Privacy Policy

Four Minute Medicine (Pty) Ltd. (reg: 2019/155280/07) (“4MM”) adheres to the highest standards of protecting your personal information when we process it by virtue of your use of our Services, your use of our Platform https://www.fourminutemedicine.com/ or any of its related websites or applications (collectively, “the Platform”) or by providing us with your personal information in any other way. As such, we have created this specific and detailed Privacy Policy for you to read and appreciate exactly how we safeguard your personal information and respect your privacy (“Policy”).

• Please note that 4MM is a private limited liability company duly registered and operating in accordance with the laws of South Africa.
• For more information regarding your personal information lawfully stored or used by 4MM, please contact privacy@fourminutemedicine.com who will gladly assist.
• Not all terms are necessarily defined in order or may be defined in our Terms and Conditions.
• Please ensure that you read all the provisions below, and our other 4MM rules and policies which may apply from time to time and made available to you, to understand all of your, and our, rights and duties.

Outline of Privacy Policy

1. Important Information and Who We Are
   1. Purpose of This Privacy Policy
   2. Responsible Party and Operator
   3. Our Contact Details
2. The Data We Collect About You
3. How Is Your Personal Data Collected?
4. Lawful Bases for Processing Personal Data
5. Purposes for Which We Will Process Personal Data
6. Disclosures of Your Personal Data
7. Google API Services User Data & Limited Use Disclosure
8. Express Cookies Provision
9. International Transfers
10. Data Security
11. Data Retention & Deletion
12. Your Legal Rights

1. Important Information and Who We Are

1.1 Purpose of this Privacy Policy

1. This Privacy Policy aims to give you information on how 4MM collects and processes your personal data through any form of your engagement with 4MM such as your engagement with us when contracting or corresponding with us, when using our Services, accessing or using the Platform, or providing us with your personal information in any other way.
2. This Privacy Policy complies with and facilitates the obligations required from, the South African Protection of Personal Information Act, No. 4 of 2013 (“POPI”), as amended.
3. Users with citizenships from jurisdictions other than South Africa, please note that 4MM complies with all South African data protection laws when processing your personal information pursuant to the Services as we are a South African entity operating in the South African market. Should foreign law be applicable in any regard to your use of the Services and/or the Platform in any way, including how we may process your personal information, please contact 4MM at privacy@fourminutemedicine.com who will gladly engage you on its application and your rights.
4. It is important that you read this Privacy Policy together with any other privacy policy or fair processing notice we may provide on specific occasions when we are collecting or processing personal data about you so that you are fully aware of how and why we are using your data. This Privacy Policy supplements the other notices and is not intended to override them.
5. Age Restriction (No Processing of Children's Data): The Platform and Services are directed strictly at individuals who are at least 18 years of age (or the applicable age of majority in your jurisdiction). We do not knowingly collect, solicit, or process personal data from children or minors under the age of 18 pursuant to POPIA and other applicable data protection laws. If you are under 18, do not attempt to register on the Platform, sign up via Google Single Sign-On, or submit any personal information to us. If we learn that we have inadvertently collected personal data from a minor, we will promptly and permanently delete that information and terminate the associated account from our databases. If you believe a minor has registered an account with us, please contact us immediately at privacy@fourminutemedicine.com.
6. We do not process special categories of personal data. Do not provide us with any such personal data, where the provision of same will constitute an immediate and automatic material breach of these terms.

1.2 Responsible Party and Operator

1. 4MM is the “Responsible Party” and is responsible for your personal data in instances where we decide the processing operations concerning your personal data. Sometimes we also operate as an “Operator” of personal data on behalf of a third-party Responsible Party, where that Responsible Party’s privacy terms will apply, but we will draw your attention to them, when applicable.
2. We have appointed a data representative at 4MM who is responsible for overseeing questions in relation to this Privacy Policy. If you have any questions about this Privacy Policy, including any requests to exercise your legal rights, please contact the representative using the details set out below.

1.3 Our Contact Details

Our full details are:

• Full name of legal entity: Four Minute Medicine (Pty) Ltd
• Information Officer: Phinda Njisane
• Email address: privacy@fourminutemedicine.com
• Postal address: PO Box 31063, Tokai, Cape Town, 7966

You have the right to make a complaint at any time to the South African regulator’s office (Information Regulator’s Office of South Africa). We would, however, appreciate the chance to deal with your concerns before you approach any such regulator, so please contact us in the first instance.

1.4 Changes to the Privacy Policy and Your Duty to Inform us of Changes

1. This Privacy Policy version was last updated on 29 October 2026 and historic versions are archived and can be obtained by contacting us.
2. It is important that the personal data we hold about you is accurate and current. Please update your personal data yourself using the relevant prompts on the Platform or keep us informed if your personal data changes during your relationship with us.

