PROTECTION OF PERSONAL INFORMATION (POPI) PRIVACY DISCLAIMER: Medipost Holdings refers to a Group of Companies consisting of: HH Dürrheim (Pty) Ltd t/a Medipost Pharmacy; Medilogistics (Pty) Ltd; Kawari Wholesalers (Pty) Ltd; Medi Training Academy (Pty) Ltd. Medipost Holdings (Medipost) respects the privacy of everyone who visits this website and would like to welcome you to its website. We recommend you read this Protection of Personal Information (POPI) disclaimer so that you understand our approach towards the use of your personal information. By using this website, you acknowledge that you have read and accept the following Protection of Personal Information (POPI) disclaimer. This notice explains how we obtain, use and disclose your personal information, as is required by the Protection of Personal Information Act, Act 4 of 2013 (POPI Act). At Medipost we are committed to protecting your privacy and to ensure that your personal information is lawfully collected and processed. Medipost shall take all reasonable measures to protect the personal information of data subject(s) and for the purpose of this disclaimer “personal information” and “special personal information” shall be defined as detailed in the Promotion of Access to Information Act, Act 2 of 2000 (“PAIA”) and the Protection of Personal Information Act, Act 4 of 2013 (“POPI”). Definition of Personal Information According to the POPI Act “personal information” refers to information relating to an identifiable, living natural person, and where applicable, an identifiable, existing juristic person for example, your name, age, gender, identity number and your email address. The PAIA and POPI Acts are available online at www.gov.za/documents/acts. If you do not agree with these terms, you may choose not to use our website, and you are requested not to provide any personal information through this website. The Collection of Personal Information We collect and process your personal information to provide you with access to our services and products. The type of personal information we collect, will depend on the purpose for which it is collected and used.

We will use your personal information only for the purposes for which it is collected or agreed with you, for example: Customer Information  To render customer related services and administration of customer accounts;  To carry out our obligations arising from any contracts entered between you and Medipost;  To conduct criminal, credit, reference and other related reference checks;  To authenticate the customer;  To provide the customer with information which Medipost believes may be of interest to the customer, such as information relating to public awareness campaigns and matters of general public interest in which Medipost is involved or has decided to lend its support to;  To contact you regarding products and services, provided you have given consent to do so or you have previously requested a product or service from us and the communication is relevant to that prior request and made within any timeframes established by applicable laws;  Use your personal information to comply with legal and regulatory requirements, or when it is prescribed by law. The Storage of Personal Information All personal information collected by Medipost will be stored as follows:  In terms of its #084 Protection of Personal information Policy; PAIA Manual; and #037 Information Distribution Policy;  In a secure and safe manner according to strict security safeguards to ensure its privacy and confidentiality;  For no longer than is necessary to achieve the purpose for which it was collected unless further retention is required by law or contractual obligation. In order to protect personal information from accidental or malicious destruction, when we delete your personal information from our servers, we may not immediately delete residual copies from our servers or remove information from our backup systems;  Otherwise reasonably required by Medipost for lawful purposes related to its functions and activities;  Retained further with the person’s consent after which the information will be de-identified and disposed of as per Medipost Policy and information destruction practices.

Personal Information Security Medipost is legally obliged to provide adequate protection for the personal information we hold and to stop unauthorised access and use of personal information. We will, on an on-going basis, continue to review our security protocols and related processes to ensure that your personal information is secure. Our security policies and principles cover:  Acceptable usage of personal information;  Access to personal information;  Computer and network security;  Governance and regulatory issues;  Investigating and reacting to security incidents;  Monitoring access and usage of personal information;  Secure communications. When we contract with third parties, we impose appropriate security, privacy and confidentiality obligations on them to ensure that personal information that we remain responsible for, is kept secure. We will ensure that anyone to whom we pass your personal information to agree to treat your information with the same level of protection as we are obliged to. Sharing of Personal Information Any personal information supplied to Medipost will be treated as confidential and Medipost will not disclose your personal information unless legally permitted thereto. No personal information will be transferred to a Third Party without the explicit consent of the data subject unless legally obliged thereto. By providing their personal information, the data subject agrees that Medipost may transfer the personal information to the following people and/or organisations in pursuit of the data processing purposes set out in our Privacy and Protection of Personal Information Policy #084:  To the divisions and entities in the Medipost Group, including directors, employees, contractors, agents, auditors, legal and other professional advisors who are authorised to process your personal information;

To financial and government organisations who may request your personal information from Medipost, in which case the data subject will be notified in advance; the provision of such personal information, including banks, governmental, judicial, regulatory and law enforcement bodies, the South African Revenue Services and the National Credit Regulator;  To persons employed by Medipost to provide services on our behalf and that they adhere to principles similar to Medipost regarding the treatment of personal information;  To any person to whom Medipost cede, delegate, transfer or assign any of our rights or obligations pertaining to products and/or services provided to the person or contracts concluded with the person;  To any person who acts as legal guardian, executor of an estate, curator or in a similar capacity;  To any person or persons who may be permitted by applicable law or that you may consent to, including persons or entities who may request such personal information to evaluate the credit worthiness of the person. Your Rights Regarding your Personal Information A data subject (employee, contractor, supplier and/or customer) has the following rights to his/her personal information collected, processed and stored by Medipost:  Right of access to the personal information collected;  Right to rectify or update your personal information;  The right to object at any time to the processing of the personal information in which event the consequences of the objection will be explained to the data subject;  The right to request Medipost to no longer process the personal information of the data subject should the personal information not be required for further processing or by law. We will take all reasonable steps to confirm your identity before making changes to personal information we may hold about you. We would appreciate it if you would take the necessary steps to keep your personal information accurate and up-to-date by notifying us of any changes we need to aware of. Cookies Policy We use the term “cookies” to refer to cookies and other similar technologies covered by the POPI Act on privacy in electronic communications.

What is a cookie? o Cookies are small data files that you browser places on your computer or device. Cookies help your browser to navigate the website and the cookies themselves cannot collect any information stored on your computer or your files. To protect your privacy, your browser only gives a website access to the cookies it has already sent to you.  Why do we use cookies? o Cookies remember the type of browser you use and which additional browser software you installed. Cookies also remember your preferences, such as language and region, which remain as your default settings when you revisit the site.  How do I reject and delete cookies? o We will not use cookies to collect personal identifiable information about you. However, should you wish to do so, you can choose to reject or block the cookies set by the websites by changing your browser settings – see “Help” function within your browser for further details. Please note most browsers automatically accept cookies so if you do not wish cookies to be used you may need to actively delete or block the cookies. If you reject the use of cookies, you will still be able to visit our website but some functions may not work correctly. General Conditions pertaining to Personal Information The Laws of the Republic of South Africa will govern all terms and conditions of any products and services contained in these pages. Should you request products or services through the Medipost Website you hereby consent and submit to the jurisdiction of the South African courts in regard to all proceedings, actions, applications or the like instituted by each party against the other, and in any way arising from any stated terms and conditions.