Privacy Policy

1. Introduction

Ovitoz (Pty) Ltd ("Ovitoz", "we", "our", "us") is committed to protecting your privacy and processing your Personal Information lawfully, transparently and securely in accordance with the Protection of Personal Information Act, 2013 (POPIA) and other applicable data protection legislation.

As a digital rewards ecosystem, Ovitoz allows members to earn, redeem and manage rewards while using digital wellness, lifestyle, shopping, and partner services.

This Privacy Policy explains who we are, what information we collect, how we use it, who we share it with, how long we retain it, how we protect it and the rights available to you. It applies whenever you register for an Ovitoz account, join the Ovitoz Rewards Programme, use our website or mobile application, interact with our WhatsApp support or chatbot, link wearable devices, connect third-party accounts, interact with participating rewards partners, or opt in through any of our platforms or social media accounts.

2. Who We Are

Ovitoz (Pty) Ltd, based in Gauteng, South Africa, is the Responsible Party for purposes of POPIA. Our principal business is operating a digital rewards and engagement platform that connects members with participating merchants (Brand Partners).

3. Your Rights as a Data Subject

You have the right to access your Personal Information; correct inaccurate information; request deletion of your account and Personal Information; object to processing; withdraw consent where consent is the legal basis; restrict processing; request details of recipients; and lodge complaints with the Information Regulator.

Deleting your account and erasing your data in the app. You can erase your account directly in the Ovitoz app, without contacting us. Open Settings, select "Delete account & erase data", and type DELETE to confirm. Deletion is permanent and cannot be undone. It removes your profile, your Early Access application, your activities and health telemetry, your OVI balance and ledger history, your vouchers, your referral records, your communication consents and any photographs you uploaded, and it deletes your sign-in record. Merchant till and settlement records are retained for accounting and audit purposes, but with your name and contact details removed (anonymised).

If you cannot sign in, or prefer not to use the in-app process, you may email privacy@ovitoz.co.za instead. The Information Officer will verify your identity and carry out the erasure on your behalf.

4. What Personal Information We Collect

We collect information directly from you and, where necessary, from connected devices, participating partners and authorised third parties. Categories include:

• Biographic and demographic information — names, date of birth, gender.
• Contact information — address, telephone numbers, email address.
• Physical activity information — step count, active heart rate, heart rate zones, active energy burned, workout metadata, activity type, duration and location.
• Reward use and activity information — reward points, tier, redemption and transaction history, vouchers, partner interactions, campaign participation.
• Tracking information — location or geolocation (where enabled), IP address, device and session identifiers.
• Preferences and online identifiers — cookies, analytics and marketing identifiers.

Connected health platforms

Where enabled by you, Ovitoz may synchronise information from Apple Health, Google Health Connect / Google Fit, Strava and Garmin. Ovitoz only reads data after you authorise the connection, and you can withdraw that authorisation at any time in Settings or in the relevant app. When the health data permission is switched off, Ovitoz stops syncing and does not save any new data.

Strava

If you connect Strava, Ovitoz uses Strava's official OAuth 2.0 authorisation flow in your device browser — we never see or store your Strava password. We request read access to your activities only (the activity:read_all scope); we cannot post, edit or delete anything on Strava. Strava data is never sold, licensed or shared with insurers, medical schemes, merchants or data brokers, and is never used for advertising. Strava data is never used in artificial intelligence, machine learning or generative AI features, and is never used to train any model. Strava workouts are shown only to you, inside your own signed-in account, and never in public feeds or to other members. Detailed workout data is retained for up to 7 days for reward verification, after which it is deleted. When you delete a workout on Strava, it is automatically removed from Ovitoz on the next sync. You may disconnect at any time in Settings or in your Strava account settings; either action deletes the stored Strava tokens and your imported Strava activities immediately. Strava tokens are stored encrypted (AES-256-GCM) and used only server-side.

Heart-rate zones and Daily 2x Boost

Ovitoz treats your heart-rate zone (Zone 1 to Zone 5) and your Daily 2x Boost usage as processed health telemetry. We use them only to calculate your rewards, including the tiered daily cap: up to 15 OVI a day on standard activity, and up to 25 OVI on a day with verified Zone 3+ activity (heart-rate data imported from Strava or an uploaded export; manually entered heart rate earns at the standard rate) or an activated Daily 2x Boost. Streak bonuses do not count towards either limit.

Referral codes and campaign identifiers

When you arrive through a referral link or a partner deal link, Ovitoz records referral codes and campaign tags in the link. We use them to credit referral rewards correctly and to confirm which partner deal a member followed. They are never sold.

5. How We Use Your Personal Information

Health data is used solely for calculating reward (OVI) allocation and verifying movement plausibility.

Ovitoz does not sell, license, or monetise raw health data to third-party medical aids, insurers, or data brokers.

We process information to personalise rewards, recommend products and participating merchants, personalise wellness journeys and improve member experiences.

Ovitoz uses artificial intelligence technologies to provide personalised recommendations, wellness insights, chatbot responses and personalised promotions. AI recommendations are not medical, healthcare or professional advice.

Where you enable background synchronisation, you expressly authorise Ovitoz to periodically synchronise your health information from authorised devices and connected health platforms. Synchronisation continues until you revoke the relevant permissions or disable the feature, which you may do at any time.

