Privacy Policy

Last updated 6 October 2026

This policy explains what personal information BodyHack (“we”) collects through bodyhack.co.za, why, who we share it with and what your rights are under the Protection of Personal Information Act (POPIA). We do not sell your personal information.

1. What we collect

Account details: your name, email address, cellphone number and password (stored only in scrambled, “hashed” form – we cannot see it).
Orders: delivery address, phone number, the products you bought, the batch you received, order and payment status, and Yoco's payment reference. Your card details go directly to Yoco; we never see or store them.
Purchase confirmations: when you buy an investigational product, your answers to the four confirmation questions, with the date, time and your IP address, stored with the order. When you enter an investigational category, the date you confirmed the notice (on your account if you are logged in).
Lab testing service: the details and photos of the product you want tested, your requests, tracking numbers and the results.
Messages: your questions, our replies and any photos or PDFs you attach.
My personal journey (only if you choose to use it): your goal, measurements (such as weight, pain or sleep), how you feel, side effects, notes and optional progress photos. This is health information – see section 3.
Technical and security information: your IP address, browser type, the pages you request and security events such as failed logins or blocked attacks.

We collect this from you when you use the site, from Yoco (payment confirmation) and from our courier (delivery status). We do not buy personal information from anyone.

2. Why we use it

To provide what you ask for (performing our agreement with you): processing and delivering orders, running lab tests, answering messages, keeping your account working, and sending you updates in your Messages.
With your consent: storing and showing your personal journey, and using it anonymously for community results and quality checks. You can withdraw consent by deleting the journey.
For our legitimate interests: keeping the site secure, preventing fraud and abuse, checking product quality per batch, and improving our service.
To meet legal duties: for example keeping financial records required by tax law.

We do not send marketing messages and do not use your information for advertising.

3. Health information (My personal journey)

We process this special personal information only with your explicit consent, which you give when you start a journey.
Your journey is private: only you can see it. Our team can access it only where needed – for example to follow up a severe side effect you report, or to investigate a possible problem with a product batch.
Community results are anonymous totals (for example “how many people felt better”). They never show names or contact details, and a result is only shown once at least 10 people have tracked the same product and goal, so no individual can be singled out.
Stories are only shared if you tick the option to share, without your name, and after we have checked them.
We never share your health information with employers, insurers, advertisers or anyone else for their own purposes.
You can delete a journey – including all check-ins and photos – at any time on its page.

Only what each party needs to do its job:

Yoco (payment provider) – the amount and order reference to take your payment; you give your card details directly to Yoco.
Our courier – your name, delivery address and cellphone number to deliver your parcel.
Our partner laboratory – your sample and its reference number. The laboratory does not receive your name or contact details.
Service providers that run the site for us: Render (hosting and database), Cloudflare (domain name service) and Telegram (instant notifications to our own team about new orders, messages and reports, which can include your name and order details). They may only use the information to provide their service to us.
Google Fonts and YouTube: our pages load fonts from Google, and when you play an embedded video it loads from YouTube's privacy-enhanced mode. Your browser connects to their servers, which see your IP address.
Authorities, if the law requires it.

5. Information stored outside South Africa

Our website and database are hosted by Render in Frankfurt, Germany (European Union), where data protection law (the GDPR) gives protection comparable to POPIA. Telegram notifications and some service providers' systems may also process information outside South Africa. We only use providers that are bound to protect it.

6. How long we keep it

Orders and payment records (including purchase confirmations): 5 years, as required for tax records and to show how products were sold.
Account, messages and lab requests: while your account exists; ask us to delete them at any time (records we must keep by law are then kept separately and not used for anything else).
My personal journey: until you delete the journey or your account.
Security logs: 90 days, then deleted automatically.
Batch certificates contain no personal information and are kept permanently.

7. How we protect it

The site uses encrypted connections (HTTPS) only. Passwords are hashed. Photos, attachments, lab results and journey photos are stored privately and are only shown to you and our team. Access to the admin area is limited and every admin login is reported. The site is protected against common attacks and automatically blocks addresses that probe it. If a security breach affects your information, we will tell you and the Information Regulator as POPIA requires.

8. Cookies

We only use the cookies the site needs to work: a login (session) cookie that keeps you logged in and remembers your cart, and a security cookie that protects forms against forgery. We do not use advertising, tracking or analytics cookies.

9. Children

The site is not intended for anyone under 18, and we do not knowingly collect information about children.

10. Your rights

Under POPIA you may:

ask what personal information we hold about you and receive a copy;
ask us to correct or delete it (you can correct your details yourself under “My account” and delete journeys yourself);
object to us using it, or withdraw your consent;
complain to the Information Regulator (inforegulator.org.za, complaints.IR@inforegulator.org.za).

To use these rights, send us a message or contact us using the details below. We may ask you to confirm your identity first, and we answer within a reasonable time.

11. Contact and Information Officer

BodyHack
Or send us a message on the site.

We may update this policy when our services change. The date at the top shows the latest version.