Effective date: 21 June 2026
1. Who we are. Navigo (Pty) Ltd (Reg No 2023/232586/07), trading as Vitesta, is the Responsible Party for your personal information under POPIA. Information Officer: officer@vitesta.co.za.
2. What we collect. Identity & contact (name, email, phone, date of birth, sex); your address for the home visit; health information (special personal information) — the tests you choose and your blood-test results; order and payment confirmation (we do not store your full card number); and basic technical/usage data, plus a referral code if used.
3. Health information. We process your health information with your consent for the purposes below, as permitted under POPIA. You may withdraw consent, though this may mean we can no longer provide the service.
4. Why we process it. To create and manage your account; arrange and perform your home collection; have your sample analysed; generate and deliver your results and wellness guidance; take payment; contact you about your booking and results; provide support; meet legal obligations; and, in de-identified form, improve our service.
5. Lawful basis. Consent; performance of our contract with you; compliance with law; and our legitimate interests in operating and securing the service.
6. Who we share it with. Testaro performs your blood collection and laboratory analysis as an independent, accredited provider under its own clinical protocols and privacy practices (Testaro is responsible for the clinical handling of your sample and results). We share the information necessary to arrange your service with Testaro and receive your results from them. We also share the minimum necessary with: phlebotomy/collection partners where applicable; our payment provider; our email/communications provider; hosting & IT providers (database, application, automation tooling); and, if you use address autocomplete, Google (to return address suggestions). We require our operators to protect your information and process it only on our instructions. We do not sell your personal information.
7. Cross-border processing. Some of our service providers process or store information outside South Africa — including our cloud hosting and database, the third-party services we use to help generate your results report, and address autocomplete. Where information is processed outside South Africa, we rely on the bases permitted by POPIA (section 72) — including your consent and agreements requiring our providers to protect your information to a comparable standard — and we limit what is shared to what each provider needs.
8. How we protect it. Access controls and row-level security (you can only access your own data); pseudonymisation separating your identity from your clinical data; encryption in transit; restricted back-office access; and activity logging. No system is perfectly secure; we will notify you and the Information Regulator of a compromise as required by law.
9. Retention. Vitesta keeps a copy of your results for up to 24 months for easy access, then deletes or de-identifies them unless the law requires longer. Your authoritative clinical laboratory records are held by Testaro, the accredited provider, and are retained by Testaro for the period the law requires for clinical records — currently 6 years for adults, and longer for minors. As clinical records these are kept under your identifying details (name, date of birth), not under an internal code only, and Vitesta cannot shorten or delete Testaro’s statutory records. When you ask us to delete your data, we delete or de-identify what Vitesta holds where we are able, subject to anything we must keep by law. Retention periods follow HPCSA and National Health Act guidance.
10. Your rights. You may request access to what we hold; correct or update it; ask us to delete it; object to processing; and withdraw consent. You can lodge a deletion request from the Privacy & data screen in your account, or email officer@vitesta.co.za. You may also complain to the Information Regulator. We may verify your identity first.
11. Children. Vitesta is for adults (18+). We do not knowingly process a child’s information without the consent of a competent person.
12. Cookies / local storage. We use minimal browser storage needed to run the site (e.g. to keep you logged in and remember a referral code).
13. Changes. We may update this notice; the current version is posted here.
14. Contact & complaints. Information Officer: officer@vitesta.co.za. Information Regulator (South Africa): enquiries@inforegulator.org.za (general) or POPIAComplaints@inforegulator.org.za (POPIA complaints); inforegulator.org.za.