UQUESTPAIA and POPIA Manual
Manual of UQUEST (Pty) Ltd prepared under section 51 of the Promotion of Access to Information Act 2 of 2000 (PAIA) and the Protection of Personal Information Act 4 of 2013 (POPIA)
Version 1.0 · Compiled 28 October 2026
1. Purpose of this manual
This manual explains what records UQUEST (Pty) Ltd holds, how to ask for access to them, what it costs, and how we process personal information. It is available free of charge.
2. Company and contact details
| Item | Detail |
|---|---|
| Registered name | UQUEST (Pty) Ltd |
| Trading name | Uquest |
| Registration number | 2026/788036/07 |
| Street and postal address | 62B Justice Mahomed, Pretoria, 0181, South Africa |
| Head of the private body | Kelton Mdakane, Director |
| Information Officer | Kelton Mdakane |
| Deputy Information Officer | None appointed |
| support@uquest.app | |
| Telephone | +27 61 491 5879 |
| Website | https://uquest.app |
3. The Regulator's guide to PAIA
The Information Regulator publishes a guide on how to use PAIA and POPIA, in each official language. It explains your rights and how to make requests. You can get it from the Regulator:
- Website: inforegulator.org.za
- Email: enquiries@inforegulator.org.za
- Telephone: 010 023 5200
- Address: Woodmead North Office Park, 54 Maxwell Drive, Woodmead, Johannesburg, 2191
4. Records available without a request
We have not published a notice under section 52(2) of PAIA. The following are freely available on uquest.app without a formal request: the Privacy Policy, Terms of Service, Refund Policy, Consumer Health Data Privacy Policy, this manual, and product information.
5. Records kept under other legislation
We keep records as required by, among others:
- Companies Act 71 of 2008
- Income Tax Act 58 of 1962
- Tax Administration Act 28 of 2011
- Value-Added Tax Act 89 of 1991 (once registered for VAT)
- Protection of Personal Information Act 4 of 2013
- Consumer Protection Act 68 of 2008
- Electronic Communications and Transactions Act 25 of 2002
The company has no employees yet. Employment legislation will be added here when it does.
6. Subjects and categories of records held
| Subject | Records |
|---|---|
| Company | Memorandum of Incorporation, registration certificate, securities register, share certificates, director resolutions, CIPC filings, beneficial ownership records |
| Finance and tax | Bank statements, accounting records, payout reports from our payment provider, supplier invoices, SARS registrations and returns |
| Users | Account and profile records, health and fitness logs, AI coach records, subscription status, support correspondence, consent records |
| Service providers | Agreements, data processing agreements, invoices |
| Technology and security | System documentation, access logs, encrypted backups, security incident register |
| Compliance | Access and privacy request register, PAIA annual reports, this manual |
| Marketing (when started) | Mailing list and consent records |
7. How we process personal information
7.1 Purposes
We process personal information to:
- create and run user accounts and the fitness and nutrition tracking service
- provide the AI coach, weekly reviews, check-ins and meal photo estimates, when users choose those features
- manage subscriptions, which are sold by our merchant of record, Paddle
- send account emails such as confirmations and password resets
- answer support requests and feedback
- understand how the app is used, only where users opt in to analytics
- keep the service secure and prevent misuse, including repeat free trials
- send marketing emails, only to people who have opted in
- keep company, tax and legal records
7.2 Data subjects and the information we hold about them
| Data subjects | Categories of personal information |
|---|---|
| Users of the app | Email address, display name, password (stored hashed by our authentication provider) or Google sign-in details, age, sex, height, weight, goals, activity level, nutrition targets, unit preference, coaching preferences (including injuries, physical limitations, dietary preferences and equipment), profile photo, body weight entries, food and nutrition logs, workouts and activities, rest days, daily notes, AI coach messages, AI-generated summaries and reviews, subscription identifiers and status, consent records, device and browser information, IP addresses in server logs |
| Website visitors | Page-view statistics without cookies, IP addresses in hosting logs |
| People who contact support | Name, email address, message content |
| Newsletter subscribers (when started) | Email address, consent record, email engagement |
| Former users | A one-way hash of the email address of a deleted account, used only to prevent repeat free trials |
| Service providers and advisers | Contact names, business contact details, agreements |
| The director | Identity and contact details, company records |
Health information (weight, body measurements, food intake, workouts, injuries, limitations and notes) is special personal information under POPIA. We process it only with the user's consent.
