Website Privacy Notice

Version 1.2 · Effective 17 July 2026

This Privacy Notice describes how we handle personal information collected through our marketing website at www.wellnest.gold. It covers website browsing (cookies, analytics and the contact form) and how we measure which of our online adverts led to a booking.

If you book a medical consultation, you will be shown the WellNest Master Patient Agreement in full during the booking flow and asked to accept it there; the version you accept is recorded. The Patient Agreement is the document that governs how we handle your patient information, including health information. Its patient privacy notice (Part F) is published with the Agreement at https://bookings.wellnest.gold/terms-and-conditions.

If you use our on-site services (IV therapy or facility modalities), you sign separate consent forms on site; each contains the privacy terms that apply to that service, including where your information is stored.

This Notice is given in accordance with the Protection of Personal Information Act 4 of 2013 (POPIA).

1. Who is responsible

Well Nest Multidiscipline Practice (Pty) Ltd (trading as WellNest and WellNest Gold), CIPC registration number 2025/508895/07, is the responsible party for personal information processed through the Website.

2. Information we collect through the Website

2.1 Information you give us

• information submitted through our contact form (typically: name, email, phone, message content);
• any other information you choose to provide when corresponding with us.

2.2 Information collected automatically

• IP address;
• device and browser information;
• pages visited, time spent on pages, referral source;
• cookies and similar tracking technologies;
• where you accept advertising cookies, a Google click reference (a click identifier, or gclid) carried from an advert click.

We do not collect health or medical information through this Website. (The advertising-conversion measurement described in section 7A relates to your booking, not to information collected through this Website's forms, and we treat it as sensitive.)

3. Why we collect it

We use Website information to:

• respond to enquiries you submit;
• operate, maintain and improve the Website;
• understand how visitors use the Website (analytics);
• measure which of our online adverts led to a booking (advertising-conversion measurement, described in section 7A);
• where you accept advertising cookies, and if we switch remarketing on in future, show you relevant WellNest adverts on other websites and platforms (remarketing, described in section 7A);
• prevent fraudulent or unauthorised use.

We do not run cold-email or newsletter marketing programmes and we do not send you marketing messages. Our advertising activity is currently limited to measuring which of our online adverts led to a booking. We do not currently run remarketing; where you accept advertising cookies we may, in future, show you relevant WellNest adverts on other websites and platforms (remarketing), as described in section 7A.

4. Lawful basis

We process Website information based on:

• your consent (where you submit information through forms, and where you accept non-essential cookies);
• our legitimate interests in operating and improving the Website (this does not include the advertising-conversion measurement in section 7A);
• compliance with legal obligations.

For advertising-conversion measurement, we rely on your consent for the click-based measurement carried out through our cookie banner. Booking-based measurement for IV therapy and on-site facility bookings currently operates on every completed booking of those services, as described in section 7A; you can object to it and withdraw at any time (see sections 7A and 10). You can use the Website, and you can book, whether or not you accept advertising cookies.

5. Who we share Website information with

• Our email delivery provider– email delivery for messages submitted through the contact form. Hosted in: United States.
• Our website hosting and content-delivery provider– delivery and hosting of the Website. Website assets are cached and served from content-delivery edge locations worldwide, while our underlying website infrastructure and data stores are in the European Union (Ireland). Website assets do not include health information. Hosted in: European Union (Ireland); edge locations worldwide.
• Our website analytics provider– website usage analytics. Hosted in: European Union (the provider's EU contracting entity); some sub-processing in the United States.
• Our advertising-measurement provider (currently Google LLC, United States) – advertising-conversion measurement and, if we switch it on in future, remarketing. Two measurement methods: (1) where you accept advertising cookies, a Google click reference from your advert click may be carried to your booking so we can measure that the advert led to a booking, and the confirmed booking is reported against that click reference together with the booking value, currency and time; (2) for IV therapy and on-site facility bookings, we send an irreversibly hashed (one-way) version of the email address and mobile number from your booking, together with the booking value, currency and time, so our provider can check whether one of our adverts led to the booking. We never send your name, raw email address, raw mobile number or any health information. See section 7A. Hosted in: United States.

We do not sell or trade your Website information.

