Vital Pursuit PAIA Manual
Prepared in terms of Section 51 of the Promotion of Access to Information Act No. 2 of 2000 (as amended) for:
- Bioscience and Technology Holdings (Pty) Ltd, trading as Vital Pursuit
- Registration number: 2016/366514/07
- Date of compilation: 8 August 2024
- Date of revision: 10 June 2025
- Date of this revision: 17 September 2026
Table of contents
- List of acronyms and abbreviations
- Purpose of this manual
- Company details
- Information Officer and contact details for access to information
- The Regulator's Guide on how to use PAIA
- Records available without a formal request
- Records available in terms of other legislation
- Categories of records held by the Company
- Description of subjects and categories of records held
- Processing of personal information (POPIA section 51(1)(c) to (e))
- How to request access to records
- Fees
- Grounds for refusal of access
- Notice on data subject rights
- Availability of the manual
- Updating of the manual
- Signatory
1. List of acronyms and abbreviations
- CEO: Chief Executive Officer
- DIO: Deputy Information Officer
- IO: Information Officer
- PAIA: Promotion of Access to Information Act No. 2 of 2000 (as amended)
- POPIA: Protection of Personal Information Act No. 4 of 2013
- Regulator: the Information Regulator (South Africa)
- Republic: the Republic of South Africa
- The Company: Bioscience and Technology Holdings (Pty) Ltd, trading as Vital Pursuit
- Asset Assistant: the Company's Android application for registering movable business assets
2. Purpose of this manual
This manual is compiled in accordance with Section 51 of PAIA. It explains what records the Company holds, how a person may request access to them, and how the Company processes personal information, as required by PAIA and by section 51(1)(c) to (e) of PAIA read with POPIA.
Overview of the Company and of Asset Assistant
The Company publishes the Asset Assistant mobile application on Google Play and provides technology and consulting services. Asset Assistant is an on-device asset register for South African businesses: a user photographs a movable asset, optional AI features identify it, read its invoice and estimate its value, and the register is exported to PDF, CSV or the user's own accounting system. The user's asset records and photographs are stored on the user's own device, not on the Company's systems, and the app has no user accounts. This design is reflected throughout sections 8 to 10 of this manual, and it is why the Company holds almost no records about app users.
3. Company details
- Full name: Bioscience and Technology Holdings (Pty) Ltd
- Registration number: 2016/366514/07
- Trading name: Vital Pursuit
- Physical address: 32 Ryneveld Street, Stellenbosch, 7600, South Africa
- Postal address: 32 Ryneveld Street, Stellenbosch, 7600, South Africa
- Telephone: +27 76 861 9520
- Email: info@vitalpursuit.co.za
- Website: https://vitalpursuit.co.za
4. Information Officer and contact details for access to information
- Information Officer: Jan H. Esser, Chief Executive Officer
- Email: info-officer@vitalpursuit.co.za
- Telephone: +27 76 861 9520
- Physical address: 32 Ryneveld Street, Stellenbosch, 7600
- Registration: the Information Officer is registered with the Information Regulator.
Deputy Information Officer(s): none appointed.
5. The Regulator's Guide on how to use PAIA
In terms of Section 10 of PAIA, the Information Regulator has compiled a Guide on how to use PAIA and how to exercise the right of access to personal information under section 23 of POPIA. The Guide is available in all official languages and can be obtained as follows:
- Website: https://inforegulator.org.za/paia-guide/ (English version: https://inforegulator.org.za/wp-content/uploads/2020/07/PAIA-Guide-English_20210905.pdf)
- From the Regulator: JD House, 27 Stiemens Street, Braamfontein, Johannesburg, 2001; PO Box 31533, Braamfontein, 2017; enquiries@inforegulator.org.za
- From the Company: a copy can be requested from the Information Officer by email.
