication and delivery of services.
Medical history, current medical conditions, past diagnoses, family medical history where relevant, medication history, allergies, body composition information, laboratory results, metabolic assessments, clinician notes, treatment plans, prescription records, and ongoing monitoring data submitted through the platform.
Information relating to diet, exercise patterns, sleep, stress levels, alcohol consumption, smoking status, and other lifestyle factors relevant to metabolic health and clinical assessment.
Billing information, payment confirmations, transaction references, and limited payment-related data necessary to process consultation fees or treatment-related charges. BioWell does not store full card details where payments are processed through third-party payment providers.
Records of correspondence between a user and BioWell, including emails, platform messages, consultation notes, support requests, and administrative communications.
IP address, browser type, device type, operating system, date and time of access, pages visited, session activity, and other technical information collected through standard website and platform technologies.
Documents, laboratory reports, identification documents, images, or other materials voluntarily uploaded by a user through the patient platform.
Personal information is collected directly from the data subject in most cases. Where relevant and lawful, information may also be obtained from healthcare providers, laboratories, pharmacies, or other authorised third parties with the data subject's knowledge or consent.
BioWell processes personal information strictly for defined, lawful, and medically necessary purposes connected to the provision of regulated healthcare services and the operation of its website and patient platform.
BioWell processes personal information in order to:
Personal information is not processed for purposes unrelated to the delivery of medical care and lawful practice administration. BioWell does not sell personal information or use health data for commercial exploitation.
BioWell may, with the user's prior consent where required under POPIA, communicate educational and service-related information by electronic means.
Such communications are limited to:
BioWell does not engage in the direct marketing of prescription medicines to the public. Communications will not promote specific scheduled medicines, publish medicine prices, guarantee clinical outcomes, or encourage the selection of a particular pharmaceutical product.
Where consent is required for electronic communications, it will be obtained in advance and may be withdrawn at any time. Each communication will include a clear mechanism to opt out of non-essential communications.
Service-related communications necessary for the provision of medical care, regulatory compliance, or patient safety may be issued irrespective of marketing consent, as they form part of the clinical and administrative obligations of the practice.
All communications are issued within the ethical framework governing medical practitioners and in accordance with applicable health and advertising standards.
This policy and the processing of personal information by or on behalf of BioWell are governed by the laws of the Republic of South Africa.
Personal information is processed in accordance with:
Where cross-border processing of personal information occurs, such processing will take place only in compliance with section 72 of POPIA and any other applicable legal requirements.
Nothing in this policy limits the application of mandatory statutory obligations imposed on medical practitioners or healthcare entities under South African law.
All personal information processed in the course of providing medical services through BioWell is subject to professional confidentiality obligations imposed on registered medical practitioners under South African law.
Information disclosed by a patient during consultation, whether through the secure online platform or any associated communication channel, is treated as confidential medical information. Such information forms part of the patient's clinical record and is protected by statutory, ethical, and common law duties of confidentiality.
Registered medical practitioners operating through BioWell are bound by the ethical rules of the HPCSA, which impose strict obligations regarding the preservation of patient confidentiality.
Disclosure of patient information may occur only where:
Confidentiality obligations apply to all members of the clinical team and to administrative personnel who access personal information in the course of their duties. Access to clinical information is restricted to those with a legitimate professional or operational need.
Nothing in this policy diminishes or overrides the professional secrecy obligations that attach to the doctor–patient relationship under South African law.
BioWell's medical services are intended for adults. The platform is not designed for use by persons under the age of 18 years.
BioWell does not knowingly collect or process personal information relating to a child, as defined in applicable law, without lawful authority. Where personal information relating to a person under the age of 18 years is provided to BioWell, such information will be processed only where processing is:
Where a competent person provides consent on behalf of a child, BioWell may take reasonable steps to verify the identity and authority of that person before processing the child's personal information.
If BioWell becomes aware that personal information of a child has been collected without the necessary legal basis or consent, reasonable steps will be taken to delete or restrict such information, subject to any lawful retention obligations.
Nothing in this section limits the duties imposed on registered medical practitioners under applicable health legislation in circumstances where treatment of a minor is permitted or required by law.
Use of the BioWell website and secure patient platform may involve the submission of information and the automatic collection of certain technical data necessary for functionality and security.
Where a user submits information through contact forms, consultation forms, or the secure patient platform, that information is recorded as part of the relevant administrative or clinical record. Information submitted for medical consultation forms part of the patient's health record and is treated as confidential medical information.
Users may be required to upload identification documents, laboratory results, images, or other supporting material through the secure patient platform. Such uploads are stored within secure systems and are accessible only to authorised personnel with a legitimate clinical or administrative need. Uploaded materials form part of the patient record where relevant to clinical care.
