Version 1.1 · Version 1.0 drafted 22 September 2026, revised 25 September 2026, approved and effective 1 October 2026. Version 1.1 revises §5 and §9 (marketing email and the unsubscribe list) and adds the free CE readiness check to §§2, 3 and 5; approved TBC October 2026 and effective TBC October 2026.

Privacy Notice

This notice explains how ISO-13485 Compliance OS (“the Platform”, “we”, “us”) collects, uses, discloses and protects personal information in terms of the Protection of Personal Information Act 4 of 2013 (“POPIA”). It applies to visitors to our public site, prospects who use the free Gap Heatmap or the free CE readiness check, and customers who use the Platform to run their ISO 13485 quality management system.

1. Who we are — the responsible party

The Platform is operated by COMPLYOS (Pty) Ltd, registration number 2026/365192/07, of 17 Orbea Close, Kronenzicht, Cape Town, 7806. Our Information Officer is Duane Webber. For any privacy question or request, email info@bathopelegroup.com.

For most personal information described below, we act as the responsible party. Where a customer organisation uploads its own operational data into the Platform — for example, employee names in a training record, or a supplier contact in a document — we act as an operator processing that data on the customer’s instructions; the customer organisation is the responsible party for that content, and data-subject requests about it should go to them first.

2. What personal information we collect

We only collect what each feature needs to function:

• Gap Heatmap (funnel) leads — email address, name, company name, establishment type, your own consultant quote (if you give one), your ISO 13485 self-assessment answers and the findings we generate from them, and the marketing opt-in decision and the version of the wording you agreed to. Collected because it is the input needed to produce your own readiness score and, only where you opt in, to follow up with compliance guidance.
• CE readiness check leads — only if you ask us to email you your report: email address, and optionally name and company, your device’s indicative EU class, your yes / in progress / no answers and the open items we derive from them, and the marketing opt-in decision and wording version. If you do not ask for the email, the check runs in your browser and nothing you enter reaches us.
• Account and organisation data — your name and email on registration, your organisation’s details, role/permissions within your organisation, and billing contact details. Collected to create and secure your account and to deliver the service you subscribed to.
• Evidence and QMS content you upload — controlled documents, SOPs, licences, certificates, audit findings, CAPAs and similar records your organisation stores in the Platform. This may include personal information about your own staff (e.g. a document owner’s name) that you choose to include. We process this as an operator on your instructions (see §1).
• Usage and support data — support correspondence you send us, and ordinary web/application logs (timestamps, error traces) needed to keep the service running securely.

Providing funnel and account information is voluntary but necessary to receive the corresponding service — without an email address, for example, we cannot deliver your Gap Heatmap result or create your account. Marketing consent is separately voluntary and is never a condition of receiving the service you asked for (see §5).

2.1 Cookies

We use a small number of cookies, all of them strictly necessary to operate the Platform. We do not use advertising cookies, analytics cookies or any cross-site tracking, and we run no third-party analytics or advertising scripts on this site. Because these cookies are required to deliver the service you have asked for, we do not ask for separate consent to them — but you can block or delete them in your browser, in which case you will not be able to sign in.

• Authentication cookies, set by our authentication provider (Supabase), which keep you signed in between page loads and let your session be refreshed securely. They are cleared when you sign out.
• active_org — records which of your organisations you are currently viewing, where you belong to more than one. Your membership of that organisation is re-checked on our servers on every request, so this cookie selects a view; it does not grant access.
• sahpra_view_as — a short-lived cookie set only in the browser of one of our own platform administrators when they open a customer organisation in read-only support view. That view cannot change your data, and every use of it is written to the audit log.

3. Why we process it

• To generate and deliver your Gap Heatmap result or CE readiness report, and any onward compliance guidance you ask for.
• To create, secure and administer your account and organisation, including access control and tenant isolation.
• To provide the subscribed service: document control, readiness tracking, regulatory-obligation tracking, and reporting.
• To run AI-assisted features you or your organisation enable — gap analysis, document classification, SOP drafting assistance, training-quiz generation, and regulatory-feed processing (see §6 on Anthropic).
• To process subscription billing and payments.
• To send direct marketing, only where you have opted in (§5).
• To meet our own legal, audit and security obligations.

