Last updated: July 2026
This policy applies to the VaxBook mobile application (iOS and Android) and web application at www.vaxbook.co.za.
VaxBook is a child health tracking application developed and operated in South Africa. We are committed to protecting the privacy of children and their families in accordance with the Protection of Personal Information Act 4 of 2013 (POPIA).
Child's full name, date of birth, ID/passport number, sex and birth details. Vaccination records including dates, lot numbers, injection sites and clinician details. Growth measurements (weight, height, head circumference). Developmental milestones. Parent/guardian name, relationship and contact number. Healthcare provider name, designation and practice details. Email address and account credentials.
We collect this information solely to provide child health tracking services including vaccination records, growth monitoring and appointment management. We do not sell or share your data with third parties for marketing purposes.
All data is stored securely on Supabase servers located in Europe. Data is encrypted in transit and at rest. Access is restricted through Row Level Security — parents can only see their own children's records, and healthcare providers can only see records of patients who have explicitly approved their access.
You (the parent/guardian) have full access to your child's records. A healthcare provider can only access your child's records after you have approved their request within the app. VaxBook staff may access anonymised data for technical support purposes only.
We use the following third-party service providers to operate VaxBook: Supabase (database and authentication, servers in Europe), PayFast (payment processing, South Africa), Expo (push notifications, United States), Vercel (web hosting, United States). Each processor is contractually bound to protect your data.
You have the right to: access all personal information we hold about you and your child, request correction of inaccurate information, request deletion of your account and all associated data, withdraw consent at any time, lodge a complaint with the Information Regulator of South Africa.
As this app handles data relating to minors, we require explicit parental or guardian consent before collecting any child's personal information. By registering a child on VaxBook you confirm you are the parent or legal guardian of that child. In accordance with Section 35 of the Protection of Personal Information Act 4 of 2013 (POPIA), we process children's personal information only with the explicit consent of a parent or legal guardian, and only for the purpose of providing child health tracking services.
We retain your personal data for as long as your account is active. Upon account deletion, certain anonymised records may be retained for legal, regulatory, and audit purposes for a period of up to 7 years in accordance with applicable South African law. Children's health records, including vaccination records and growth data, are retained for a minimum of 6 years following account deletion in accordance with the National Health Act 61 of 2003. You may request full data erasure by contacting us directly. Payment transaction records are retained for 5 years in accordance with South African tax legislation.
In the event of a data breach that poses a risk to your personal information, we will notify you and the Information Regulator of South Africa within 72 hours of becoming aware of the breach. Notification will be sent to the email address associated with your account and will include the nature of the breach, the information affected, and the steps we are taking to address it.
For privacy-related queries contact us at: hello@vaxbook.co.za
Information Officer: VaxBook (Pty) Ltd.