BioWell does not operate a public comment function on its website. If this position changes, any public-facing interaction functionality will be governed by appropriate privacy and moderation controls.
The BioWell website uses standard website technologies, including cookies and session-based tools, to support functionality, maintain secure sessions, and analyse website performance. Cookies may collect limited technical information such as IP address, browser type, device information, and interaction data.
Cookies are not used to access health records or confidential patient information. Users may configure their browser settings to restrict or disable cookies; however, certain website features may not function correctly if cookies are disabled.
Pages on the BioWell website may include embedded content or links to third-party services. Embedded content behaves in the same manner as if the user had visited the external website directly. BioWell does not control the privacy practices of third-party websites and is not responsible for their data processing activities.
Users are encouraged to review the privacy policies of any external websites they access through links or embedded content on the BioWell website.
All interactions involving medical information occur through secure, access-controlled systems designed to protect confidentiality and maintain the integrity of patient records. Users are responsible for safeguarding their login credentials and for notifying BioWell promptly if they suspect unauthorised access to their account.
BioWell collects and processes personal information from a range of lawful sources, depending on the nature of the engagement with the user or patient and the services provided.
Personal information is collected directly from the data subject when a user completes online forms, schedules consultations, participates in medical assessments, uploads documentation, communicates with the clinical team, or otherwise interacts with the BioWell website or secure patient platform. Clinical information provided during consultation forms part of the patient's medical record.
Where relevant to treatment, personal information may be obtained from licensed laboratories, healthcare practitioners, or pharmacies involved in the patient's care, with the patient's knowledge or lawful basis for such processing.
BioWell may engage third-party service providers to support the operation of its website, secure patient platform, payment processing, and administrative systems. These entities process personal information only on behalf of BioWell, under written agreements that require compliance with POPIA and appropriate confidentiality safeguards.
Personal information may be received from or disclosed to regulatory authorities, courts, or other lawful bodies where required by law or where necessary to comply with statutory obligations.
In limited circumstances, BioWell may verify information against publicly available records where necessary to confirm identity, comply with legal obligations, or protect against fraud.
Certain technical information is collected automatically when a user accesses the BioWell website or secure platform. This includes device information, IP address, browser type, and usage data generated through cookies or similar technologies necessary for system functionality and security.
BioWell does not obtain personal information from covert or unlawful sources. All collection and processing activities are conducted in accordance with applicable data protection laws and within the context of delivering regulated medical services.
BioWell processes personal information only where there is a lawful basis for doing so under POPIA and other applicable legislation. The lawful basis relied upon will depend on the nature of the information and the context in which it is processed.
Where required by law, BioWell processes personal information on the basis of the data subject's informed consent. Consent may be obtained electronically through the website or secure patient platform. A data subject may withdraw consent at any time, subject to lawful retention obligations and the consequences that withdrawal may have on the provision of services.
Personal information is processed where it is necessary for the conclusion or performance of a contract with the data subject. This includes processing required to provide medical consultations, administer treatment plans, manage prescriptions, and facilitate payment for services rendered.
BioWell processes personal information where required to comply with applicable legal or regulatory obligations, including obligations arising under POPIA, health records legislation, professional regulatory frameworks, taxation laws, and lawful directives issued by competent authorities.
Personal information may be processed where it is necessary for the legitimate interests of BioWell or a third party, provided that such interests are not overridden by the rights and freedoms of the data subject. Legitimate interests may include maintaining platform security, preventing fraud, protecting the integrity of clinical records, and managing operational risk.
In limited circumstances, processing may occur where necessary for reasons of public interest, including the protection of public health or compliance with statutory reporting obligations, as permitted under applicable law.
Personal information may be processed where necessary for the establishment, exercise, or defence of legal claims, including responding to complaints, regulatory investigations, or litigation.
Where special personal information is processed, including health information, such processing is conducted in accordance with the additional safeguards and lawful grounds required under POPIA, as addressed in the following section.
BioWell does not sell personal information and does not disclose personal information to third parties except where necessary for the lawful provision of medical services, compliance with legal obligations, or the protection of legitimate interests.
Personal information may be disclosed to the following categories of recipients, where lawful and strictly necessary:
Licensed laboratories, pharmacies, and other healthcare practitioners involved in a patient's care may receive relevant clinical information to facilitate diagnosis, prescription fulfilment, and continuity of treatment.
BioWell engages third-party service providers to support the operation of its website, secure patient platform, administrative systems, and data infrastructure. These may include information technology providers, cloud hosting providers, system administrators, and cybersecurity service providers. Such entities act as operators and process personal information only on behalf of BioWell under written agreements requiring confidentiality and compliance with POPIA.
