Legal

Privacy Policy

Last updated: 24 October 2026  ·  AuraBIOLABS (Pty) Ltd  ·  Cape Town, South Africa

AuraBIOLABS (Pty) Ltd ("AuraBIOLABS", "we", "us", or "our") is committed to protecting your privacy in accordance with the Protection of Personal Information Act, 2013 (POPIA) and, where applicable, the General Data Protection Regulation (GDPR). This Privacy Policy explains how we collect, use, store, disclose and protect your personal information when you use our website, products or services.

1. Who We Are

AuraBIOLABS is a biosciences company based in Cape Town, South Africa. We manufacture and distribute pharmaceutical-grade bacteriostatic water and related products through direct-to-consumer (D2C) and business-to-business (B2B) channels. All manufacturing is conducted at a GMP- and ISO-certified facility in South Africa.

For the purposes of data protection legislation, AuraBIOLABS is the Responsible Party (under POPIA) and Data Controller (under GDPR) in respect of your personal information.

2. Information We Collect

2.1 Information You Provide Directly

  • Account registration: first name, last name, email address, password (hashed), phone number.
  • Orders: delivery address, payment reference, product quantities.
  • B2B supply applications: business name, business type, contact name and role, email, phone, city, province, vial size preference, estimated monthly volume, intended use case.
  • Communications: any messages, queries or feedback you send to us.

2.2 Information Collected Automatically

  • IP address, browser type and version, operating system.
  • Pages visited, time spent on pages, referring URLs, and device identifiers.
  • Firebase Analytics events (page views, conversion events) via Google Analytics 4 (measurement ID G-2WQV0GHJVC).

2.3 Sensitive Information

We do not intentionally collect sensitive personal information (as defined under POPIA) such as health information, biometric data or financial account details. Payment processing is handled by third-party providers and we do not store full card numbers on our systems.

3. How We Use Your Information

  • To process and fulfil orders and supply applications.
  • To create and manage your account on our platform.
  • To communicate with you about your orders, applications and account.
  • To send service notifications relevant to your account (order status, application decisions).
  • To comply with legal, regulatory and compliance obligations, including record-keeping requirements applicable to pharmaceutical-adjacent products.
  • To improve our website, products and services using aggregated analytics data.
  • To detect and prevent fraud, misuse or unlawful activity.
  • To manage our CRM and customer relationship workflows using Revarc (Avolvia).

4. Legal Basis for Processing

We process your personal information on the following legal bases:

  • Contract performance: processing necessary to fulfil your order or supply agreement.
  • Legitimate interests: fraud prevention, security, improving our services, and business operations where these interests are not overridden by your rights.
  • Legal obligation: compliance with applicable South African law, including but not limited to the South African Medicines and Related Substances Act and associated regulations.
  • Consent: where we have obtained your explicit consent, for example for marketing communications.

5. Sharing Your Information

We do not sell your personal information. We share information only as follows:

  • Service providers: Firebase (Google) for authentication, database and hosting; Revarc (Avolvia) for CRM; The Courier Guy for delivery logistics. Each is bound by data processing agreements consistent with POPIA.
  • Regulatory authorities: where required to do so by law or lawful order.
  • Business transfer: in the event of a merger, acquisition or sale of assets, your data may transfer to the acquiring entity, subject to equivalent privacy protections.

6. Data Retention

We retain personal information for as long as necessary to fulfil the purposes described in this policy, or as required by law. Order and supply records are retained for a minimum of five (5) years for compliance purposes. Account data is retained for the duration of your account relationship and for a reasonable period thereafter unless you request deletion.

7. Your Rights

Under POPIA (and GDPR where applicable), you have the right to:

  • Access the personal information we hold about you.
  • Request correction of inaccurate personal information.
  • Request deletion or restriction of processing, subject to legal obligations.
  • Object to processing based on legitimate interests.
  • Data portability (GDPR): receive your data in a structured, machine-readable format.
  • Lodge a complaint with the Information Regulator of South Africa (inforegulator.org.za).

To exercise any of these rights, contact us at privacy@aurabiolabs.co.za.

8. Cookies and Analytics

We use Firebase Analytics (Google Analytics 4) to understand how visitors interact with our website. This involves the placement of cookies or similar tracking technologies. Analytics data is processed in aggregate and used only to improve our service. You may disable analytics tracking through your browser settings or by using a privacy browser extension. We do not use third-party advertising cookies.

9. International Transfers

Firebase services are operated by Google LLC, which may process data in multiple jurisdictions. Google participates in and complies with applicable data transfer frameworks. By using our services, you acknowledge that your data may be processed outside the Republic of South Africa in accordance with these frameworks.

10. Security

We implement industry-standard security measures including HTTPS encryption, Firebase Authentication with secure token handling, and Firestore security rules restricting data access. No system is entirely secure and we cannot guarantee absolute security of data transmitted over the internet. We will notify affected individuals and relevant authorities in the event of a data breach as required by POPIA.

11. Children's Privacy

Our products and services are not directed at persons under 18 years of age. We do not knowingly collect personal information from minors. If you believe a minor has provided us with personal information, please contact us immediately.

12. Changes to This Policy

We may update this Privacy Policy from time to time. The "Last updated" date at the top of this page reflects the most recent revision. Continued use of our services after any update constitutes your acceptance of the revised policy. Material changes will be communicated via the email address associated with your account.

13. Contact

Avolvia (Pty) Ltd t/a AuraBIOLABS
Pretoria, South Africa
support@aurabiolabs.co.za