7.3 Recipients
- Operators that process information on our behalf: Supabase (database, authentication, server functions, file storage), OpenAI (AI coach and meal photo analysis), PostHog (opt-in analytics, no health data), RevenueCat (subscription status), Resend (account emails), Zoho (support mailbox), Cloudflare (hosting, content delivery, email forwarding, website statistics) and Google (optional sign-in and encrypted backup storage).
- Paddle, which sells our subscriptions as merchant of record and handles payment details under its own privacy notice.
- Authorities, such as SARS, the Information Regulator or a court, when the law requires it.
- Professional advisers, such as our accountant or attorney, under a duty of confidentiality.
We do not sell personal information.
7.4 Planned transborder flows
Personal information is processed outside South Africa:
| Country or region | Providers |
|---|---|
| United States | Supabase (us-east-1), OpenAI, RevenueCat, Resend (us-east-1), Zoho Mail, Google |
| European Union | PostHog |
| United Kingdom and European Union | Paddle |
| Global network | Cloudflare |
We rely on binding agreements with each operator that give protection substantially similar to POPIA (section 72(1)(a)), and on users' consent to the transfer (section 72(1)(b)).
7.5 Security measures
We protect personal information with:
- encrypted connections (HTTPS/TLS) for all traffic
- database row-level security, so each user can reach only their own records
- billing fields that only the server can change
- secret keys held only on the server
- signature checks on incoming payment webhooks
- analytics that never receive health data
- error messages and logs stripped of personal detail in production
- two-factor authentication on administrator accounts
- weekly encrypted backups (AES-256) that are rotated
Only the director has access to production systems.
8. How to request access to a record (PAIA)
- Complete Form 2 of the PAIA Regulations, 2021 (Request for Access to Record), available from the Information Regulator's website or from us on request.
- Email it to support@uquest.app with proof of identity. If you act for someone else, include proof of your authority.
- Describe the record clearly, say in what form you want access, and identify the right you want to exercise or protect and why you need the record (section 53(2)(d)).
- Pay the request fee, unless you are asking for your own personal information.
We will decide within 30 days. We may extend this once by up to 30 days and will tell you why (section 57). If we do not decide in time, the request is regarded as refused (section 58). We may refuse access only on the grounds in Chapter 4 of Part 3 of PAIA, for example to protect another person's privacy or confidential commercial information.
Fees
| Item | Fee (ZAR) |
|---|---|
| Request fee (not payable for your own personal information) | 140.00 |
| Copy or printout, per A4 page | 2.00 |
| Copy on a flash drive you provide | 40.00 |
| Transcription of an audio record, per A4 page | 24.00 |
| Search and preparation, per hour after the first hour | 145.00 (maximum 435.00) |
| Deposit if the search will take more than 6 hours | One third of the access fee |
| Postage | Actual cost |
Fees are those prescribed by the Regulator for private bodies.
If you are unhappy with a decision
You can complain to the Information Regulator within 180 days of our decision, or apply to court.
9. Requests about your own personal information (POPIA)
You may, free of charge:
- ask whether we hold personal information about you and receive a copy (section 23)
- ask us to correct or delete it (section 24, using Form 2 of the POPIA Regulations or any written request)
- object to processing (section 11(3), using Form 1 of the POPIA Regulations or any written request)
- withdraw consent
Send these to support@uquest.app. We accept requests in any reasonable form, including a plain email, and respond within 30 days. Most users can also delete their account in the app under Profile > Delete account.
10. Availability and updates
This manual is available at uquest.app and at our registered address, free of charge, and is provided to the Information Regulator on request. We review it at least once a year and whenever our processing changes.