1.5 Third-Party Links on Platform or otherwise

The Platform may include links to third-party Platforms, plug-ins, and applications. Clicking on those links or enabling those connections may allow third parties to collect or share data about you. We do not control these third-party Platforms and are not responsible for their privacy statements or terms. When you leave our Platform or engage with such third parties, we encourage you to read the distinct privacy policy of every third party you engage with.

2. The Data We Collect About You

1. Personal data, or personally identifiable information, means any information about an individual, both natural and juristic entities (i.e., people and companies), from which that entity can be identified. It does not include data where the identity has been removed (anonymous data).
2. We may collect, use, store, and transfer (“process”) different kinds of personal data about you which we have grouped together as follows:
   • Identity Data including first name, last name, gender, username or similar identifier or the information about your company such as company registration details, company address and name;
   • Student or User Data including HPCSA registration number, student number, attending university, and subjects or discipline of interest;
   • Contact Data including email address, mobile number, and social media contact details;
   • Employment Data including educational background, professional qualifications, work history, registration numbers with relevant medical councils, areas of clinical expertise, certifications, references, and any other information provided in the CV or supporting documents. This data may also include information regarding professional memberships, languages spoken, and any additional skills or achievements relevant to the job application. We may use AI software to automatically screen and process this Employment Data to assess whether you meet the requirements of the advertised job positions on the Platform. While this information is necessary as part of the Automated Processing and AI Screening, we utilise a tool to delete and redact any personally identifiable information from the CV and we do not store any information uploaded to the Platform. We only store the final report that is generated once the AI Screening has been concluded;
   • Financial Data including bank account details, third-party payment provider information and payment card details (which we do not store but only provide to our authorised third-party payment service provider under contract with us);
   • Social Media Data including all information accessible on your publicly available profile such as images, photos, photo tags, likes, followers, comments, posts, and stories;
   • Transaction Data including details about payments to and from you, contracts, contractual terms, contract fees, signups, subscriptions, invoices and other details of Services you have obtained from us, or provided to us;
   • Technical Data including internet protocol address/es, your login data, browser type and version, time zone setting and location, cookies, browser plug-in types and versions, operating system and platform and other technology on the devices you use to access the Platform;
   • Profile Data including your Platform/Profile username and password, preferences, feedback, ratings and reviews, and questionnaire responses;
   • Automated Processing and AI Screening: We use AI software to assist in screening and evaluating doctors' CVs and related Employment Data to determine suitability for specific job positions advertised on the Platform. This may involve automated decision-making processes. You have the right to request human intervention, express your point of view, and contest any decision made solely by automated means, as provided under applicable data protection laws.
   • Usage Data including information about how you use our company, Platform, surveys, events, and Services; and
   • Marketing and Communications Data including your preferences in receiving notices and marketing from us and our third parties and your communication preferences.
   • Google Single Sign-On (SSO) Data: If you choose to register, log in, or link your account using Google Single Sign-On, we collect authentication data received from Google, including your unique Google account identifier, full name, verified email address, and profile picture URL.
3. We may also collect, use and share Aggregated Data such as statistical or demographic data for any purpose. Aggregated Data may be derived from your personal data but is not considered personal data in law as this data does not directly or indirectly reveal your identity. However, if we combine or connect Aggregated Data with your personal data so that it can directly or indirectly identify you, we treat the combined data as personal data which will be used in accordance with this Privacy Policy.
4. Where we need to collect personal data by law, or under the terms of a contract we have with you and you fail to provide that data when requested, we may not be able to perform the contract we have or are trying to enter into with you. In this case, we may have to cancel your access to the Platform or the Services you are accessing, but we will notify you if this is the case at the time.

3. How Is Your Personal Data Collected?

We use different methods to collect data from and about you, including through:

• Direct interactions: You may give us your Identity, Student, Contact, Profile, Social Media, Transaction and Financial Data by filling in 4MM forms, or by corresponding with us by phone, email or otherwise. This includes personal data you provide when you:
  • use our Services;
  • use our Platform;
  • sign-up for newsletters;
  • interact with us via social media such as Instagram, LinkedIn, Twitter or YouTube;
  • complete an online form;
  • provide any services to us as a service provider or independent contractor;
  • request information to be sent to you;
  • give us some feedback.
• Automated technologies or interactions: As you interact with our Platform, we may automatically collect Technical Data, Profile and Usage Data about your equipment, browsing actions and patterns. We may collect this personal data by using cookies, server logs and other similar technologies. We may also receive Technical Data about you if you visit other Platforms employing our cookies.
• Third parties or publicly available sources: We may receive personal data about you from various third parties and public sources as set out below:
  • analytics providers Amazon and/or Google based in the USA;
  • social media networks like LinkedIn and Instagram based in the USA;
  • providers of services related to marketing and communication such as Tally based in Belgium, Typeform based in Spain, ActiveCampaign based in the USA, Google based in USA and
  • providers of technical and/or payment services being Amazon Web Services based in the USA; Strapi based on France; CookieYes based in the United Kingdom, and Peach Payments based in South Africa.
  • Publicly available sources such as the Health Professionals Council of South Africa based in South Africa.