Where payments are made through third-party payment platforms, limited transaction-related information may be processed by payment service providers, including Yoco, Ozow, Mastercard, and Visa, subject to change. BioWell does not store full card numbers where payment processing is handled by regulated external providers.
Personal information may be disclosed, where necessary, to legal advisers, auditors, insurers, or other professional advisers for purposes of compliance, risk management, or the establishment, exercise, or defence of legal claims.
Personal information may be disclosed to regulatory authorities, including the Health Professions Council of South Africa, the Information Regulator, or other competent bodies, where required by law or in connection with a lawful investigation or oversight function.
Personal information may be disclosed where required by a court order, subpoena, statutory directive, or other lawful process issued by a competent authority. Disclosure to law enforcement will occur only where legally mandated or where failure to disclose would constitute a breach of legal duty.
Where necessary for professional indemnity purposes or insurance claims, limited personal information may be disclosed to insurers or indemnity providers, subject to confidentiality safeguards.
All disclosures are limited to the minimum information necessary to fulfil the relevant purpose. Where possible, personal information is shared in a restricted or pseudonymised form. Confidential medical information remains subject to professional secrecy obligations and is not disclosed beyond what is legally and ethically permissible.
BioWell retains personal information only for as long as necessary to fulfil the purposes for which it was collected and to comply with applicable legal, regulatory, and professional obligations.
Health and clinical information forms part of the patient's medical record and is retained in accordance with applicable health legislation and the ethical guidelines of the Health Professions Council of South Africa.
Medical records are retained for the minimum period prescribed by law and professional regulation, and may be retained for longer where required for medico-legal protection, ongoing care, or the establishment, exercise, or defence of legal claims.
Billing records, payment confirmations, and related financial documentation are retained in accordance with taxation legislation, accounting standards, and statutory retention requirements.
Correspondence and platform communications are retained where relevant to the clinical record or necessary for regulatory compliance, dispute resolution, or operational continuity.
Technical data, access logs, and security monitoring records are retained for as long as reasonably necessary to maintain system integrity, detect unauthorised access, and comply with security obligations.
Where personal information is no longer required for a lawful purpose and is not subject to statutory retention requirements, it will be securely deleted or destroyed in a manner that prevents reconstruction or recovery.
Where BioWell is subject to actual or anticipated litigation, investigation, or regulatory review, relevant personal information may be retained beyond standard retention periods until the matter is resolved.
Retention periods are reviewed periodically to ensure continued compliance with applicable legislation and professional standards.
A data subject has the right to request access to personal information held by or on behalf of BioWell, subject to identity verification and lawful limitations.
Requests for access must be submitted in writing to the information officer using the contact details provided in this policy. BioWell may require sufficient information to verify the identity of the requester before releasing any personal information.
Upon receipt of a valid request, BioWell will:
Access to medical records may be subject to professional considerations and applicable health legislation. In certain circumstances, access may be provided through a healthcare practitioner where required to protect the well-being of the patient or another person.
Where personal information is found to be inaccurate, incomplete, misleading, or outdated, the data subject may request correction. Requests for deletion or destruction will be considered in accordance with statutory retention obligations and professional regulatory requirements.
BioWell will respond to requests within the timeframes prescribed by POPIA and other applicable legislation. Where a request is refused, written reasons will be provided, and the data subject will be informed of the right to lodge a complaint with the Information Regulator.
The exercise of data subject rights does not override lawful retention obligations, professional confidentiality duties, or restrictions imposed by court order or statute.
Requests can be sent to: info@bio-well.co.za.
BioWell implements appropriate technical and organisational measures to protect personal information against loss, misuse, unauthorised access, disclosure, alteration, or destruction. Security safeguards are designed with regard to the sensitivity of health information and the risks associated with online medical platforms.
BioWell uses secure, access-controlled systems for the storage and management of clinical and administrative records. Safeguards include:
BioWell maintains internal policies and procedures governing the handling of personal information. These include:
Personal information processed through the BioWell platform is stored on infrastructure located in South Africa. Where cloud-based services are used, such services are subject to contractual data protection safeguards and must comply with POPIA requirements regarding cross-border data transfers.
In the event of a security compromise affecting personal information, BioWell will act in accordance South African regulations, including notifying affected data subjects and the Information Regulator where required by law.
No system can guarantee absolute security. BioWell takes reasonable steps to safeguard personal information but cannot warrant that unauthorised access will never occur. Users are responsible for maintaining the confidentiality of their login credentials and notifying BioWell promptly of any suspected unauthorised access.