6. Records available without a formal request
The following records are available on the Company's website, or from the Information Officer on request, without a formal PAIA request:
- This PAIA Manual
- Asset Assistant Terms and Conditions
- Asset Assistant Privacy Policy
- Asset Assistant POPIA Notice
- Asset Assistant Data Deletion page
- Marketing and product information published on the website and the Google Play listing
The Asset Assistant legal documents are published at the addresses given in the app's Terms and Privacy screen and on the Google Play listing.
7. Records available in terms of other legislation
Where applicable, records are also available in terms of the following legislation, subject to the conditions in each Act:
- Companies Act No. 71 of 2008
- Income Tax Act No. 58 of 1962 and the Tax Administration Act No. 28 of 2011
- Value-Added Tax Act No. 89 of 1991
- Basic Conditions of Employment Act No. 75 of 1997
- Labour Relations Act No. 66 of 1995
- Unemployment Insurance Act No. 63 of 2001
- Compensation for Occupational Injuries and Diseases Act No. 130 of 1993
- Consumer Protection Act No. 68 of 2008
- Electronic Communications and Transactions Act No. 25 of 2002
- Protection of Personal Information Act No. 4 of 2013
8. Categories of records held by the Company
Corporate and operational records
- Company registration and statutory records
- Service agreements and project documents (consulting)
- Internal communication and policies
- Product documentation and user manuals
Financial records
- Invoices, bank statements and banking details
- Financial statements and management accounts
- Tax returns and SARS correspondence
- Google Play sales and payout reports (aggregate; Google Play, not the Company, holds customer payment details)
Personnel records
- Employment contracts and contractor agreements
- Contact information, performance and payroll records
Client records (consulting)
- Contracts, proposals and statements of work
- Correspondence and communication logs
- Transaction history and client profiles
Third-party service provider records
- Contracts, service level agreements and data processing terms with service providers (for example Google Cloud, Google Play, OpenAI)
- Performance and cost reports
Asset Assistant records (the app)
The Company deliberately holds very little in relation to app users. The app has no user accounts and no server-side copy of any customer's register. What the Company does hold:
- AI usage logs: one entry per AI request, containing timestamp, operation type, AI model, request status, token usage, a confidence score, currency, country, an asset category, and, only where the user has given separate in-app consent, the vendor name read from an invoice. Not linked to any account, person or device identifier. Retained for 12 months.
- Technical request logs: recorded automatically by Google Cloud for every request to the Company's service: time, address requested, response status and size, IP address and app or browser identifier. Used for security, abuse prevention and fault tracing. Stored in South Africa and retained for 90 days.
- Support reports and support correspondence: only if a user chooses to send one. Contains app version, device model, subscription state, credit balance and purchase tokens; never photographs, asset details or location.
- Purchase verification records: opaque Google Play purchase tokens processed transiently to confirm a purchase with Google. They identify a transaction, not a person.
- Team-mode relay content: end-to-end encrypted capture data in transit between a customer's own devices. The Company cannot read it. Deleted on delivery and in any case within 60 days.
- Reported AI results: if a user reports an AI result, the reference to that request, the reason selected and any note typed.
What the Company does not hold: customers' asset registers, photographs, invoices, GPS positions, backups, backup passphrases, payment card details, or anything a customer sends to their own accounting system (for example Xero) through the app.
9. Description of subjects and categories of records held
| Subject | Categories of records |
|---|---|
| Strategy and planning | Business plans, strategic documents |
| Human resources | HR policies, employment contracts, employee records |
| Legal and compliance | Regulatory compliance documents, PAIA manual, POPIA notices and policies, Information Officer registration |
| Marketing | Marketing material, website and Google Play listing content, market research |
| Technology and product | System architecture, software documentation, security documentation, Asset Assistant source code and release records |
| Asset Assistant service operation | AI usage logs, support reports, purchase verification records, relay operation records (see section 8) |
| Consulting | Client contracts, deliverables, correspondence |
| Finance | Accounting records, tax records, Google Play reports |
10. Processing of personal information
This section is included in terms of section 51(1)(c) to (e) of PAIA, read with POPIA.