4. Lawful Bases for Processing Personal Data

We will only use your personal data under one or more lawful basis for processing. Most commonly, we will use your personal data in the following circumstances:

• where we have your express consent to do so;
• where we need to consult with you or perform on the Services contract we are about to enter into or have entered into with you;
• where it is necessary for our legitimate interests (or those of a third party) and your interests and fundamental rights do not override those interests; and/or
• where we need to comply with a legal or regulatory obligation.

5. Purposes for Which We Will Process Personal Data

1. We have set out below, in a table format, a description of all the ways we plan to use your personal data, and which of the legal bases we rely on to do so. We have also identified what our legitimate interests are, where appropriate, and which exact External Third Parties your personal data is handed to for same reasons.
2. Note that we may process your personal data for more than one lawful ground depending on the specific purpose for which we are using your data.

5.1 Change of Purpose

1. We will only use your personal data for the purposes for which we collected it unless we reasonably consider that we need to use it for another reason and that reason is compatible with the original purpose. If we need to use your personal data for an unrelated purpose, we will notify you and we will explain the legal basis which allows us to do so.
2. Please note that we may process your personal data without your knowledge or consent, in compliance with the above rules, where this is required or permitted by law.

5.2 Marketing and Communication Preferences

1. We strive to provide you with granular control over communications. You can manage your preferences or unsubscribe from specific distribution lists (e.g., Clinical Co-Creators, Clinical Foundations Series, Jobs & Opportunities, Medhi Users, Perks & Incentives) or unsubscribe from all marketing communications at any time by clicking the "unsubscribe from this list" link in the footer of any promotional email, or by contacting us directly.
2. You will receive product, educational, and platform updates from us if you register an account on our Platform (including via Google Single Sign-On) and have not opted out. We do not share your email address with third parties for their independent marketing purposes.

5.3 Opting-Out

1. You can opt out of any or all marketing communications at any time via the email preference center or by selecting "Unsubscribe All". Opting out of marketing does not affect essential service, security, transactional, or administrative messages necessary for operating your account.
2. Where you opt-out of receiving these marketing messages, this opt-out will not apply to other personal data of yours which we process for another lawful basis.

6. Disclosures of Your Personal Data

1. We may have to share your personal data with the parties set out below for the purposes set out above.
2. Internal Third Parties including other entities or parties in the 4MM group and their respective directors and employees, acting as joint responsible parties or operators;
3. External Third Parties including:
   • authorised third-party service providers under contract with 4MM who need your personal information to provide their services to you pursuant to your use of our services;
   • service providers and contractors providing their services to us and acting as operators of your personal information on instruction from us;
   • South African or other national governments and/or their respective authorities pursuant to our adherence with legislative requirements; such as tax; and
   • professional advisers acting as operators or joint responsible parties including lawyers, bankers, auditors and insurers who provide consultancy, banking, legal, insurance and accounting services as required.
4. Third parties to whom we may choose to sell, transfer, or merge parts of our company or our assets. Alternatively, we may seek to acquire other organisations or merge with them. If a change happens to our company, we may continue to use your personal information in the same way as set out in this Privacy Policy.
5. We require all third parties to respect the security of your personal data and to treat it in accordance with the law. We do not allow our third-party service providers to use your personal data for their own purposes and only permit them to process your personal data for specified purposes and in accordance with our instructions and standards.

7. Google API Services User Data & Limited Use Disclosure

1. When you use Google Single Sign-On to access 4MM, we access only the basic profile and identity permissions authorised by you through your Google account settings.
2. We use data obtained through Google SSO to authenticate your identity, create and maintain your account, facilitate core Platform access, and send essential transactional and account security notices. If you register via Google SSO, your email address may also be used to send relevant 4MM educational and platform updates subject to your marketing preferences, from which you may unsubscribe at any time via the email preference center.
3. 4MM does not sell, rent, or transfer personal data obtained via Google APIs to data brokers or third parties, except to infrastructure and communications service providers strictly necessary to deliver the Service and authorised communications (such as our database hosting provider, Supabase, or our email delivery providers acting solely on our instructions), or as required by law. We do not use Google user data to serve personalised, retargeted, or interest-based third-party advertisements.
4. AI and Machine Learning Models: Data accessed via Google APIs is never used to train, retrain, or fine-tune generalised or foundation artificial intelligence (AI) or machine learning (ML) models. Google authentication credentials and account identifiers stored within our database backend are logically segregated from any AI training, testing, or bias-monitoring pipelines.
5. Limited Use Statement: 4MM’s use and transfer to any other app of information received from Google APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements.
6. Revocation of Google Permissions: You can revoke 4MM’s access to your Google account at any time via your Google Account Third-Party Permissions Settings.