4. Lawful basis for processing (POPIA s11)

We process personal information because it is necessary to perform a contract with you (delivering the service you signed up for), because you have consented (marketing, §5), to comply with a legal obligation (e.g. financial record-keeping), or in pursuit of our legitimate interest in operating and securing the Platform, balanced against your rights.

5. Direct marketing (POPIA s69)

Where you are not already a customer, we only send direct marketing if you have given prior, opt-in consent. The consent checkbox on the Gap Heatmap and on the CE readiness check is unticked by default and is never a condition of receiving your result — delivering your own result is the service you asked for, not marketing, and consent conditioned on that service would not be freely given. We record the exact wording version you agreed to, so we can always show what you actually consented to. If you did not tick the box, the email with your result contains your result and nothing else: no invitation to book a call and no offers.

If you are a customer, including on trial access, we may also send you a few emails about getting more from the Platform and about our plans. We rely on POPIA s69(3) for these: they relate to the service you signed up for, and you can opt out when you register and in every one of these emails. Every marketing email we send through the Platform has an unsubscribe link at the bottom. If we write to you personally, reply ‘unsubscribe’ and we will act on it the same way. The link opens a page where you confirm with one button. Many email apps also show their own unsubscribe button, which does the same thing. Once you unsubscribe, we stop all marketing email to that address straight away.

To keep honouring your choice, we keep your email address on an unsubscribe list (see §9). Unsubscribing does not stop the service emails you need to use your account, such as security and sign-in notices, deadline reminders, invitations and payment receipts. Those are not marketing. If you ask us to delete your information, we keep only your email address on the unsubscribe list, so that we do not market to you again by mistake.

You can withdraw consent at any time, free of charge, by using the unsubscribe link in any marketing email or by emailing hello@iso13485-compliance.co.za. Withdrawal does not affect the lawfulness of anything sent before you withdrew.

6. Who we share it with (sub-processors)

We do not sell personal information. We use the following service providers to run the Platform, each acting on our instructions and bound to protect the data they process for us:

If a lead-notification webhook is configured for our own internal use (e.g. a Slack alert), it receives the same lead data described in §2 and is treated as an extension of our own systems, not a separate marketing recipient.

6a. What we promise when we process your organisation’s data for you (POPIA s21)

Where we act as an operator on your instructions — processing evidence documents, training records, supplier contacts or other operational data your organisation uploads into the Platform, as described in §1 — POPIA s21 requires a written security undertaking between us. This section is that undertaking, and it binds us from the moment your organisation first uploads data, including during trial access.

• We process the personal information your organisation uploads only on your instructions — to deliver the features you have enabled (document storage, AI-assisted classification, training records, audit logs) — and not for any other purpose of our own, including training our own models on your content.
• We maintain the technical and organisational security measures described in §10 (tenant-level row-level security, private storage with short-lived signed URLs, encryption in transit, audit logging of state-changing actions) in respect of this data specifically, not only our own systems.
• We treat the content of what you upload as confidential. Our staff and systems do not access it except to provide support you request, investigate a fault, or comply with a legal obligation.
• We do not pass this data to a further operator (a sub-processor) beyond those already named in §6, and if that changes, we will update §6 and, where the change is material, notify account holders before it takes effect.
• If we become aware of a security compromise involving data we hold as your operator, we will notify your organisation’s registered account contact without undue delay, so that you — as the responsible party for that content — can meet your own POPIA s22 notification obligations to the Information Regulator and to the data subjects concerned.
• On cancellation, this data is handled as described in §9 (retention) — kept read-only for a period and then deleted — and you may export it at any time before that.

8. Cross-border transfer (POPIA s72)

Some of the providers above process personal information outside South Africa — notably Supabase (European Union), Netlify (United States), where AI features are enabled, Anthropic (United States), where the Google Drive connector is enabled, Google (United States), and for our encrypted nightly backups, GitHub (United States). Resend, which delivers our transactional email and therefore receives your email address and name, stores that data in the United States: its documented behaviour is that account data, email metadata and delivery logs are held in the United States whatever sending region is selected, so selecting a region closer to you does not keep the data in it. We rely on two bases in s72(1). For personal information about you as a user of the Platform, we rely on s72(1)(c): you are a party to a contract with us, and hosting, serving and supporting your account cannot be performed without these transfers. For all transfers, we rely in addition on s72(1)(a) to the extent that the provider is bound by a data processing agreement incorporating standard contractual clauses that impose conditions substantially similar to POPIA, including on onward transfer. Where a lead has given us marketing consent but is not yet a customer, we rely on that consent under s72(1)(b). We have not made, and do not make, any claim that these transfers are covered by an adequacy finding unless and until that is verified.

