Platform · Legal
GlowFlow Privacy Policy
Version of 9 October 2026
What changed: Section 12 (international processing) updated on the advice of Tate Inc.: it now lists the countries where personal information may be processed and the safeguards GlowFlow relies on.
1. About this Privacy Policy
This Privacy Policy explains how Dr Sophie Ramsaroop (Pty) Ltd, trading as GlowFlow, processes personal information in connection with the GlowFlow platform and GlowFlow's own business activities.
GlowFlow is a software platform used by clinics for bookings, client administration, clinical records, consent forms, photographs, messaging, stock and related functions.
If you are a patient or client of a clinic using GlowFlow, the clinic is ordinarily the responsible party for your personal information. The clinic decides why and how your information is collected and used, and the clinic's own privacy notice applies to that processing.
This Privacy Policy principally describes GlowFlow's own processing and its role as an operator processing clinic information on the clinic's behalf.
2. Our roles under POPIA
GlowFlow acts in two distinct capacities under the Protection of Personal Information Act 4 of 2013 ("POPIA").
2.1 GlowFlow as operator
For personal information belonging to a clinic's patients or clients, including:
- booking information;
- clinical and treatment records;
- consent forms;
- clinical photographs;
- marketing lists; and
- related client information,
the clinic is the responsible party and GlowFlow acts as the clinic's operator.
GlowFlow processes that information on the clinic's behalf and in accordance with the clinic's documented instructions and the applicable Operator Agreement.
GlowFlow does not determine the purposes for which the clinic collects or uses its clients' personal information.
2.2 GlowFlow as responsible party
GlowFlow is separately a responsible party for personal information processed for its own purposes, including:
- clinic owner and staff accounts;
- subscription and billing information;
- support correspondence;
- GlowFlow website visitors;
- information relating to GlowFlow's own suppliers and service providers; and
- records necessary to operate, secure and administer GlowFlow's business.
The rights and responsibilities applicable to these two capacities are therefore not identical.
3. Who we are
Trading name: GlowFlow
Legal entity: Dr Sophie Ramsaroop (Pty) Ltd
Legal form: Private company registered in South Africa, trading as GlowFlow
Registration number: 2021/383189/07
Registered address: 261 Underwood Road, Glen Park, Pinetown, KwaZulu-Natal, 3610
Email: admin@glowflow.online
VAT: GlowFlow is not registered for VAT.
4. Information Officer
GlowFlow has appointed an Information Officer for purposes of POPIA and the Promotion of Access to Information Act 2 of 2000 ("PAIA").
The Information Officer's role contact address is:
Email: admin@glowflow.online
The Information Officer is identified by name in GlowFlow's PAIA Manual.
Each clinic using GlowFlow remains responsible for appointing and identifying its own Information Officer in respect of the personal information for which that clinic is the responsible party.
5. Personal information GlowFlow processes
Depending on your relationship with GlowFlow, we may process:
5.1 Clinic account information
- name;
- email address;
- mobile number;
- role;
- username;
- password hash;
- account status; and
- information required to administer the clinic account.
5.2 Subscription and billing information
- subscription plan;
- invoice information;
- payment status;
- PayFast transaction references; and
- related billing records.
GlowFlow does not receive or store the full card number used by a clinic where payment is processed through the applicable payment provider.
5.3 Support information
Where you contact GlowFlow, we may process:
- your name;
- contact details;
- correspondence;
- support requests;
- technical information relevant to the issue; and
- records necessary to resolve and document the support matter.
5.4 Website and technical information
When you visit GlowFlow's website, we may process:
- IP address;
- browser and device information;
- user-agent information;
- requested pages;
- technical logs; and
- information generated by cookies or similar technologies where applicable.
5.5 Optional analytics and advertising information
Where applicable, GlowFlow may process conversion or analytics information through optional cookies or similar technologies.
Where consent is required for such technologies, they will not be activated until the relevant consent has been obtained.
6. Clinic client information
GlowFlow may process personal information belonging to clinic clients solely as an operator.
That information may include:
- names and contact details;
- dates of birth;
- booking and appointment information;
- treatment information;
- clinical consultation notes;
- treatment history;
- contraindications;
- medication information;
- allergy information;
- pregnancy-related information;
- consent records;
- clinical photographs;
- marketing preferences;
- communications and messaging information; and
- other information that the clinic lawfully chooses to process through the platform.
The clinic is responsible for determining:
- what information it collects;
- the lawful basis for processing it;
- what notices and consents are required;
- how long the information should be retained; and
- whether the information should be disclosed to another person or organisation.
