SteadilyWho is responsible
CostusWorx (Pty) Ltd, 858 Carnoustie Crescent, Copperleaf Golf Estate, Centurion, 0157, is the responsible party for Steadily. Information officer: Bruce Lowe, CostusWorx (Pty) Ltd, bruce@costusworx.co.za, 012 668 1444.
What we collect and why
Your name, email and optional cell number, so you can sign in. The health information you choose to enter: GLP-1 and other medicines, supplements, doses and injection sites, weight and measurements, food, water and fibre, symptoms, glucose readings, blood results and notes. We use it only to run your diary, send the reminders you switch on, and, if you invite them, show it to your doctor. We don't sell it, use it for advertising, or share it with medical aids, employers or insurers.
Health information is special personal information. We process it only with your explicit consent (section 27(1)(a)), which you give when you create your diary and again for each doctor you invite. You can withdraw it at any time by revoking a doctor or deleting your account.
Who can see it
You. A doctor you invite, read-only, until you or they end the link. CostusWorx support only when needed to fix a fault you report. Every doctor view is recorded in an access log you can see under Me. Steadily is hosted in South Africa on WebNest's cPanel hosting, which acts as our operator under a written agreement (section 21).
Phone alerts
If you turn on alerts, your browser gives us a push address for that device. Alerts go through your phone maker's push service (Google, Apple or Mozilla) encrypted end to end, so the push service can't read them. Alerts never include readings or notes, and discreet mode leaves out medicine names too. Turn alerts off at any time under Me.
Scanning medicine labels
If you scan a pharmacy label, box or script, or pick the PDF of an e-script, the photo or PDF is read on your own phone. It isn't uploaded, sent to anyone else or stored. Only the details you check and save are added to your diary.
How we protect it
HTTPS only. Passwords are hashed, never stored. Your notes and your doctor's notes are encrypted in the database. Sign-ins are rate limited and sessions end after 30 minutes of inactivity. Emails never contain health information.
How long we keep it
Until you delete your account, which removes your diary, doctor links, alerts and notes straight away. A minimal access log (dates, actions and account numbers, no health data) is kept for 5 years, then deleted.
Your rights
You can see and download everything we hold about you (Me → Your data), correct it in the app, delete it, and object to processing. If you're unhappy with how we handle your information, contact the information officer first. You can also complain to the Information Regulator at inforegulator.org.za.
Medical disclaimer
Steadily is a record-keeping tool. The medicine-level chart is an estimate from published half-life data, not a blood test. Food and supplement guidance is general, drawn from published nutrition advice for people on GLP-1 medicines. It doesn't replace advice from your doctor, dietitian or pharmacist.