Privacy policy: what we collect and how to delete it

Who processes your information

medicalinsurance.co.za operates as the responsible party under the Protection of Personal Information Act 4 of 2013 (POPIA) for the information you submit to us directly through this site.

When you ask to be contacted about a specific product, the accredited financial services provider or medical scheme we forward you to becomes a separate responsible party for that contact and for any application you go on to sign. Their own privacy terms apply from that point.

What we collect, and why

We only collect what is needed to produce an accurate comparison and to hand a complete enquiry to one accredited advisor. We never ask for medical records, ID documents or banking details on this site.

• Quote details: first name, last name, email, mobile number, province, age, number of dependants and income band — used to match you against published scheme rate tables.
• Cover preferences: whether you need hospital-only cover, day-to-day benefits, chronic medication or gap cover — used to rank options and calculate your Healthcare Affordability Score.
• Attribution data: campaign, source, medium, landing page, page URL, page title and referrer — used to measure which content and campaigns produce useful enquiries.
• Technical data: a first-party anonymous identifier cookie, approximate location derived from IP, browser and device type — used for security, fraud prevention and aggregate analytics.
• Account data, if you sign in: your email address and authentication identifiers, so you can return to your saved matches and delete your data yourself.

Our lawful basis for processing

For quote submissions we rely on your consent, given when you tick the contact consent box and submit a form. For fraud prevention, security logging and aggregate analytics we rely on our legitimate interest in operating a safe, measurable service.

You may withdraw consent at any time. Withdrawing consent stops future contact but does not undo an application you have already signed with a scheme or insurer.

Who we share your information with

We forward each enquiry to one accredited advisor for the product you asked about. We do not resell enquiries, we do not place them into a lead auction, and we do not sell contact data to third parties for unrelated marketing.

We also use a small set of processors that handle data on our instructions: our hosting and database provider, our lead-routing provider, and Google Tag Manager and Google Analytics for aggregate measurement. Each is bound by contract to process only for our stated purposes.

Cookies and attribution storage

We store campaign parameters (utm_source, utm_medium, utm_campaign, utm_content, utm_term, utm_id) and advertising click identifiers (gclid, fbclid, msclkid, ttclid, li_fat_id) in first-party storage for up to 90 days so that a later enquiry can be credited to the content that produced it.

We set a first-party anonymous identifier in an httpOnly cookie to stitch page views to an enquiry without exposing that identifier to browser scripts. Clearing your browser storage removes all of it.

How long we keep it

Quote submissions are retained for 36 months, which matches the record-keeping expectations that apply to financial services enquiries in South Africa. Aggregate analytics are retained indefinitely in a form that cannot identify you.

Account records are deleted immediately on request. Where a record must be retained for a legal obligation, we restrict it from all further processing instead of deleting it, and tell you which record and why.

Your rights under POPIA

You have the right to ask what we hold about you, to correct it, to object to processing, to withdraw consent, to have it deleted, and to complain to the Information Regulator of South Africa.

The fastest route is self-service: sign in and use the delete-my-data control on your account page. It removes your enquiry records and account in one step, with no email exchange required.

• Access or correction: email privacy@medicalinsurance.co.za and we respond within 30 days.
• Deletion: use the delete control on your account page, or email us and we do it for you.
• Marketing opt-out: reply STOP to any SMS, or use the unsubscribe link in any email.
• Complaints: the Information Regulator (South Africa) at inforeg@justice.gov.za.

How we protect your information

All traffic to this site is encrypted in transit. Enquiry records sit behind row-level security so that a signed-in person can reach only their own records, and administrative reporting runs on aggregates rather than raw contact data.

If a breach affects your personal information, we notify you and the Information Regulator as soon as reasonably possible after establishing the scope, as POPIA requires.

Changes to this policy

We update this page when our processing changes and revise the date at the top. Material changes to how we share data are announced on the site before they take effect. For how we earn and which relationships are commercial, read our advertiser disclosures.