Entriva — Privacy Notice

Entriva is an onboarding service operated by Praxiva (Pty) Ltd (CIPC 2026/392940/07). An organisation, such as a dental practice, a golf club or another organisation, uses Entriva to ask you its questions over WhatsApp. That organisation is the responsible party: it decides what is asked and how your answers are used. Praxiva (Pty) Ltd is the operator: it processes your information on the organisation's behalf.

privacy@praxiva.co.za

Your name, your contact details, and your answers to the organisation's questions, together with a short summary of those answers written by AI for the organisation. What is asked depends on the organisation:

• Health organisations (such as a dental practice): medical aid information, medical history, and the reason for your visit. For these the summary is a clinical summary with ICD-10 suggestions and risk flags.
• Golf clubs: the membership you are applying for, your handicap and GolfRSA number, and who is proposing you. A golf club does not ask about your health or for bank details.
• Other organisations: the questions the organisation wrote itself. These organisations do not use Entriva for health information.

We process your information so the organisation that invited you can onboard you: prepare for your appointment, consider your membership application, or take you on. You consent before the first question, and you can withdraw that consent at any time. Health information is processed only for health organisations, for the provision of treatment by your health professional and with your consent.

We use the following service providers, each bound by data-protection terms:

• Our hosting provider — secure database and hosting; your data at rest is stored in the European Union (Ireland).
• Our WhatsApp messaging provider — delivery of your messages over WhatsApp (United States). Your answers travel over the WhatsApp platform, which you choose to use.
• Our AI provider — AI generation of the summary of your answers, and for health organisations the ICD-10 suggestions and risk flags (United States).

An organisation that uses Entriva can ask privacy@praxiva.co.za for the names of these providers.

An organisation that is not a health organisation may also have Entriva send your answers straight to its own systems, such as its membership system or CRM, when you finish. That is the organisation's choice as responsible party; each send is recorded in its audit log, and photos or documents you sent are never included.

We do not sell your information or use it for our own marketing.

Your data at rest is held in the EU. Message delivery and AI processing occur in the US. These transfers are made under POPIA §72 safeguards — our providers are bound by data-processing agreements incorporating standard contractual clauses offering protection substantially similar to POPIA.

Your answers are encrypted at rest (AES-256-GCM) and in transit (TLS). Access is limited to the organisation's authorised users, and every action on your data is written to a tamper-evident audit log (POPIA §17 and §19).

When a golf club or another non-health organisation onboards someone under 18, a parent or guardian completes the questions and consents on their behalf.

AI-processing prompts are deleted within 30 days. How long your answers are kept depends on the organisation:

• Health organisations: your records are kept for at least 6 years, in line with HPCSA Ethical Rule 5 and the National Health Act.
• Golf clubs: An application that does not become a membership is deleted after 12 months. A member's record is kept while they are a member and for 5 years after, unless the club sets a shorter period.
• Other organisations: Your answers are kept for as long as the organisation needs them and for at most 5 years after your last onboarding with them.

Entriva holds your records on the organisation's behalf and deletes or returns them on its instruction, never earlier than the law requires.

You may request access to, correction of, or deletion of your information, and you may object to its use. Contact the organisation that invited you, or privacy@praxiva.co.za. You may also lodge a complaint with the Information Regulator of South Africa.