GlowFlow does not independently decide those matters for the clinic.
7. Special personal information
Some information processed through GlowFlow may constitute special personal information under POPIA, including information concerning a person's health or sex life and certain biometric or other categories specified by POPIA.
Clinic client information may include, for example:
- medical history;
- medication;
- allergies;
- pregnancy status;
- treatment history;
- contraindications;
- clinical photographs; and
- other health-related information.
GlowFlow processes such information as an operator where instructed by the relevant clinic.
The clinic remains responsible for ensuring that its processing of special personal information is permitted by POPIA and any other applicable law.
The platform does not itself create a lawful basis for the clinic's processing.
8. Children
GlowFlow may process information relating to clients under 18 where a clinic provides services to minors.
The public booking flow requires a date of birth. Where the booking concerns a person under 18, the booking flow requires the relevant parent or legal guardian's:
- name;
- relationship to the minor;
- contact number; and
- express consent before the booking can be completed.
Marketing consent is disabled for under-18 clients.
The clinic remains responsible for determining whether it may lawfully provide the relevant treatment to a minor and for obtaining any consent required by law.
GlowFlow does not determine whether a treatment is appropriate for a child.
Where clinic staff create records manually or import existing client information, the clinic remains responsible for ensuring that the required age and guardian safeguards have been satisfied.
9. How we use personal information as responsible party
Where GlowFlow acts as responsible party, we use personal information for purposes including:
- creating and administering accounts;
- providing and maintaining the GlowFlow platform;
- processing subscriptions and billing;
- communicating with clinic customers;
- responding to support requests;
- maintaining security;
- detecting and investigating abuse or security incidents;
- maintaining technical records;
- complying with legal and regulatory obligations;
- exercising or defending legal rights;
- improving the platform; and
- other lawful purposes compatible with the purposes for which the information was collected.
We will not use clinic client clinical information for GlowFlow's own advertising or marketing.
10. Direct marketing
GlowFlow may send marketing communications to clinic customers where permitted by POPIA and other applicable law.
Where consent is required, GlowFlow will obtain and record that consent.
Marketing consent is separate from acceptance of the Terms of Use and acknowledgement of this Privacy Policy.
A person may withdraw marketing consent at any time by using the unsubscribe mechanism provided in the relevant communication or by contacting:
Withdrawal of marketing consent does not affect the lawfulness of processing carried out before the withdrawal.
GlowFlow does not intentionally use clinical information or clinical photographs belonging to clinic clients for GlowFlow's own direct marketing.
11. Disclosure and service providers
GlowFlow may use third-party service providers where reasonably necessary to operate the platform.
These providers may provide:
- hosting and database infrastructure;
- file storage;
- email delivery;
- SMS delivery;
- messaging services;
- security and network services;
- payment processing;
- analytics or technical services; and
- other infrastructure required to operate GlowFlow.
Where a third party processes clinic personal information on GlowFlow's behalf, it is treated as a sub-operator and is subject to the applicable contractual and data-protection requirements.
GlowFlow maintains a current Sub-processor Disclosure identifying material sub-processors and relevant processing information.
GlowFlow will not sell clinic client personal information.
12. International processing
GlowFlow's database and file storage are hosted in Ireland, within the European Union. Personal information processed through GlowFlow is not, however, processed only in the European Union. Depending on the service concerned, it may be processed in:
- the European Union, including Ireland and the Netherlands;
- the United Kingdom;
- the United States, for example for email delivery and optional AI features; and
- other countries through the global network of the provider through which the website is served.
SMS delivery and payment processing are currently described by the relevant providers as taking place in South Africa, and no cross-border transfer has been identified for those services.
Where personal information is transferred outside South Africa, GlowFlow relies on the applicable mechanism under section 72 of POPIA, together with appropriate contractual safeguards. These include data-processing agreements with GlowFlow's direct service providers and with its hosting provider (which in turn must impose equivalent obligations on its own sub-processors) and, where applicable, standard contractual clauses.
GlowFlow's Sub-processor Disclosure sets out, provider by provider, what each provider does, where it processes personal information and the safeguards that apply.
If the processing location or transfer mechanism materially changes, GlowFlow will update the applicable documentation and provide notice where required.
13. How GlowFlow protects information
GlowFlow maintains reasonable technical and organisational measures appropriate to the nature of the information processed.
These include, where applicable:
- encryption in transit using TLS;
- encryption at rest as provided by the relevant infrastructure provider;
- row-level access controls;
- role-based access controls;
- private storage for clinical and consent files;
- short-lived signed URLs for access to protected files;
- encrypted storage of payment credentials;
- separation between GlowFlow subscription payments and clinic client payments;
- authentication and account-security controls; and
- security monitoring and incident-response procedures.