9. How long we keep it

We keep personal information only as long as the purpose requires, or as long as a law requires, whichever is longer. Our schedule is:

• Enquiry and lead records — 24 months from your last engagement with us, then deleted. Deleted sooner on request, unless we need the record for the consent evidence below.
• Marketing consent records (including consent you later withdrew) — for the life of the relationship plus three years, as evidence of what you agreed to and when, under POPIA s69. Three years is our own choice of retention, not a fixed statutory period; we use it as a practical analogy to the ordinary prescription period for debt under s11(d) of the Prescription Act 68 of 1969, since that is the longest period a claim about this consent could realistically arise.
• Unsubscribe list — your email address, the date you unsubscribed and how (the email link or your email app’s unsubscribe button). We keep it for as long as we send marketing email, including after we delete your other information, because it is the least we need to honour your objection (POPIA s11(3)(b) and s69).
• Unsubscribe link tokens — for every address we send marketing email to, a random code that makes the unsubscribe link work without putting your address in it. We keep it for as long as we send marketing email.
• Account and user data — for the life of your subscription, then 12 months in read-only form so you can export it or return, then deleted within a further 30 days. Deleted sooner on request.
• Evidence documents and quality records you upload — same 12-month read-only window, then deleted. We are not your regulatory system of record: ISO 13485 and SAHPRA require you to retain your own quality records, and you should export before that window closes.
• Audit logs — three years after your account closes. These record who did what and when, and we need them to answer a dispute or a regulator’s question.
• Billing and invoice records — seven years. Section 24 of the Companies Act 71 of 2008 requires us to keep accounting records for seven years; the Tax Administration Act 28 of 2011 sets a shorter general floor of five years after the relevant tax period (longer if a dispute or audit is open). We keep the longer of the two rather than the shorter, so deleting these earlier is not something we choose to do.

Backups lag live deletion: a record deleted from the live system is removed from rolling backups as those backups age out.

10. How we protect it

• Every tenant-scoped database table is protected by row-level security, so one organisation’s queries cannot reach another’s data.
• Evidence documents are stored privately and never served from a public bucket; access is via short-lived signed URLs (five minutes by default).
• Data is encrypted in transit (HTTPS/TLS) between your browser, the Platform and our sub-processors.
• State-changing actions are written to an audit log.

We do not currently hold any independent security certification (e.g. ISO 27001, SOC 2) and make no claim to one.

11. Your rights as a data subject

Under POPIA you may request access to the personal information we hold about you (s23), request its correction or deletion (s24), and object to processing on reasonable grounds (s11). To exercise any of these rights, email info@bathopelegroup.com. We aim to respond within the 30-day period POPIA allows. If the personal information concerned is content your employer/organisation uploaded about you, we may need to route your request to them first, as they are the responsible party for that content (§1).

12. Automated processing and AI features

Readiness scores and AI-assisted gap analysis are decision-support only. They are not used to make any decision about you with legal or similarly significant effect, and are always intended to be reviewed by a qualified person before anyone relies on them.

13. Complaints

If you believe we have not handled your personal information properly, you may complain to us first at info@bathopelegroup.com, or lodge a complaint with the Information Regulator of South Africa. Its complaints address is POPIAComplaints@inforegulator.org.za; general enquiries: enquiries@inforegulator.org.za or 010 023 5200; Woodmead North Office Park, 54 Maxwell Drive, Woodmead, Johannesburg, 2191 (as published at inforegulator.org.za, checked 13 September 2026).

14. Changes to this notice

We will update the version number and effective date at the top of this page whenever this notice changes materially, and will not apply a materially narrower notice retroactively to data already collected under a broader one.

See also our Terms of Service.