6. Cross-border transfer

Some of our Website service providers process information outside South Africa:

• Contact-form email. Our email delivery provider processes website contact-form email through systems based in the United States. By submitting a contact form, you specifically and explicitly consent to this transfer in accordance with section 72(1)(b) of POPIA. No health information is transmitted via the contact form.
• Analytics. Our website analytics provider processes Website analytics data primarily in the European Union, with some sub-processing in the United States. Where you accept analytics cookies, you specifically and explicitly consent to this transfer in accordance with section 72(1)(b) of POPIA.
• Advertising measurement. Our advertising-measurement provider, Google LLC (United States), processes advertising-conversion data in the United States. Where you accept advertising cookies, a Google click reference may be carried to your booking, and the conversion report described in section 7A is made against it in the United States. Separately, for IV therapy and on-site facility bookings, an irreversibly hashed version of the email address and mobile number from your booking is uploaded in the United States, for advertising-conversion measurement only. This is a transfer of personal information outside South Africa, to which section 72(1)(b) of POPIA applies. We never transfer your raw email address or mobile number for this purpose.
• Website hosting. Our website hosting and content-delivery provider, through its European Union (Ireland) region, hosts our website infrastructure and stored website assets. Server logs, which may include your IP address, are processed in this region, and website assets are additionally cached and served from content-delivery edge locations worldwide. This involves a transfer of personal information outside South Africa, primarily to the European Union. By using this Website you consent to this transfer in accordance with section 72(1)(b) of POPIA.

US data protection law differs from POPIA. EU data protection law provides a framework that, in our assessment, is comparable to POPIA but not identical to it.

7. Cookies

The Website uses cookies and similar technologies to:

• enable basic Website functionality (essential cookies, set without consent on the basis of strict necessity);
• remember your preferences (where applicable);
• help us understand how visitors use the Website (analytics cookies, set only where you have given consent);
• support our advertising-conversion measurement, including a Google click reference carried to our booking link, and, where you accept them, future remarketing (advertising cookies, set only where you have given consent).

Cookie consent banner.Before we set any non-essential cookies (including analytics and advertising cookies), we display a cookie consent banner asking for your consent. Our banner keeps advertising and analytics storage denied by default, so advertising and analytics tags do not store or read cookies, and no Google click reference is carried to our booking link, until you accept. You can withdraw consent at any time by clearing the consent cookie or using the “Cookie preferences” link in the Website footer. You can also manage cookies through your browser settings. Disabling essential cookies may affect Website functionality.

Manage cookie preferences

7A. Advertising and conversion measurement

We advertise WellNest online. To understand whether our advertising works, we measure which of our adverts led to a booking. We use two methods, depending on how you book. This section explains both.

Click-based measurement (consultation bookings). Where you arrive at our booking site from one of our online adverts and you have accepted advertising cookies on this Website, a Google click reference from that advert may be carried to your booking so we can measure that the advert led to a booking. When the booking is confirmed and paid, we report the conversion to our advertising-measurement provider against that click reference, together with the booking value, currency and time, solely to measure which advert led to a booking. We never send your name, contact details or any health information through this method.

Booking-based measurement (IV therapy and on-site facility bookings). When you book and pay for an IV therapy or on-site facility service, our systems take the email address and mobile number from your booking, convert each into an irreversibly hashed value (a one-way SHA-256 hash), and upload only those hashed values to our advertising-measurement provider once a day, together with the booking value, currency and time. The provider uses the hashed values only to check whether one of our adverts led to the booking; where there is no match to an advert click, no conversion is recorded. We never upload your raw email address or mobile number, and we do not upload any clinical or health information about your booking. You can object to this measurement and ask us to stop and to delete prior uploads at any time (see “Withdrawing” below and section 10).

Hashing does not make this anonymous. A one-way hash cannot be read back into your email or mobile number by us or by our provider. The hashed value is still personal information about you under POPIA, and we treat it as such.

Sensitive by inference. A booking with a healthcare practice can reveal something about your health, so we treat this measurement as involving sensitive information, and we limit it to the hashed values and booking value, currency and time described above.

Withdrawing.For click-based measurement, withdraw at any time through the “Cookie preferences” link in the Website footer or by clearing the consent cookie; after withdrawal, no further click reference is carried from your browser. For booking-based measurement, contact our Information Officer at hello@wellnest.gold; we add your hashed identifier to a suppression list and make no further uploads for your bookings, and on request we instruct our provider to delete prior uploads. See section 10.

