DigiBroz (Pty) Ltd ("DigiBroz", "us", "we", or "our") operates Leru Health at https://leru.health (the "Service"). This policy explains how we collect, use, and protect personal information when you use the Service, and the choices you have about that information.
This policy is written to comply with South Africa's Protection of Personal Information Act ("POPIA"). If you are located in the European Union, United Kingdom, or another jurisdiction with its own data protection law, that law's rights apply to you in addition to what is described here.
Personal Information means information relating to an identifiable, living individual, such as your name, email address, or usage data.
Responsible Party (referred to elsewhere as "Data Controller") means the entity that determines the purpose and means of processing Personal Information. For this policy, that is DigiBroz.
Operator (referred to elsewhere as "Data Processor") means a third party that processes Personal Information on our behalf, under our instruction.
Data Subject means the individual to whom the Personal Information relates — typically you, the User of the Service.
Account data: name, email address, and any other information you provide when creating or managing your account.
Billing data: your Subscription plan and billing history. Card and payment details are collected and stored by our payment processor, Paddle, not by us directly — see "Payments" below.
Usage data: information about how you access and use the Service, such as IP address, browser type, pages visited, and timestamps, collected automatically as you use the Service.
Cookies: small pieces of data stored on your device to keep you signed in, remember preferences, and, where enabled, measure Service usage. You can control cookies through your browser settings; blocking them may limit parts of the Service.
We use the information above to:
We retain your Personal Information only as long as necessary for the purposes described in this policy, or as required to meet legal, accounting, or reporting obligations. When no longer needed, we delete or anonymize it.
Your information may be processed and stored on servers located outside South Africa, including by service providers such as Paddle. Where this happens, we take reasonable steps to ensure your data receives a level of protection consistent with this policy and applicable law.
We may disclose your Personal Information where required by law, or where we believe in good faith that disclosure is necessary to comply with a legal obligation, protect our rights or property, investigate wrongdoing connected to the Service, or protect the safety of users or the public.
We use commercially reasonable technical and organizational measures to protect your Personal Information. No method of transmission over the internet or electronic storage is completely secure, so we cannot guarantee absolute security.
Subject to applicable law, you have the right to:
Most account information can be updated directly in your account settings. For anything else, contact us using the details below. We may ask you to verify your identity before acting on a request.
You also have the right to lodge a complaint with South Africa's Information Regulator (or your local data protection authority, if applicable).
We use third-party service providers to help operate the Service, including hosting, email delivery, and payment processing. These providers only receive the Personal Information needed to perform their function, and are contractually restricted from using it for any other purpose.
Subscriptions are billed by Paddle.com Market Limited ("Paddle"), acting as our Merchant of Record. We do not collect or store your card details — they are provided directly to Paddle, whose handling of your payment information is governed by Paddle's Privacy Policy. Paddle is PCI-DSS compliant.
Where enabled, we use Google Analytics to understand how the Service is used. Google may process this data under its own privacy policy. Where our cookie consent banner is active, analytics cookies are only set after you consent; you can opt out at any time through your cookie preferences or your browser settings.
The Service may contain links to third-party sites we do not operate. We are not responsible for the content, privacy policies, or practices of any third-party site. Review the privacy policy of any site you visit.
The Service is not directed at children under 18, and we do not knowingly collect Personal Information from anyone under that age. If you believe a child has provided us with Personal Information, contact us and we will take steps to remove it.
We may update this policy from time to time. We will post the updated policy on this page and, for material changes, notify you by email or a prominent notice on the Service before the change takes effect.
If you have any questions about this Privacy Policy, contact us at support@leru.health.