POPIA Notice

ClaimIQ SA (Pty) Ltd is the “responsible party” for personal information you submit to us. Our Information Officer can be contacted atprivacy@claimiq.co.za.

To review and dispute a rejected medical aid claim on your behalf, we collect:

• Identification & contact details:full name, email address, WhatsApp / phone number.
• Medical scheme information: scheme name (e.g. Discovery, Bonitas, Momentum), plan / option, membership context.
• Claim information: claimed amount, rejection reason, event description.
• Special personal information (health data):rejection letters, hospital bills, discharge summaries, clinical notes, ICD-10 diagnosis codes, procedure codes and related medical documents you upload.

Health information is treated as “special personal information” under section 26 of POPIA and is processed on the basis of your consent for the specific purpose of pursuing your claim (section 27(1)(a)).

We use your information only for the following purposes:

• To perform the clinical and administrative review of your rejected claim.
• To act as your authorised representative in engaging your medical scheme and, if needed, the Council for Medical Schemes (“CMS”).
• To prepare dispute letters, PMB motivations and submission packs.
• To communicate with you about your matter and to invoice fees.
• To comply with legal, regulatory and record-keeping obligations in South Africa.

In the interests of transparency, we disclose that part of our review is performed by an automated AI clinical audit pipeline. The pipeline reads the documents you upload, extracts diagnosis and procedure codes, checks them against the ICD-10 Master Industry Table and Prescribed Minimum Benefits (PMB) rules, and produces a draft audit result and suggested resubmission letter.

The AI output is a decision-support tool. It is reviewed by a human on our clinical / dispute team before any dispute is submitted to your medical scheme on your behalf. You have the right to request human intervention, to express your view, and to contest a decision made about you as contemplated in section 71 of POPIA.

We share your information only with parties needed to progress your matter:

• Your medical scheme and its administrator, for the specific claim(s) you have instructed us on.
• The Council for Medical Schemes (CMS)if the matter is escalated for a ruling.
• Internal clinical and dispute reviewers(ClaimIQ staff and contracted clinical panel members) under confidentiality obligations.
• Cloud infrastructure and AI processing providers that host our platform and run the clinical audit pipeline, under written processing agreements. Where any provider processes data outside South Africa, we take reasonable steps under section 72 of POPIA to ensure comparable protection.
• Regulators, courts or law enforcementwhere we are legally required to disclose.

We do not sell your personal information and we do not use it for marketing profiling.

We retain your file for as long as reasonably necessary to progress your matter, to respond to follow-up queries, and to meet legal, accounting and regulatory record-keeping obligations. Ordinarily this is a period of up to 5 (five) years from the date the matter is closed, after which the file is securely deleted or de-identified.

We use encrypted transport (HTTPS), encrypted storage, role-based access controls, and audit logging on our claims platform. Access to health information is limited to staff who need it to progress your matter. Despite reasonable safeguards, no system is perfectly secure; if a security compromise affects your personal information, we will notify you and the Information Regulator as required by section 22 of POPIA.

Under POPIA you have the right to:

• Be told what personal information we hold about you and request a copy.
• Request that inaccurate or outdated information be corrected.
• Request deletion of information we are no longer legally entitled to keep.
• Withdraw your consent, or object to processing on reasonable grounds.
• Ask us not to use your information for direct marketing (we do not by default).
• Lodge a complaint with the Information Regulator (see section 10 below).

To exercise any of these rights, contactprivacy@claimiq.co.za. We may need to verify your identity before acting on the request. Note that withdrawing consent partway through a dispute may prevent us from continuing to act on your behalf.

As required by the Promotion of Access to Information Act 2 of 2000 (“PAIA”), a copy of our PAIA manual is available on request fromprivacy@claimiq.co.za.

If you believe we have handled your personal information unlawfully, you may lodge a complaint directly with the Information Regulator of South Africa:

• Website: www.inforegulator.org.za
• Email: complaints.IR@inforegulator.org.za

We would appreciate the opportunity to resolve any concern directly first — please see ourComplaints Procedure.

We may update this POPIA Notice from time to time. The latest version will always be available on this page with an updated effective date. Material changes will be communicated to active clients by email.

ClaimIQ SA (Pty) Ltd
Registration No.: [Pending CIPC Registration]
Information Officer: privacy@claimiq.co.za