Privacy Policy

Who we are

Maag is a South African gut-health service operated by Maag (Pty) Ltd. We are the responsible party under the Protection of Personal Information Act (POPIA) for the personal information described here. For privacy requests, email privacy@maag.co.za.

Your microbiome data is special personal information

Your microbiome test results say something about your health, so POPIA treats them as special personal information. We process them only with your explicit consent, given when you activate a kit, to provide you with your report and a tailored meal plan — and, in anonymised form, to improve Maag and support research (see below). We do not use your results for advertising and we do not sell them — to anyone, ever.

To be clear about what the test is: we sequence the bacterial DNA in your gut sample. We do not sequence or analyse your own human genome, and the test is not a genetic test of you.

What personal information we collect

• Account data: first name, last name, email address.
• Sample & health data: the gut sample you send us, the microbiome sequencing results derived from it, and the dietary preferences, restrictions, and allergens you tell us.
• Order & delivery data: your delivery address, subscription and box history, and meal selections.
• Payment data: handled by our payment provider (see below).
• Communication data: emails we send you are logged (sender, recipient, subject, status) for up to 2 years.
• Session data: login tokens and timestamps used at login.

Why we process your information

• To sequence your sample and produce your report and meal plan (lawful basis: your explicit consent, plus performance of our contract with you).
• To dispatch your kit, food boxes, and Maag Flora, and to keep you updated (lawful basis: contract performance).
• To maintain security and detect abuse (lawful basis: legitimate interest).

Who we share your data with

We share your data only with the partners needed to deliver the service, each bound by a data processing agreement. We never sell your data or share it for marketing.

We sequence your sample in our own laboratory in Cape Town — your sample and results are never sent to a third-party lab. Your results are analysed, and your recommendations produced, by our own data-science models run in-house — we do not send your data to third-party AI services.

• Couriers. Your name and delivery address are shared with our courier (Aramex) to dispatch kits, return your sample, and deliver food.
• Email. Emails are sent via MailPace (MailPace Ltd, United Kingdom), who process delivery on our behalf.
• Payments. Card payments are processed by PayFast (Pty) Ltd, South Africa, a PCI-DSS compliant provider. Your name, email, and the amount are passed to PayFast's hosted portal to complete the transaction. Maag never sees or stores your card details. See payfast.io.

Research and improving Maag

We may use your results in anonymised, de-identified form — with anything that could identify you removed — to improve the recommendations we make to all Maag members, and as part of scientific and academic research, including published research papers. Anonymised data cannot be traced back to you, and we do not sell your personal information. If you would prefer your data not be used for research even in anonymised form, email privacy@maag.co.za and we will exclude it.

Your sample after testing

Once your sample has been sequenced, the physical sample is destroyed in our lab in line with our accredited disposal procedures. Your sequencing results remain in your Maag account until you delete them or close your account.

How long we keep your data

• Account and microbiome results: until you delete them or close your account.
• Order and payment records: retained for financial record purposes (7 years).
• Email logs: purged after 2 years.
• Login session tokens: expire automatically after 60 days.

Your rights under POPIA

You have the right to:

• Access the personal information we hold about you — email privacy@maag.co.za.
• Correct inaccurate information — update your profile in Account Settings.
• Delete your account, microbiome results, and personal data — available in Account Settings or on request.
• Withdraw consent to processing your microbiome results at any time (this means we can no longer provide your report or a tailored plan).
• Object to processing — email privacy@maag.co.za.
• Lodge a complaint with the Information Regulator of South Africa at inforegulator.org.za.

Security

All data is transmitted over HTTPS. Access to your microbiome results is restricted to you and to the Maag staff who need it to deliver your service. Card payments are handled entirely by PayFast's hosted portal — card details never pass through or are stored on Maag's servers.

Contact

For any privacy-related request, email privacy@maag.co.za.