GlowFlow does not represent that every individual access to a clinical record or consent form is currently recorded in an audit log.
The platform currently records certain system and operational events, but individual access logging for clinical records is not presently implemented.
We therefore do not describe individual clinical-record access logging as an existing security control.
14. GlowFlow staff access to clinic clinical information
GlowFlow staff do not have ordinary administrator access to clinic client or clinical records.
The platform-administrator role is restricted to clinic-level administrative information such as:
- clinic name;
- subscription plan;
- billing status;
- account status; and
- aggregate operational information.
GlowFlow staff cannot use the platform-administrator role to open or read a clinic's clinical notes, clinical photographs, client list or consent records.
There is currently no general support-access mechanism under which GlowFlow staff can obtain access to clinical content at a clinic's request.
If a support matter requires information that GlowFlow cannot access because of these controls, the relevant clinic must provide the information necessary to resolve the issue through an appropriate and lawful channel.
This limitation is intentional and forms part of GlowFlow's security architecture.
15. Retention of personal information
GlowFlow will not retain personal information for longer than is necessary for the purpose for which it was collected or subsequently processed, unless a longer period is required or authorised by law or otherwise permitted by section 14 of POPIA.
Because GlowFlow acts as an operator for clinic clinical records, the clinic's applicable professional and statutory retention obligations are relevant to the retention of those records.
The following schedule applies to GlowFlow's processing, subject to any longer period required or authorised by law, a lawful instruction from the clinic, a legal hold, audit, investigation or other applicable legal requirement.
| Category | Retention period | Legal / lawful basis |
|---|---|---|
| Clinical / treatment records and consent forms | At least 6 years from the date the record becomes dormant, subject to longer periods applicable to minors, mentally incapacitated patients, litigation, statutory requirements or other HPCSA guidance; records may be retained indefinitely where reasonably appropriate and technically practicable. | POPIA s14; National Health Act s13; HPCSA Guidelines on the Keeping of Patient Health Records; applicable professional obligations |
| Clinical photographs | For as long as they form part of the patient's clinical record, and thereafter in accordance with the applicable clinical-record retention period. Photographs used separately for marketing are retained only while the relevant marketing purpose and lawful basis continue, subject to withdrawal and applicable record-keeping requirements. | POPIA s14; National Health Act; HPCSA record-keeping obligations; consent/lawful processing basis where applicable |
| Booking and appointment history | For the period reasonably necessary for clinic administration, dispute resolution, audit and applicable legal/professional obligations; where forming part of the patient's clinical record, the applicable clinical-record retention period applies. | POPIA s14; contract; lawful business purposes; applicable professional obligations |
| Invoices, payments and PayFast transaction references | At least 5 years where required for tax purposes, and 7 years where required as company records; longer where required by law, audit, investigation or legal proceedings. | Tax Administration Act s29; Companies Act s24; POPIA s14 |
| Marketing contact details and consent records | While the marketing relationship remains active and thereafter for a reasonable period sufficient to demonstrate the lawful basis and management of marketing communications, ordinarily up to 3 years after the last relevant marketing interaction or withdrawal, unless longer retention is required for legal purposes. | POPIA s14; POPIA direct-marketing provisions; proof of consent / legal compliance |
| Email and SMS delivery logs | Up to 24 months after the relevant communication, unless a longer period is reasonably required for security, dispute resolution, legal compliance or proof of consent/communication. | POPIA s14; security and accountability purposes; legal claims |
| Security, access and audit logs | Up to 24 months from creation, unless a longer period is reasonably required for investigation, security incident response, legal proceedings, regulatory requirements or other lawful purposes. | POPIA s14; security obligations; legal and regulatory requirements |
| Closed clinic accounts | Account and contractual records: up to 7 years after closure where required for company, tax, contractual or legal purposes. Clinic client/clinical records are retained or deleted according to the applicable clinical-record retention requirements and the Operator Agreement. | POPIA s14; Companies Act; Tax Administration Act; contract; applicable professional obligations |
The periods above are minimum or ordinary retention periods, not an authorisation to retain information indefinitely. Where the applicable lawful purpose ends and no legal or other lawful retention basis remains, information must be securely deleted, destroyed or de-identified as appropriate.
POPIA section 14 expressly requires records not to be retained longer than necessary, subject to statutory and other lawful exceptions.
For clinical records, the HPCSA guidance provides for at least six years from dormancy, with specific longer-retention circumstances including minors, mentally incapacitated patients and certain occupational-health matters.
