POPIA Statement
Last updated 21 October 2026 (version 1.0)
1. Purpose
This statement sets out how xlabs (Pty) Ltd ("xlabs", "we") complies with the Protection of Personal Information Act 4 of 2013 (POPIA) in running Clara. It applies to personal information processed through Clara at getclara.co.za and its organisation sub-domains. Read it with the Clara privacy policy.
2. Our role under POPIA
Organisations that use Clara decide what personal information they store in it and why. For that information, the organisation is the responsible party. xlabs is its operator: we process the information only on its instructions, under a written agreement (section 21).
For the accounts of people who sign in to Clara, billing contacts, and our own website, xlabs is the responsible party.
| Information | Responsible party | xlabs role |
|---|---|---|
| Client, policy, claim, order, financial and document records | The organisation | Operator |
| Email, files and calendars from accounts a user connects | The organisation | Operator |
| User accounts, roles, sign-in and audit logs | xlabs, with the organisation | Responsible party |
| Billing and subscription details | xlabs | Responsible party |
3. The eight conditions for lawful processing
| Condition | How Clara meets it |
|---|---|
| Accountability | A named Information Officer oversees compliance. Privacy and security are checked in every release and in a standing security audit. |
| Processing limitation | Information is processed only for the features an organisation turns on. Connected accounts ask for the narrowest access each feature needs and can be disconnected at any time. |
| Purpose specification | Each feature's purpose is documented. Information is kept while the organisation uses Clara, then deleted or returned, unless the law requires longer. |
| Further processing limitation | We do not sell personal information, use it for advertising, or use it to train general-purpose AI models. |
| Information quality | Users correct records in place. Uncertain record matches go to a person for review, never merged automatically. |
| Openness | This statement and the privacy policy say what we process and why. |
| Security safeguards | See section 5. |
| Data subject participation | See section 7. |
4. Personal information we process
- Identity and contact details of users and of organisations' clients: name, email, phone, ID and policy numbers.
- Policy, claim, renewal, medical aid, financial and order records an organisation adds or imports.
- Email, documents and calendar items from accounts a user chooses to connect.
- Technical and security data: sign-in times, audit logs of changes and error logs.
Some records may hold special personal information, such as health information for medical aid or gap cover. The organisation needs a lawful basis for it under sections 26 to 33. Clara protects it with the same access controls, encryption and audit logging, and module and policy-type grants limit who can see it.
5. Security safeguards
Section 19 requires appropriate, reasonable safeguards. In Clara:
- Each organisation's data is held in its own separate database.
- Data is encrypted in transit and at rest. Passwords, API keys and connection secrets sit in an encrypted vault and are never shown again after saving.
- Every module needs an explicit grant. Access is further limited by policy type and record ownership.
- Every change to key records is written to an audit log, whatever made the change.
- Client-facing sends, payments and accounting writes run only after a named person approves them.
- The client portal is isolated from staff systems and shows each client only their own information.
- Security testing is ongoing, and findings are tracked until resolved.
6. Operators, AI services and cross-border transfers
We use service providers under written agreements that require them to protect personal information and use it only on our instructions:
- Hosting and databases: Vercel and Supabase, currently in the European Union.
- AI service providers, which receive only the content needed for a result and may not use it to train their models.
- Email delivery, and the integrations an organisation turns on: its accounting system, Google, Slack or WhatsApp.
Information leaves South Africa only under section 72: to recipients bound by law or binding agreements that give protection substantially similar to POPIA.
7. Data subject rights
People can ask to see, correct or delete their personal information, or object to its processing (sections 11(3) and 23 to 25). Clients of an organisation that uses Clara should contact that organisation first, as it controls their information; we help it respond. Requests to xlabs go to miles@xlabs.co.za. Anyone may also complain to the Information Regulator at inforegulator.org.za.
8. Direct marketing
Clara's campaign tools record consent and opt-outs, include an opt-out in every message and always honour it (section 69). The organisation remains responsible for having consent, or an existing-customer basis, before contacting anyone.
9. Security compromises
If we have reasonable grounds to believe personal information was accessed or acquired without authority, we tell the affected organisation without undue delay and help it notify the Information Regulator and the people affected (section 22). Where xlabs is the responsible party, we notify them directly.
10. Information Officer
Information Officer, xlabs (Pty) Ltd: Miles Marshall, CEO, miles@xlabs.co.za.
Information Regulator (South Africa): inforegulator.org.za
11. Review
We review this statement at least once a year, and whenever Clara's processing changes materially. The version and effective date above identify the current version.
| Version | Date | Change |
|---|---|---|
| 1.0 | 21 October 2026 | First issue. |