Privacy policy.
Version 2.0. Effective 28 September 2026. This policy explains how BodyAxis processes personal information under the Protection of Personal Information Act 4 of 2013 (POPIA). It forms part of our terms and conditions.
1. Who is responsible
BodyAxis is the responsible party for the personal information described in this policy. BodyAxis operates bodyaxis.co.za and body-axis.web.app from Pretoria, Gauteng, South Africa.
Our Information Officer is the owner of BodyAxis. Privacy requests, questions and complaints go to orders@bodyaxis.co.za with the subject line "POPIA".
2. What this policy covers
This policy covers personal information we collect when you browse the platform, take the online assessment, apply for the Private range, apply to be a reseller, create or use an account, place an order, contact us, or receive email, SMS or WhatsApp messages from us. It covers customers, members, resellers, applicants and visitors.
3. What we collect
We collect only what each activity needs. The table shows what we collect, where it comes from and what it is used for.
| Activity | Information | Used for |
|---|---|---|
| Online assessment | Your first name, email address and, if you give it, WhatsApp number; your answers to the assessment questions (age band, change in weight over time, approaches you have tried, what tends to interrupt a plan, whether you are open to the Private range); the date and time. | Sending you your assessment result and following up on it, which you consent to when you submit it. |
| Private range application | First and last name, email address, mobile number, date of birth, region, why you are interested, anything you choose to add in the notes field, your confirmation that you are 18 or older and that you accept the terms, and the date and time of that confirmation. | Reviewing your application, confirming that you are 18 or older, creating your account if approved, and keeping a record of your acknowledgements. |
| Reseller application | Name, email address, WhatsApp number, area, expected monthly volume, how you heard about us, a short description of yourself, and your acceptance of the terms. | Reviewing your application, setting your reseller tier and managing your reseller account. |
| Account | Name, email address, phone number, role (client, reseller or owner), reseller tier where applicable, account status, the date you were created and last seen, and your notifications inside the platform. | Signing you in, showing you the right catalogue and pricing, and running your account. |
| Passkeys (owner accounts) | A passkey credential identifier and public key, and a short-lived sign-in challenge. Your fingerprint or face never leaves your device and is never sent to us. | Passwordless sign-in for the platform owner. |
| Orders | Name, email address, phone number, delivery address, the items and amounts ordered, the delivery option and courier service you chose, your payment method, a payment reference from the payment provider, the status of the payment and of the delivery, the tracking reference, your acceptance of the terms at checkout, and any proof-of-payment file you upload for a manual EFT. | Processing, paying for, dispatching and tracking your order; sending order, payment and shipping emails; handling returns and complaints; tax and accounting records. |
| Contact and support | Your messages to us and our replies, by email, SMS or WhatsApp. | Answering you and keeping a record of what was agreed. |
| Technical | IP address, browser and device type, pages requested and request times, as recorded in the standard logs of our hosting provider (Google Firebase). | Security, fraud prevention, and diagnosing faults. We do not run analytics or advertising trackers. |
What we do not collect. We never see or store your card number, bank login, banking password or one-time PIN. Payments are made on the payment provider's own pages. We do not collect identity numbers. We do not buy or collect information about you from data brokers.
4. Health information
Health information is special personal information under section 26 of POPIA and we keep our handling of it to a minimum.
- The assessment asks about your age band and how your weight has changed over time. You give those answers voluntarily and you consent to us processing them when you submit the assessment. They are used only to send you and discuss your result. They are not used to decide whether an application is approved.
- The notes field on the Private range application is optional. Please do not put medical information in it. If you do, we treat it as given with your consent, we use it only to respond to your application, and we will delete it on request.
- We do not ask for, and you should not send us, medical records, diagnoses, prescriptions or test results. If you send them anyway, we will delete them unless you ask us to keep them for a specific reason.
- We do not share health information with anyone, and we do not use it for marketing.
5. Why we process it and on what basis
POPIA requires a lawful basis for every use of personal information. Ours are:
- To perform a contract with you (section 11(1)(b) of POPIA): reviewing applications, running your account, processing and delivering orders, taking payment, handling returns and answering support requests.