10.1 Purpose of processing personal information
The Company processes personal information to:
- provide and improve its consulting services and the Asset Assistant app
- provide the AI features a user requests in the app, and to cost and monitor that service
- verify Google Play purchases and prevent unauthorised use of paid features
- respond to support requests and reported AI results
- manage client, employee and supplier relationships
- process payments and keep accounting records
- comply with legal and regulatory obligations
10.2 Categories of data subjects and personal information
| Category of data subject | Personal information processed |
|---|---|
| Asset Assistant users | No accounts are kept. The IP address and app identifier of each request are held in technical request logs for 90 days. Other personal information may arise only from: a support report or email the user chooses to send; a vendor name logged from an invoice with the user's consent; a report of an AI result. Photographs and documents sent for AI processing pass through the Company's service in transit only and are not stored. |
| Team-mode field workers | A device label typed by the organisation owner and a pseudonymous device token. The organisation owner, not the Company, is the responsible party for the organisation's register. |
| Website enquirers | Name, email address, and optionally phone number and organisation, with the message they send through the contact form on https://vitalpursuit.co.za (and, if they choose to include it, the Strategy Preview text and AI response). Received by email and kept as business correspondence in Google Workspace. |
| Consulting clients and their staff | Name, business address, email, telephone number, role, contract and billing details, and any information the client supplies for a consulting engagement (which may include healthcare-related information where the engagement concerns a healthcare business) |
| Employees and contractors | Name, address, identity number, employment history, qualifications, banking and payroll details |
| Service providers | Company details, contact information, banking and tax details |
10.3 Recipients of personal information
Personal information may be shared with:
- Government and regulatory bodies, for example SARS and the Information Regulator, where required by law
- OpenAI (United States): processes photographs, documents and text hints for the app's AI features, transiently, and retains inputs for up to 30 days for abuse monitoring
- Google: Google Cloud hosts the Company's AI proxy, relay and usage logs in South Africa; Google Play processes app purchases and app verification (Play Integrity) under Google's own terms
- Accounting systems chosen by the user (currently Xero): only when a user connects their own accounting organisation in the app and instructs it to send asset records there; the data goes from the user's device to that provider and the Company is not a party to it
- Financial institutions, for payment processing and banking
- Legal, accounting and other professional advisers
- Affiliates and subsidiaries, if any
10.4 Planned transborder flows of personal information
- United States of America: AI processing by OpenAI (photographs, documents and minimal hints for a single request). Google Play purchase verification and app verification are handled by Google under its own terms.
- Other countries: where a user connects a third-party accounting system, that provider may host data outside South Africa; the user, not the Company, directs that transfer.
The Company's own service and its retained logs run inside South Africa on Google Cloud. Transfers to OpenAI are necessary to provide the feature the user requests and are made under binding terms that require OpenAI to protect the data, as contemplated by section 72 of POPIA.
10.5 Information security measures
- Asset Assistant stores customer data on the customer's device only; there is no server-side copy for the Company to lose.
- All traffic between the app and the Company's service travels over encrypted HTTPS/TLS connections.
- Team-mode data is end-to-end encrypted on the devices; the Company's relay carries ciphertext it cannot read.
- Encrypted backups are protected by a passphrase chosen by the user; the Company never receives them.
- Service providers encrypt data at rest and in transit (OpenAI: AES-256 and TLS 1.2 or later; Google Cloud: encryption at rest).
- Access to the Company's cloud console, logs and records is limited to the Information Officer and authorised personnel, protected by multi-factor authentication.
- Retention limits are enforced technically: technical request logs expire after 90 days, usage logs after 12 months and relay content after at most 60 days.
- Business records are kept on access-controlled systems and reviewed periodically.