For financial and accounting information, applicable statutory retention periods may extend beyond ordinary POPIA purpose-based retention. The Tax Administration Act provides a five-year record-retention period in the circumstances specified by section 29, while the Companies Act generally requires relevant company records to be retained for seven years.
16. Deletion and destruction
When GlowFlow is no longer authorised or required to retain personal information, it will take reasonable steps to:
- securely delete or destroy the information; or
- de-identify it so that it can no longer reasonably be associated with an identifiable person.
Deletion from active systems may be followed by temporary persistence in backup or disaster-recovery systems.
Information in backup systems will be overwritten or deleted in accordance with the applicable backup cycle and will not ordinarily be restored or used except where reasonably necessary for disaster recovery, security, legal compliance or another lawful purpose.
Where GlowFlow acts as operator, deletion of clinic client information will be subject to the clinic's lawful instructions and the Operator Agreement.
17. Security compromises
If GlowFlow becomes aware of a security compromise affecting personal information processed on behalf of a clinic, GlowFlow will notify the affected clinic as soon as reasonably possible after becoming aware of the compromise, having regard to the needs of any law-enforcement or other investigation.
The notification will contain the information reasonably available at the time and will be updated as further information becomes available.
Where clinic client information is affected, the clinic remains the responsible party for determining and making any notification required to the Information Regulator and affected data subjects under section 22 of POPIA.
GlowFlow will provide reasonable technical information and assistance to enable the clinic to assess and respond to the incident.
Suspected security incidents should be reported to:
18. Your rights
Where GlowFlow acts as responsible party, you may have rights under POPIA to:
- request access to personal information;
- request correction or deletion of information that is inaccurate, irrelevant, excessive, out of date or unlawfully processed;
- object to certain processing;
- withdraw consent where processing is based on consent;
- object to direct marketing; and
- lodge a complaint with the Information Regulator.
Requests may be sent to:
Where GlowFlow is acting only as an operator for a clinic, the relevant clinic is ordinarily responsible for responding to the request.
If you send a clinic-data request to GlowFlow, GlowFlow may refer or forward it to the relevant clinic and notify you accordingly.
GlowFlow will not independently disclose or delete clinic client records merely because a request has been sent to GlowFlow where the clinic is the responsible party.
Formal PAIA requests are dealt with in accordance with GlowFlow's PAIA Manual.
19. Access to health records
Where the relevant information forms part of a clinic's patient health record, access is subject to the applicable provisions of POPIA, PAIA, the National Health Act and applicable professional rules.
The clinic remains responsible for determining whether access should be granted and for applying any applicable statutory restrictions or safeguards.
The National Health Act requires health records to be created and maintained and requires appropriate measures to prevent unauthorised access.
20. Cookies and similar technologies
GlowFlow may use cookies and similar technologies for:
- essential website functionality;
- authentication;
- security;
- analytics; and
- optional advertising or conversion measurement.
Where a cookie or similar technology requires consent, GlowFlow will request that consent before activating it.
You can manage cookies through your browser and, where available, GlowFlow's cookie controls.
21. Third-party websites and services
GlowFlow may contain links to third-party websites or services.
GlowFlow is not responsible for the privacy practices of a third party operating a website or service that is outside GlowFlow's control.
Where a third-party provider processes personal information on GlowFlow's behalf, the provider is subject to the applicable contractual and data-protection arrangements.
22. Complaints
You are welcome to raise a privacy concern with GlowFlow first:
You do not, however, have to do so before exercising a right to lodge a complaint with the Information Regulator of South Africa.
Information Regulator
Physical address:
Woodmead North Office Park
54 Maxwell Drive
Woodmead
Johannesburg
2191
Telephone: 010 023 5200
Toll-free: 0800 017 160
POPIA complaints: POPIAComplaints@inforegulator.org.za
General enquiries: enquiries@inforegulator.org.za
The right to complain to the Information Regulator does not affect any other remedy available under applicable law.
23. Changes to this Privacy Policy
We may update this Privacy Policy when our processing activities, technology, legal obligations or security arrangements change.
The version date appears at the beginning of the Policy.
Where a change is material, we will take reasonable steps to notify affected persons or clinic customers where required by law or reasonably appropriate in the circumstances.
24. Contact
For questions concerning this Privacy Policy or GlowFlow's own processing of personal information:
GlowFlow
Dr Sophie Ramsaroop (Pty) Ltd
Registration number: 2021/383189/07
261 Underwood Road
Glen Park, Pinetown
KwaZulu-Natal, 3610
Email: admin@glowflow.online