8. Express Cookies Provision

1. The Platform may make use of “cookies” to automatically collect information and data through the standard operation of the Internet servers. “Cookies” are small text files a Platform can use (and which we may use) to recognise repeat users, facilitate the user’s ongoing access to and use of a Platform and allow a Platform to track usage behaviour and compile aggregate data that will allow the Platform operator to improve the functionality of the Platform and its content, and to display more focused advertising to a user by way of third-party tools.
2. The type of information collected by cookies is not used to personally identify you. If you do not want information collected using cookies, there is a simple procedure in most browsers that allows you to deny or accept the cookie feature. Please note that cookies may be necessary to provide you with certain features available on our Platform, and thus if you disable the cookies on your browser, you may not be able to use those features, and your access to our Platform will therefore be limited. If you do not disable “cookies”, you are deemed to consent to our use of any personal information collected using those cookies, subject to the provisions of this Policy and our other policies or terms.

9. International Transfers

1. We may share your personal data within our company group and/or with affiliates, and this may involve transferring and processing your data outside of South Africa.
2. If we transfer your personal data out of South Africa, we ensure a similar degree of protection is afforded to it by ensuring at least one of the following safeguards is implemented:
   • We will only transfer your personal information to countries that have appropriate data protection legislation in place similar to that of South Africa; and/or
   • Where we use certain service providers, we may use specific contracts/clauses which give personal data the same protection it has in South Africa.

10. Data Security

1. We have put in place appropriate security measures to prevent your personal data from being accidentally lost, used, or accessed in an unauthorised way, altered, or disclosed by using encryption of all your data and making sure all data is access-restricted with access keys & private keys. In addition, we limit access to your personal data to those employees, agents, contractors and other third parties who have a legitimate need to know. They will only process your personal data on our instruction, and they are subject to a duty of confidentiality.
2. We have put in place procedures to deal with any suspected personal data breach and will notify you and any applicable regulator of a breach where we are legally required to do so.

11. Data Retention & Deletion

1. We will only retain your personal data for as long as necessary to fulfil the purposes we collected it for, including the purpose of satisfying any legal, accounting, or reporting requirements.
2. To determine the appropriate retention period for personal data, we consider the amount, nature, and sensitivity of the personal data, the potential risk of harm from unauthorised use or disclosure of your personal data, the purposes for which we process your personal data, any other South African applicable law requiring us to retain the data and whether we can achieve those purposes through other means, and the applicable legal requirements.
3. In some circumstances we may anonymise your personal data (so that it can no longer be associated with you) for research or statistical purposes in which case we may use this information indefinitely without further notice to you.

11.1 Direct Account & Data Deletion

• Self-Service Deletion: You can permanently delete your account and all associated personal data directly within the Platform at any time by navigating to Settings > Delete Account and clicking "Delete My Account".
• Irreversibility & Database Purge: Once confirmed, this action cannot be undone. All personal data, profile records, and identifiers are permanently purged from our active production database (Supabase) and associated servers, excluding only anonymized statistical data or records we are required to retain to satisfy mandatory statutory, tax, or legal obligations.

12. Your Legal Rights

Under certain circumstances, you have rights under data protection laws in relation to your personal data where we are the relevant “Responsible Party” over such personal data. Please contact us to find out more about, or manifest, these rights:

• request access to your personal data;
• request correction of your personal data;
• request erasure of your personal data: You can exercise this right instantly via the self-service "Delete My Account" feature in your platform settings, or alternatively by submitting a request to our Information Officer at privacy@fourminutemedicine.com with the subject line "Data Deletion Request". Upon verification, all associated personal records will be permanently deleted from our active databases.
• object to the processing of your personal data;
• request a restriction on processing your personal data;
• request transfer of your personal data; and/or
• right to withdraw consent.

1. You will not have to pay a fee to access your personal data (or to exercise any of the other rights). However, we may charge a reasonable fee if your request is clearly unfounded, repetitive or excessive. Alternatively, we may refuse to comply with your request in these circumstances.
2. We may need to request specific information from you to help us confirm your identity and ensure your right to access your personal data (or to exercise any of your other rights). This is a security measure to ensure that personal data is not disclosed to any person who has no right to receive it. We may also contact you to ask you for further information in relation to your request to speed up our response.
3. We try to respond to all legitimate requests within one month. Occasionally it may take us longer than a month if your request is particularly complex or you have made a number of requests. In this case, we will notify you and keep you updated.