Privacy Policy

1. Who we are

Certiva (Pty) Ltd (Registration No. 2026/338141/07) is the responsible party for personal information processed through certiva.co.za. We are domiciled in Cape Town, South Africa. Contact: hellocertiva@gmail.com

2. Information we collect

We collect the following personal information when you register and use Certiva:

• Full name
• Email address
• HPCSA registration number (optional; used to submit your CPD points to your HPCSA profile and print on your certificates)
• Payment information (processed by PayFast — we do not store card details)
• Course completion records and assessment scores
• Exam preparation data (FCPsych Part 1, FCS Part 1, FCP Part 1, Dip PEC, FCPaeds Part 1, FCOG Part 1, FCA Part 1 and Dip HIV Man): practice and mock exam sessions, your answers, scores, topic performance and starting-check results
• Usage data (pages visited, time spent on platform), collected via Google Analytics and the Meta Pixel
• CVs and cover letters you make with the CV maker, and anything you choose to put in them, including details of other people such as your referees
• Your choice about marketing emails, with the date and the wording you agreed to, and a record of which Certiva emails we have sent you (so nothing is sent twice)
• Group passes: the codes you buy and, when a colleague uses one, which account redeemed it and when
• Referrals: who referred whom through a referral link, and the extra days given
• Feedback, reviews and exam waitlist sign-ups you send us, including the name you choose to show if you allow a review to be published

3. Why we collect it

We process your personal information for the following purposes:

• To create and manage your account
• To process payments for Exam Passes, upgrades, extra months, monthly membership, group passes and the CPD bundle
• To generate CPD certificates of completion and submit your CPD points to your HPCSA profile
• To record and display your CPD progress
• To communicate with you about your account, payments, CPD certificates, your progress (a weekly email you can stop with one link) and the end of your access
• To send you study tips, exam dates and Certiva offers by email, only if you have opted in. Every marketing email has an unsubscribe link, and you can change your choice on your Account page at any time
• To save your CVs and cover letters so you can edit and download them on any device
• To provide personalised exam preparation analytics, weakness tracking and your study plan
• To run group passes and referrals, and to read and reply to feedback, reviews and waitlist sign-ups
• To comply with our obligations to accreditation bodies

4. Legal basis for processing

We process your personal information on the following grounds under POPIA:

• Performance of a contract (your Exam Pass, membership or other purchase, and your account)
• Legitimate interests (platform improvement and security)
• Compliance with legal obligations
• Your consent, for marketing emails (you can withdraw it at any time)

5. How we store and protect your information

Your account and study data are stored on Supabase (servers in the European Union, Ireland). The website and its server functions run on Netlify, which also keeps a small store of email-sending records, feedback, starting-check results and checkouts you started but did not finish (kept for 14 days, so we can send one reminder if you opted in to marketing emails). Emails are sent through Google (Gmail). We implement appropriate technical and organisational measures to protect your personal information against unauthorised access, loss, or disclosure. Payment data is handled exclusively by PayFast and is not stored on Certiva's systems.

Cross-border transfers. Some of these providers (Supabase, Netlify, Google and Meta) process information outside South Africa. We only use providers bound by laws or agreements that give protection comparable to POPIA (section 72), and by using Certiva you agree to these transfers.

6. Sharing your information

We do not sell your personal information. We may share it with:

• PayFast — for payment processing
• Supabase — for data storage and authentication
• Netlify — for hosting the website and running its server functions
• Google (Gmail) — for sending account, CPD and opted-in marketing emails
• The HPCSA — your name, HPCSA number and the CPD course you passed, to record your CPD point on your HPCSA profile
• Google (Google Analytics) — for usage and traffic analytics. When you are signed in we send your Certiva account ID (a random code, not your name or email), and for completed purchases the payment reference, package and amount
• Meta (Facebook and Instagram) — to measure which of our adverts lead to sign-ups and purchases. When you buy, we send Meta the payment reference, package and amount, your email address and Certiva account ID as one-way scrambled codes (hashes) that Meta can only match to an existing Meta account, and the browser type and IP address you checked out from
• Accreditation bodies (SAMA, UCT) — where required to verify course completions
• The colleague who bought a group pass — they can see whether the code they gave you has been used, and when (not your name or email)
• Law enforcement or regulators — where required by law

7. CVs and cover letters

• Before you create an account, your CV is kept only in your browser on your own device. We never receive it.
• When you import an existing CV, the file is read in your browser. It is never uploaded to us. Only the text you keep in the editor is saved.
• Once you have an account, your CVs and cover letters are saved to your account so you can open them on any device. Only you can see them. We don’t share them with employers or anyone else, we don’t use them for advertising, and we only look at one if you ask us to help with a problem.
• If you delete a CV or cover letter in My CVs, it is deleted straight away.
• Your CV may include information about other people, such as your referees’ names, phone numbers and email addresses. Please ask them before you add it.

8. Your rights under POPIA

You have the right to:

• Access the personal information we hold about you
• Request correction of inaccurate information
• Request deletion of your account and associated data
• Object to processing of your personal information
• Lodge a complaint with the Information Regulator of South Africa

You can do the first of these yourself: on your Account page, under Your data, choose Download my data for a copy of everything your account holds. You can correct your name and HPCSA number on the same page. To delete your account, or to correct or object to anything else, use the buttons under Your data. We reply to your account’s email address to confirm before we delete anything, so nobody else can delete your account.

To exercise any of these rights, contact our Information Officer (the director of Certiva (Pty) Ltd) at hellocertiva@gmail.com. You can also contact the Information Regulator at inforegulator.org.za. Our PAIA and POPIA manual explains how to request records.

9. Retention

We keep your personal information while your account is open. When you ask us to delete your account, we delete your profile, practice and mock exam answers, CVs and cover letters, and email choices after confirming the request with you, and we close your login. Some records are kept for longer:

• Payment records: five years, because tax law requires it.
• CPD completions: up to five years, so your CPD points can be verified.
• Your marketing email choice and unsubscribe record: kept as proof of your choice, so we never email you marketing by mistake.

Copies in our providers’ routine backups are removed as those backups expire.

10. Cookies and local storage

Certiva uses functional cookies necessary for authentication and session management, analytics cookies set by Google Analytics to understand how the platform is used, and the Meta Pixel to measure our adverts on Facebook and Instagram. We do not sell your data to advertisers. You can block these cookies in your browser settings, and you can control how Meta uses this information in your Facebook or Instagram ad settings.

We also use your browser's local storage on your own device: to remember your progress through the free practice questions before you create an account, your chosen exam, your study-plan ticks, a CV you start before creating an account, a referral code you arrived with (for 30 days), and a random device code recorded with your log-ins for security. This information stays on your device unless it is needed for something you do (for example, a referral code is sent with your payment).

11. Exam preparation content disclaimer

The exam preparation content on Certiva — including all practice questions, mock exams, and performance analytics — is independent self-assessment material produced by Certiva. It is not affiliated with, endorsed by, or accredited by the Colleges of Medicine of South Africa (CMSA), the Health Professions Council of South Africa (HPCSA), or any other examining or professional body. All questions are original content written in a style consistent with CMSA past papers and are intended for self-assessment purposes only. Certiva makes no representations as to the accuracy, completeness, or fitness of this content for any particular purpose, including examination success.

12. Changes to this policy

We may update this policy from time to time. We will notify you of material changes via email. Continued use of the platform constitutes acceptance of the revised policy.