Privacy Policy

This website is owned and operated by Medicine Like Food (“we”, “us”, “our”), a natural health and herbal wellness business based in the Western Cape, South Africa. We are the responsible party (data controller) for the personal information collected through medicinelikefood.com.

Information Officer / contact for privacy matters:
Email: [email protected]
Phone / WhatsApp: 079 438 9914
Address: Western Cape, South Africa

We only collect information we genuinely need. Depending on how you use our site, this may include:

• Order & checkout information: your name, email address, delivery address, phone number and order details.
• Payment information: processed securely by our payment providers (PayFast, PayPal). We do not store your full card details on our servers.
• Account information: if you create an account, your name, email and a securely hashed password.
• Newsletter signups: your email address, together with a record of your consent and the date you gave it.
• Contact enquiries: the name, email and message you send us.
• Usage & analytics data: via Google Analytics — for example your approximate location, device/browser type, pages viewed and how you found us. This may include your IP address and cookie identifiers. Analytics only runs after you accept cookies (see section 6).

We process your personal information for the following purposes:

• To process and deliver your orders, and to provide order updates and customer support.
• To manage your account and keep it secure.
• To send marketing emails and wellness content — only where you have given us your consent, which you can withdraw at any time.
• To respond to your enquiries and messages.
• To understand how our site is used so we can improve it (analytics).
• To meet our legal, accounting and regulatory obligations.

Under POPIA, we rely on your consent, the performance of our contract with you (your order), our legitimate interests in running our business responsibly, and compliance with the law as our lawful bases for processing. For EU visitors, the equivalent GDPR lawful bases apply.

We never sell your personal information. We share it only with trusted parties who help us run the store, and only as far as needed:

• Payment providers (PayFast, PayPal) to process your payment securely.
• Delivery / courier partners to fulfil your order.
• Email & hosting providers that power this website and our notifications.
• Google Analytics for website usage insights.
• Regulators or authorities where we are legally required to do so.

Some of these providers may process data outside South Africa. Where that happens we take reasonable steps to ensure your information continues to be protected to a comparable standard, as required by POPIA.

We keep personal information only for as long as necessary for the purpose it was collected, or as required by law (for example, tax and accounting records are kept for the period required by SARS). When information is no longer needed, we securely delete or anonymise it. Newsletter records are kept until you unsubscribe, plus a short period to evidence that consent was given and withdrawn.

Cookies are small files stored on your device. We use a small number of essential cookies to make the site work (for example, to remember your cart and keep you signed in) — these are always on.

We also use Google Analytics to understand how visitors use our site. These analytics cookies only load after you accept them in our cookie banner. You can reject them and the site will still work fully. You can change your choice at any time by clearing your cookies or using the “Cookie settings” link, and you can control cookies through your browser settings too.

You have the right to:

• Ask what personal information we hold about you and request a copy.
• Ask us to correct or update information that is inaccurate.
• Ask us to delete your information, where we are not legally required to keep it.
• Object to or withdraw your consent to marketing at any time (every marketing email includes an unsubscribe link).
• Lodge a complaint with the Information Regulator of South Africa, or your local data protection authority if you are in the EU.

To exercise any of these rights, email us at [email protected]. The Information Regulator (South Africa) can be reached at inforegulator.org.za.

We use appropriate technical and organisational measures to keep your information safe, including encrypted connections (HTTPS), secure password hashing and restricted access. While no online service can guarantee absolute security, we work hard to protect your data and to respond quickly if anything ever goes wrong.

Our products and website are intended for adults. We do not knowingly collect personal information from children without the consent of a parent or guardian.

We may update this Privacy Policy from time to time. The latest version will always be published on this page with an updated date at the top.

Please also read our Terms & Conditions and our Returns & Refunds Policy.