Privacy policy

Last updated: 13 June 2026

This Privacy Policy explains how Slumbr Sleep Clinic ("Slumbr", "we", "us", "our") collects, uses, shares and protects your personal information when you use our website slumbrsleep.co.za, complete the Slumbr Sleep Pattern Assessment™ or a pre-consultation intake form, book or attend an online consultation, or purchase a product (together, the "Services"). We are committed to processing your personal information lawfully and in accordance with the Protection of Personal Information Act, 2013 (POPIA).

For the purposes of POPIA, Slumbr Sleep Clinic is the responsible party. Our Information Officer can be contacted at info@slumbrsleep.co.za.

1. The personal information we collect

Depending on how you use the Services, we may collect:

  • Contact and identity details — name, date of birth, identity or passport number, email address, mobile number, postal/physical address and emergency-contact details.
  • Account and transaction details — orders placed, products purchased, consultations booked, and payment-confirmation details. Card and banking details are processed directly by our payment provider and are not stored by us.
  • Special personal information (health information) — your answers to the Slumbr Sleep Pattern Assessment™, your pre-consultation intake form (including validated screening instruments such as the ISI, STOP-BANG, PHQ-9 and GAD-7), your medical, medication, allergy and substance history, and the clinical records created during and after your consultation.
  • Technical information — device, browser, IP address and usage information collected through cookies and similar technologies (see section 11).

Health information is "special personal information" under section 26 of POPIA and is given heightened protection. We collect it only with your explicit consent, and we process it for the legitimate medical purposes set out below by, or under the responsibility of, a health professional who is subject to an obligation of confidentiality (section 27(1)(a) of POPIA).

2. How we collect your information

We collect information directly from you when you use the assessment, complete an intake form, make a booking or purchase, or communicate with us; and automatically through your device when you use the website. We do not buy personal information about you from third parties.

3. Why we process your information

  • To provide the Services — to match you to a sleep pattern, prepare for and conduct your consultation, create and maintain your clinical record, and fulfil your orders.
  • To enable your treating physician to review your assessment and intake answers and form a working clinical impression before your consultation.
  • To process payments, send confirmations, calendar invitations and appointment links, and provide customer support.
  • To comply with legal, regulatory and professional obligations (including HPCSA record-keeping and POPIA).
  • To secure the Services and prevent fraud.

We will only send you marketing communications if you have asked us to, and you can opt out at any time. We do not sell your personal information.

4. AI-assisted clinical decision support

To help your physician prepare, we may use an artificial-intelligence service to generate a preliminary, draft clinical summary from your assessment and intake answers. This draft is for your physician's review only — it is never a diagnosis, a prescription, or an automated decision about your care, and your physician reviews and signs off on any clinical decision. Before your information is sent to this service it is de-identified: your name, identity number and contact details are removed, and only the clinical content is processed. The output is re-associated with your record on our own systems.

5. Who we share your information with

We share personal information only as necessary to provide the Services, and only with parties who are bound to protect it. These "operators" (processors) act on our instructions under written agreements:

  • Your treating physician and authorised clinical staff (HPCSA-registered, bound by confidentiality).
  • Hosting and database providers that store our records securely.
  • The de-identified AI decision-support provider described in section 4.
  • Our e-commerce platform (Shopify) and our payment provider, to operate the store and process payments.
  • Email, calendar and communication providers used to send confirmations and documents.
  • Authorities or advisers where required or permitted by law.

6. Cross-border transfers

Some of our service providers store or process information on servers located outside South Africa. Where this happens, we transfer your information in accordance with section 72 of POPIA — only where the recipient is subject to laws, binding rules or agreements that provide an adequate level of protection comparable to POPIA, or where you have consented.

7. How we protect your information

We apply appropriate, reasonable technical and organisational safeguards, including encryption of health information in transit and at rest, access controls limiting clinical records to authorised staff, and a practice of never writing health information to system logs. No method of transmission or storage is perfectly secure; we will notify you and the Information Regulator of a compromise of your personal information as required by section 22 of POPIA.

8. How long we keep your information

We keep clinical records for at least the minimum period required by the Health Professions Council of South Africa (HPCSA) — generally six years from the date of the last entry (longer for records of minors and in certain other cases). Other information is kept only for as long as necessary for the purpose for which it was collected or as required by law, after which it is securely deleted or de-identified.

9. Your rights

Subject to applicable law, you have the right to:

  • request access to the personal information we hold about you;
  • request correction or deletion of personal information that is inaccurate, irrelevant, excessive, out of date or unlawfully obtained;
  • object to the processing of your personal information on reasonable grounds;
  • withdraw your consent (this does not affect processing already carried out, and may mean we can no longer provide certain Services);
  • lodge a complaint with the Information Regulator.

To exercise any of these rights, contact our Information Officer at info@slumbrsleep.co.za. We may need to verify your identity before acting on a request.

10. Children

The Services are intended for adults aged 18 and over. We do not knowingly collect personal information from children. If you believe a child has provided us with personal information, please contact us so we can delete it.

11. Cookies

Our website uses cookies and similar technologies to operate the store, remember your preferences, and understand how the site is used. You can control cookies through your browser settings; disabling some cookies may affect how the site works.

12. Contact us and the Information Regulator

For any privacy question or to exercise your rights, contact:

Slumbr Sleep Clinic — Information Officer
Email: info@slumbrsleep.co.za
Website: slumbrsleep.co.za

You also have the right to complain to:

The Information Regulator (South Africa)
JD House, 27 Stiemens Street, Braamfontein, Johannesburg, 2001
Email: POPIAComplaints@inforegulator.org.za / enquiries@inforegulator.org.za

13. Changes to this policy

We may update this Privacy Policy from time to time. We will post the revised version on this page and update the "Last updated" date. Material changes will be communicated where required by law.