11. How to request access to records
- Complete the prescribed form. Use Form 2 (Request for Access to Record of a Private Body), available from the Information Regulator at https://inforegulator.org.za/wp-content/uploads/2020/07/InfoRegSA-PAIA-Form02-Reg7.pdf or from the Information Officer.
- Submit the form to the Information Officer by email to info-officer@vitalpursuit.co.za, or by post or hand delivery to 32 Ryneveld Street, Stellenbosch, 7600.
- Include in the request: a description of the record sufficient to identify it; the right you wish to exercise or protect and why the record is required for that purpose; the form of access you prefer (inspection, copy, electronic copy); your identity details and proof of identity; and, if you are requesting on behalf of someone else, proof of the capacity in which you act.
- Pay the applicable fees (section 12) when notified.
The Company will respond within 30 days of receiving a complete request, which may be extended once by up to 30 days where PAIA permits. If a request is refused, reasons will be given as PAIA requires.
If you need help completing the form, contact the Information Officer.
12. Fees
Fees are those prescribed in the PAIA Regulations (2021), Annexure B, as published by the Information Regulator. At the date of this revision:
- Request fee: R140.00, payable by every requester except a personal requester (a person requesting a record containing personal information about themselves).
- Access fees are charged for reproducing and preparing the record, for example R2.00 per A4 page for a printed copy, R40.00 for an electronic copy on a flash drive the requester supplies, and R145.00 per hour (after the first hour) for search and preparation, capped at R435.00 per request.
- Deposit: where search and preparation are expected to exceed six hours, a deposit of one third of the estimated access fee may be required.
- Postage and electronic transfer costs are charged at actual cost.
The current schedule is at https://inforegulator.org.za/paia-fees-structure-2/. If the Regulator amends the fees, the amended fees apply.
13. Grounds for refusal of access
The Company may refuse access to a record on the grounds set out in Chapter 4 of Part 3 of PAIA, including where the record contains:
- personal information about a third party (section 63)
- commercial information of a third party or of the Company, including trade secrets (sections 64 and 68)
- information supplied in confidence by a third party (section 65)
- information whose disclosure could endanger the safety of individuals or the security of property (section 66)
- records privileged from production in legal proceedings (section 67)
- research information whose disclosure would expose the researcher or the Company to serious disadvantage (section 69)
Access may not be refused where disclosure would reveal evidence of a substantial contravention of the law or an imminent and serious public safety or environmental risk, and the public interest in disclosure clearly outweighs the harm (section 70). Where access is refused, the Company will give reasons as PAIA requires, and the requester may lodge a complaint with the Information Regulator or apply to court.
14. Notice on data subject rights
Under POPIA you have the right to:
- Access the personal information the Company holds about you
- Correction of inaccurate, irrelevant, excessive, out of date, incomplete, misleading or unlawfully obtained information
- Deletion of personal information the Company is no longer entitled to keep
- Object to processing, including for direct marketing
- Withdraw consent where processing is based on consent (for example vendor-name logging in the app, which can be withdrawn on the app's Terms and Privacy screen)
- Complain to the Information Regulator: POPIAComplaints@inforegulator.org.za
To exercise these rights, contact the Information Officer at info-officer@vitalpursuit.co.za. Asset Assistant users control their own register directly on their device; uninstalling the app erases all local data.
15. Availability of the manual
A copy of this manual is available:
- On the website: https://vitalpursuit.co.za/legal/paia.html
- At the Company's offices: 32 Ryneveld Street, Stellenbosch, 7600, during normal business hours
- By email: request a copy from info@vitalpursuit.co.za
- Languages: English.
16. Updating of the manual
The Company will review this manual at least annually and update it whenever there is a change in legislation, in the Company's activities, or in the way it processes personal information. The dates of compilation and revision appear on the first page.
17. Signatory
Issued by:
Jan H. Esser Chief Executive Officer and Information Officer Bioscience and Technology Holdings (Pty) Ltd, trading as Vital Pursuit
Date: 17 September 2026