Our provider's role.Our advertising-measurement provider, Google LLC, in the United States, processes the click reference, the hashed values and the conversion reports as our operator, for advertising-conversion measurement only, and is not permitted to use them for its own purposes under this arrangement. It acts only as our operator for this purpose. If we later switch on remarketing, ad personalisation or a customer-matching feature, our provider's role changes and we will update this Notice, and where required ask for your consent again, before we do so.

Cross-border transfer. This processing involves a transfer of personal information to the United States. See section 6.

Retention. See section 8. Your choices and rights. See section 10.

Remarketing.We do not currently run remarketing. Where you accept advertising cookies, we may in future show you relevant WellNest adverts on other websites and platforms you visit after you have been to this Website. We will update this Notice before switching remarketing on. You can switch it off at any time by withdrawing your cookie consent through the “Cookie preferences” link in the Website footer, or by clearing the consent cookie.

8. How long we keep Website information

• Contact form submissions: retained for the duration needed to address your enquiry, plus a reasonable period for record-keeping (usually no longer than 12 months unless you become a patient);
• Website analytics: aggregated and retained for as long as necessary for analytical purposes (typically no longer than 26 months, in line with common analytics default retention);
• Server logs: retained for security and operational purposes (typically no longer than 90 days);
• Advertising-conversion data:the Google click reference carried to a booking is retained for about 90 days; thereafter our provider's retention terms apply to conversion reports. Any copy we hold of the irreversibly hashed booking contact details is kept only as long as needed to complete the upload and the relevant measurement (we delete it after upload, or after the attribution window, whichever is later); once the hashed values are with our provider, their retention is governed by their terms. Our record of which bookings were reported is kept with the related booking records.

9. How we protect Website information

We apply appropriate technical and organisational measures, including encrypted transmission (HTTPS), access controls, and regular monitoring.

No website is completely secure. If we become aware of a security compromise that affects your personal information, we will notify the Information Regulator within 72 hours of becoming aware, and we will notify you as soon as reasonably possible thereafter, in accordance with section 22 of POPIA.

10. Your rights under POPIA

You have the right to:

• be informed of how your personal information is used;
• access your personal information;
• request correction of inaccurate information;
• object to processing in certain circumstances;
• withdraw consent (where consent is the basis for processing);
• request deletion where legally permissible;
• lodge a complaint with the Information Regulator.

How your rights apply to advertising-conversion data. For click-based measurement, the click reference is stored with your booking record, so we can identify whether a conversion was reported for your booking; you can ask us to confirm this, object to this processing or withdraw your consent, in which case no further conversions are reported for your bookings, and ask us to retract a conversion report already sent, in which case we instruct our provider to retract it. For booking-based measurement, although we upload only irreversibly hashed values, we still hold the source email and mobile number in our booking systems, so we can recompute the hash to locate your record; you can ask us to confirm whether your hashed identifier was uploaded, object to this processing, in which case we add your hashed identifier to a suppression list and make no further uploads, and ask us to delete prior uploads, in which case we instruct our provider to delete them.

To exercise any of these rights, contact our Information Officer at hello@wellnest.gold.

11. Children

This Website is a general information site and may be viewed by anyone, including people under 18 and the parents or guardians of patients under 18. We do not knowingly collect personal information from a child (a person under 18) through this Website, including through the contact form, without the consent of a parent or legal guardian.

Where a patient under 18 receives WellNest services, their personal information is collected and handled under the WellNest Master Patient Agreement and the applicable service consent forms, with parental or legal guardian consent and the additional safeguards required by section 35 of POPIA.

If you believe a child has submitted personal information through this Website, please contact us at hello@wellnest.gold and we will remove it unless the law requires us to keep it.

12. Changes to this Notice

We may update this Privacy Notice from time to time. The current version is always available on the Website.

13. Contact

• Well Nest Multidiscipline Practice (Pty) Ltd
• Email: hello@wellnest.gold
• Website: www.wellnest.gold
• Phone: +27 66 538 4856

For privacy queries or to exercise your POPIA rights: hello@wellnest.gold.