Identity verification forms part of the onboarding and consultation process. Users may be required to submit identifying information, including legally recognised identification details, to establish and confirm their identity before accessing clinical services. BioWell may take reasonable steps to validate such information against documentation provided through the platform.
Verification measures are applied to:
Where a person acts on behalf of another individual, BioWell may require proof of authority and identity before processing personal information or providing access to services.
BioWell may suspend or restrict access to the platform where identity verification requirements are not met or where submitted information appears inconsistent, inaccurate, or potentially fraudulent.
Verification procedures are conducted in a manner proportionate to the sensitivity of the services provided and the nature of the personal information processed.
BioWell does not make clinical decisions based solely on automated processing of personal information.
Medical assessments, treatment plans, prescription decisions, and dose adjustments are made by registered medical practitioners exercising independent clinical judgement.
The secure patient platform may use structured digital tools to organise information, flag risk factors, or support administrative processes, but such tools do not replace clinician oversight.
BioWell does not engage in automated profiling for commercial purposes, behavioural advertising, or product promotion.
Where automated systems are used to support platform functionality, including appointment scheduling, data organisation, risk flagging, or security monitoring, such systems operate under defined parameters and are subject to human review where they may affect a user's access to services or clinical care.
If automated processing is introduced in future in a manner that could produce legal effects or similarly significant consequences for a data subject, BioWell will ensure that appropriate safeguards are implemented in accordance with POPIA, including the right to request human intervention.
BioWell is committed to addressing concerns regarding the processing of personal information promptly and transparently.
A data subject who believes that their personal information has been processed unlawfully, inaccurately, or in a manner inconsistent with this policy may submit a written complaint to the information officer using the contact details provided in this policy.
Complaints can be directed to: info@bio-well.co.za / gerhard@bio-well.co.za
Complaints should include sufficient detail to enable BioWell to understand the nature of the concern and to identify the relevant information or processing activity.
BioWell will:
If a data subject is not satisfied with BioWell's response, or believes that their rights under POPIA have been infringed, they have the right to lodge a complaint with the Information Regulator of South Africa.
Contact details for the Information Regulator are available on the official website of the Information Regulator.
Nothing in this section limits a data subject's right to institute civil proceedings in respect of an alleged interference with the protection of personal information, as provided for under POPIA.
BioWell does not warrant or guarantee that the website, secure patient platform, or any related systems will be free from interruption, error, unauthorised access, or technical failure. To the extent permitted by law, BioWell shall not be liable for any loss or damage arising from circumstances beyond its reasonable control, including cyber incidents, third-party service disruptions, or force majeure events.
Nothing in this policy excludes or limits any liability that cannot lawfully be excluded under South African law.
BioWell is not responsible for the privacy practices, security measures, or content of third-party websites or external platforms that are not owned or controlled by BioWell.
Users are responsible for safeguarding their login credentials and for ensuring that information submitted through the platform is accurate and complete. BioWell is not liable for consequences arising from inaccurate, incomplete, or misleading information provided by a user.
This privacy policy governs the processing of personal information. It does not constitute medical advice, a treatment guarantee, or a representation regarding clinical outcomes. Clinical decisions remain subject to professional judgement and applicable medical standards.
BioWell may update or amend this privacy policy from time to time to reflect changes in applicable law, regulatory guidance, clinical practice, operational processes, or platform functionality.
Where material changes are made, the updated version of the policy will be published on the BioWell website and secure patient platform. The "effective date" and "last updated" fields at the beginning of this document will indicate when the current version came into force.
Continued use of the BioWell website or secure patient platform after the publication of an updated policy constitutes acknowledgment of the revised terms, subject to any rights afforded under POPIA.
BioWell retains prior versions of this privacy policy for internal governance and compliance purposes. Historical versions may be made available upon reasonable request, subject to operational considerations.
Users are encouraged to review this policy periodically to remain informed of how personal information is processed and protected.
All queries, requests, or concerns relating to the processing of personal information must be directed to the responsible party identified in section 1 of this policy or to the appointed information officer.
Name: Dr GL Vosloo
Entity: Dr GL Vosloo medical practice / BioWell (Pty) Ltd
Name: Dr Gerhardus Louwrens Vosloo
Designation: Information Officer
Email address: gerhard@bio-well.co.za
Written requests relating to access, correction, deletion, objection, or any other data subject right under POPIA must be submitted to the information officer using the contact details above.
Where required, requests may need to be accompanied by sufficient information to enable identity verification, as described in this policy.
Important: Access to the BioWell platform and participation in the programme is conditional upon electronic acceptance of this document on the platform.