- To comply with the law (section 11(1)(c)): keeping tax and accounting records, confirming that Private range applicants are 18 or older, responding to lawful requests from authorities, and keeping evidence of the acknowledgements you give us.
- Our legitimate interests (section 11(1)(f)): keeping the platform secure, preventing fraud, enforcing our terms, and improving how the platform works, in each case only where our interest is not outweighed by your rights.
- Your consent (section 11(1)(a)): assessment answers and any health information you volunteer, and any direct marketing you opt in to. You may withdraw consent at any time by emailing orders@bodyaxis.co.za; withdrawal does not affect processing that happened before it.
6. Marketing
We send you emails and messages that are needed to run your account and your orders (confirmations, payment receipts, shipping notifications, application decisions, security alerts). Those are not marketing and you cannot opt out of them while you have an account or an open order.
We send marketing messages by email, SMS or WhatsApp only in line with section 69 of POPIA: to people who have opted in, or to existing customers about our own similar products, with an opt-out on every message. Consenting to be contacted about your assessment result is not consent to marketing. To stop marketing at any time, use the opt-out in the message or email orders@bodyaxis.co.za. We never sell or rent your details to anyone for their marketing.
7. Who we share it with
We share personal information only with the operators we need to run the platform, each of which processes it on our instructions under a written agreement, and only as much as each one needs:
| Operator | What they receive | Why |
|---|---|---|
| Google (Firebase Hosting, Authentication, Cloud Firestore, Cloud Storage, Cloud Functions) | All platform data | Hosting the platform, storing its database and files, running its server code and signing you in. |
| Google (Gmail) | Your email address and the content of emails we send you | Sending order, payment, shipping and account emails. |
| Ozow | Order reference, amount, and your name and email address | Instant EFT payments. |
| HappyPay and PayJustNow | Order reference, amount, your name, email address, phone number and, where required, your delivery address | Pay-later payments. Each provider is a responsible party in its own right for its credit assessment and account with you. |
| The Courier Guy | Your name, phone number, email address and delivery address, and the parcel details | Quoting, booking, delivering and tracking your parcel. |
| Google Fonts | Your IP address and browser details when a page loads a font | Displaying the platform's typefaces. |
We also disclose personal information where the law requires it, to respond to a lawful request from a court, regulator or law-enforcement body, to establish or defend a legal claim, or, if BodyAxis or its assets are sold or transferred, to the buyer, who will be bound by this policy. Approved resellers receive the name, contact details and delivery address of their own customers' orders that we fulfil for them, and nothing about anyone else.
8. Where it is stored
The platform runs on Google Cloud. Our database and uploaded files are stored in Google's United States regions, and our server code runs in Google's European and United States regions. Email is sent through Google's mail servers. Your personal information therefore leaves South Africa.
Section 72 of POPIA allows this where the recipient is bound by a law, binding corporate rules or a contract that gives protection substantially similar to POPIA. Google processes our data under its Cloud Data Processing Addendum, which includes those protections, and Google Cloud is certified under ISO/IEC 27001, 27017 and 27018. Ozow, HappyPay, PayJustNow and The Courier Guy process your information in South Africa.
9. Cookies and browser storage
The platform does not use advertising cookies, analytics scripts or tracking pixels. It uses your browser's local storage for these purposes only:
- keeping you signed in after you log in (Firebase Authentication);
- remembering the items in your cart and your assessment reference between pages; and
- remembering preferences such as a dismissed notice.
None of this is shared with third parties. You can clear it at any time through your browser settings. Clearing it signs you out and empties your cart. The payment providers' own pages set their own cookies under their own policies.
10. How we protect it
Section 19 of POPIA requires us to secure personal information with appropriate, reasonable measures. Ours include:
- encryption of all traffic between your browser and the platform (TLS), and encryption of stored data by Google Cloud;
- database access rules that let you read and change only your own records, let resellers see only their own orders, and reserve administrative access for the platform owner;
- server-side checks on every order, so that prices and payment status cannot be altered from a browser;
- role-based access for our own staff, passkey sign-in for the owner account, and separate secret storage for provider credentials;
- payment pages hosted by the payment provider, so that card and banking details never pass through us; and
- written processing agreements with every operator listed in section 7.
