Privacy Policy

Ovalleaf (“we”, “us”) is committed to protecting personal information in accordance with the Protection of Personal Information Act, 2013 (POPIA). This policy explains what we collect through the ovalleaf.com website and the Ovalleaf Claims Intelligence & Management Platform (the “Service”), why we collect it, and the choices you have.

Where our customers use the platform to process claims data about their own policyholders and claimants, the customer is the responsible party and we act as their operator under POPIA — we process that information only on the customer’s instructions.

• Account information: name, business email address, organisation name, role and department when you register or are invited to the platform.
• Customer Data: claims records, supporting documents and related case information submitted by our customers to the platform.
• Contact enquiries: details you submit through our contact or demo request forms.
• Billing information: subscription and transaction records. Card details are collected and processed directly by our payment provider, Paystack — we do not store card numbers.
• Usage and technical data: log data, device and browser information, and analytics events (see Cookies below).

• to provide, secure and support the Service, including authentication and tenant-level data isolation;
• to process subscriptions and payments;
• to respond to enquiries and provide onboarding and support;
• to maintain audit trails required by our customers for compliance purposes;
• to monitor, troubleshoot and improve the Service; and
• to comply with legal obligations.

We do not sell personal information.

We share personal information only with service providers that help us run the Service, under contracts that protect it:

• Amazon Web Services — cloud hosting and storage;
• Paystack — payment processing;
• Email and analytics providers — transactional email delivery and website analytics.

We may also disclose information where required by law or to protect our rights, our customers or the public.

Some of our infrastructure and providers are located outside South Africa (including AWS regions in Europe). Where personal information is transferred across borders, we do so in accordance with section 72 of POPIA, using providers that are subject to laws or binding agreements providing an adequate level of protection.

We apply technical and organisational measures appropriate to a claims platform, including encryption in transit and at rest, role-based access control, tenant-level data isolation, audit logging and continuous monitoring. No system is perfectly secure; we will notify affected parties and the Information Regulator of any data breach as required by POPIA.

We keep personal information only as long as needed for the purposes above, for the duration of your subscription, and for periods required by law. When a subscription ends, Customer Data is available for export for 30 days and then deleted from production systems, subject to legal retention requirements.

Under POPIA you may:

• request access to the personal information we hold about you;
• request correction or deletion of inaccurate or unlawfully held information;
• object to processing, including for direct marketing; and
• lodge a complaint with the Information Regulator of South Africa (inforeg.org.za).

To exercise these rights, contact us via the contact page or WhatsApp at +27 67 222 0162. If your information is processed on behalf of one of our customers, we may refer your request to them as the responsible party.

Our website uses cookies and similar technologies for essential functionality and analytics (Google Analytics / Tag Manager) to understand how the site is used. You can control cookies through your browser settings; disabling them may affect some site features.

We may update this policy from time to time; the “last updated” date above reflects the current version, and material changes will be notified via the Service or email. Questions about this policy can be sent via the contact page.