6. Member Messaging and User-Generated Content (Chat Hub)

The Ovitoz Chat Hub lets members create and join groups (tribes) and send messages to other members.

What we collect. When you use the Chat Hub we process and store the messages you send, the groups you create or join, your group role (member, admin or creator), and the display name and profile photograph you choose to show other members.

Message reports. Any member can report a message using the "Report Message" option. When a message is reported we store the reported message content, the reason selected (Spam, Discrimination, Explicit Content or Harassment), the identity of the reporter and the identity of the author, so that moderators can review the report.

Automated content screening. Messages are screened automatically before they are posted. The screening checks for hate speech and racial discrimination (including obfuscated spellings), explicit or sexual content, spam and phishing links (only approved domains are permitted; link shorteners and suspicious domains are blocked), promotional scam patterns, message flooding and duplicate messages. Messages that fail screening are blocked and the sender is shown a notice that the message was blocked under the Ovitoz Community Guidelines.

Moderation actions and records. Group creators, admins and Ovitoz moderators can review reported and auto-blocked content in a moderation queue and may warn, mute or ban a member, or dismiss a report. We retain moderation records (reports, blocks and the actions taken) for as long as needed to enforce the Community Guidelines, resolve disputes and meet legal obligations, after which they are securely deleted or anonymised.

Your responsibility. You remain responsible for the content you post. Do not share personal information about yourself or others in group messages that you are not comfortable other members seeing. Message content is visible to members of the groups you join.

7. Cookie and Tracking Technologies

Ovitoz uses cookies, SDKs, pixels and similar technologies, classified by function:

• Strictly necessary cookies — required for authentication, session management, security and fraud prevention. Always on.
• Functional and preference cookies — remember settings and preferences; activated in accordance with your cookie preferences.
• Analytics cookies — measure how users interact with the Platform; not activated until the required prior consent has been obtained.
• Marketing and advertising cookies — pixels and similar technologies used to measure campaign performance and attribute conversions; disabled by default until you provide explicit, affirmative consent.

When you first visit the Ovitoz web Platform, a prominent consent banner is displayed before any non-essential marketing or third-party tracking technology is activated. Non-essential tracking scripts remain blocked unless and until you make an affirmative choice. Consent is not inferred from silence, continued browsing, pre-ticked boxes or inactivity. Rejecting optional tracking does not prevent access to the core functionality of the Platform. You may withdraw or change your consent at any time through the cookie preference centre.

8. Why We Process Personal Information

Ovitoz processes information to administer memberships; operate its rewards Programme; issue rewards; process redemptions; personalise member experiences; authenticate users; provide customer support; detect fraud; comply with legal obligations; improve Platform performance; perform analytics; and develop new services.

9. Data Sharing

Personal Information may be shared with participating rewards partners, fitness partners, payment processors, cloud providers, analytics providers, AI providers, regulators, law enforcement, auditors and legal advisers. Where information is shared with service providers, contractual safeguards ensure appropriate protection and use only for authorised purposes. Ovitoz does not sell your Personal Information.

While Ovitoz itself does not process Personal Information outside of South Africa, certain operators such as Brand Partners may do so. Where this occurs, Ovitoz ensures that adequate contractual or statutory safeguards protect your Personal Information, consistent with POPIA.

10. How We Protect Your Personal Information

Ovitoz maintains industry-standard safeguards including secure APIs, access controls, penetration testing, vulnerability management, audit logging and monitoring. Personal Information is retained only while your account remains active, for legal compliance, to resolve disputes and for legitimate business purposes, and is securely deleted or anonymised when no longer required. Where a security compromise occurs, Ovitoz will investigate and contain the breach, notify affected users and the Information Regulator where legally required, and implement corrective measures.

11. Consent

Messaging and chatbot consent. By starting or continuing a chatbot conversation, you consent to Ovitoz collecting information contained within messages, storing conversation history, processing your information using AI technologies, and transferring messages to human support agents where necessary. Marketing communications are only sent where you have separately opted in.

Cookie and third-party tracking consent. Optional marketing and attribution tracking is subject to a separate opt-in. Creating an account, joining the rewards Programme or accepting this Privacy Policy does not, in itself, constitute consent to optional third-party marketing tracking.

Special personal information consent (sections 26, 27 and 32 of POPIA). By creating an Ovitoz account, enabling health telemetry, linking third-party accounts or otherwise using the Platform, you acknowledge that you have read and understood this Privacy Policy and consent to the processing of your Personal Information to the extent that consent is the applicable lawful basis under POPIA.

12. Children's Privacy

Ovitoz does not knowingly collect Personal Information from children without the consent of a parent or legal guardian where required by law.

13. PAIA Manual

Ovitoz maintains a PAIA Manual in accordance with section 51 of PAIA, containing categories of records, Information Officer details, request procedures, applicable forms and fees. The Manual is available on the Ovitoz website and upon request.

14. Changes to this Privacy Policy

Ovitoz may amend this Policy from time to time to reflect legal, operational or technological changes. Updated versions will be published on the Platform and, where appropriate, notified to members.

15. Information Officer Contact Details

Ovitoz has appointed an Information Officer responsible for POPIA compliance.

• Email: privacy@ovitoz.co.za
• Website: https://www.ovitoz.co.za
• Telephone: +27 64 528 0264