No system is perfectly secure. You help by keeping your password and passkey private and by telling us at once if you suspect misuse of your account.
11. If something goes wrong
If we have reason to believe that your personal information has been accessed or acquired by an unauthorised person, section 22 of POPIA requires us to notify the Information Regulator and, unless a public body directs otherwise, to notify you as soon as reasonably possible after discovery. We will tell you what happened, what information was involved, what we have done about it and what you can do to protect yourself.
12. How long we keep it
| Information | Kept for |
|---|---|
| Orders, payment references, invoices and proof of payment | 5 years after the end of the tax year of the order, as required by the Tax Administration Act 28 of 2011 and the Companies Act 71 of 2008. |
| Account records and your acknowledgements of the terms | While your account is active, and for 3 years after it is closed so that we can deal with any claim under the CPA. |
| Private range and reseller applications | Approved: as part of your account. Declined or withdrawn: 12 months from the decision, then deleted. |
| Assessment answers | 12 months from submission, then deleted unless you have become a member, in which case they are deleted when your account is. |
| Support correspondence | 3 years from the last message. |
| Passkey credentials and sign-in challenges | Credentials until you remove them; challenges for minutes. |
| Hosting logs | Per Google's default log retention for Firebase Hosting and Cloud Functions, currently 30 days. |
When a period ends we delete the information or de-identify it so that it can no longer be linked to you. If you ask us to delete your information sooner, we will, except for records the law requires us to keep, which we restrict to that purpose only.
13. Your rights
Under POPIA and the Promotion of Access to Information Act 2 of 2000 (PAIA) you may:
- ask whether we hold personal information about you and request a copy of it (section 23 of POPIA). We will confirm within a reasonable time and free of charge, and supply the record itself for at most the prescribed fee;
- ask us to correct or update information that is inaccurate, out of date or incomplete (section 24);
- ask us to delete or destroy information that is excessive, out of date, unlawfully obtained or no longer needed for the purpose we collected it (section 24), subject to section 12 above;
- object to processing based on our legitimate interests, on reasonable grounds relating to your situation (section 11(3));
- object to direct marketing at any time, without giving a reason (section 11(3)(b));
- withdraw consent where processing is based on it (section 11(2)); and
- complain to the Information Regulator (section 17).
To use any of these rights, email orders@bodyaxis.co.za with the subject "POPIA" from the email address on your account, and tell us what you want. We may ask you to confirm your identity before we act. We respond within 30 days. Our PAIA manual is available on request at the same address.
14. Automated decisions
We do not make decisions about you by automated means alone. Every Private range and reseller application is reviewed and decided by a person. The pay-later providers make their own credit decisions under their own policies; those decisions are theirs and you should ask them how they are made.
15. Children
The Private range is only available to people who are 18 or older, and the application asks for your date of birth and your confirmation of that. The rest of the platform is not directed at children and we do not knowingly collect personal information from anyone under 18 without the consent of a parent or guardian. If you believe a child has given us personal information, email orders@bodyaxis.co.za and we will delete it.
16. Other websites
When you pay, you are taken to the payment provider's own website. When you track a parcel, you use the courier's website. Their privacy policies, not ours, apply to what you do there. We are not responsible for the content or privacy practices of any website we link to.
17. The Information Regulator
If you are not satisfied with how we have handled your personal information or your request, you may lodge a complaint with the Information Regulator (South Africa):
- Website: inforegulator.org.za
- General enquiries: enquiries@inforegulator.org.za
- POPIA complaints: POPIAComplaints@inforegulator.org.za
- Telephone: 010 023 5200, toll free 0800 017 160
- Address: JD House, 27 Stiemens Street, Braamfontein, Johannesburg, 2001
We would prefer the chance to put things right first, so please contact us before you complain, but you are not obliged to.
18. Changes
We will update this policy when our processing changes or the law requires it. The version number and effective date at the top of the page show the current version. If a change materially affects how we use information we already hold about you, we will email you before it takes effect.
19. Contact
Privacy requests, questions and complaints: orders@bodyaxis.co.za, subject line "POPIA". We reply within 2 working days and resolve requests within 30 days.