Privacy Policy

1. Introduction

The Mantis Model (Pty) Ltd ("Mantis Model", "we", "us" or "our") operates underwriting.life, a secure underwriting-intelligence platform used by life insurers, reinsurers and their authorised intermediaries (our "Clients") in South Africa. The platform helps a Client assess an insurance application by retrieving and combining identity, pathology and financial-crime screening information about the individual who is applying for cover (the "Applicant" or "data subject").

This Privacy Policy explains how we collect, use, share, secure and retain personal information, and the rights you have. It is published in line with the Protection of Personal Information Act 4 of 2013 ("POPIA") and read together with our Manual prepared under the Promotion of Access to Information Act 2 of 2000 ("PAIA").

We are committed to processing personal information lawfully, in a way that is necessary, proportionate and transparent, and to protecting the special category information we handle with appropriate care.

2. Our role: operator and responsible party

POPIA distinguishes between a responsible party (which decides why and how personal information is processed) and an operator (which processes personal information on behalf of, and on the instruction of, a responsible party).

We act as an operator for every search. A search is run only on the written instruction of a Client, for that Client's underwriting or claims purpose, and the Client is the responsible party for it, including for the consent obtained from the Applicant. Selecting and contracting the data sources described in section 5 is part of the service we supply to our Clients.

We act as a responsible party only for our own billing, accounting and financial records; the security, access and audit logs of our platform; the accounts of Client users; the handling of requests and complaints addressed to us; and statistical data derived from search results only after de-identification. For new searches this takes place only where the Client's agreement authorises it. We also hold a historical statistical store derived before September 2026 from a medical data service that has since been withdrawn; it contains no names, identity numbers, dates of birth or link to an Applicant or a search, nothing is added to it, and it is not used to provide any service.

Where we act as an operator, we process personal information only with the Client's knowledge or authorisation, treat it as confidential, and apply the security safeguards described in section 9, as required by sections 20 and 21 of POPIA.

3. Information Officer

We have registered an Information Officer with the Information Regulator (registration number 2026-019341), as required by POPIA.

You may contact the Information Officer about this Policy, to exercise your rights, or to raise a concern about how we handle personal information.

4. Whose information we process and what we collect

Insurance Applicants (data subjects screened through the platform). We do not collect this information directly from the Applicant and Applicants do not have accounts on the platform. We receive identifying details from the Client and use them to query the data sources in section 5. Depending on the products the Client selects, this may include:

• Identity and contact details: full name, identity number or passport number, date of birth, and similar identifiers used to confirm identity (IDV product, via Home Affairs verification). The Home Affairs verification result includes the Applicant's Home Affairs photograph, which is biometric information and therefore special personal information.
• Health and medical information (special personal information): pathology / laboratory results, used to inform underwriting (PATH product).
• Financial-crime screening information: results of sanctions, politically-exposed-person (PEP) and adverse-media screening against the Applicant's name (AML product).

Client users (insurer and intermediary staff). To operate accounts we process names, work email addresses, telephone numbers, role and authentication data (including two-factor authentication secrets), and audit logs of actions taken on the platform.

Website visitors. When you visit underwriting.life we may process limited technical data (such as IP address and basic usage logs) needed to keep the site secure and functioning.

We process the minimum information necessary for each purpose and do not use Applicant information for marketing.

5. Sources of information

Applicant information is sourced from the Client and from regulated third-party data providers that we query on the Client's behalf:

• Identity verification: Department of Home Affairs records, accessed through our verification partner OmniCheck.
• Sanctions / PEP / adverse-media screening: accessed through VerifyID.
• Pathology results: accessed directly from pathology laboratories, under written data processing agreements.

We query a data source only when the relevant product has been selected for a specific application and the consent and authorisation conditions in section 7 are met.

6. Why we process personal information (purpose)

We process personal information to: verify an Applicant's identity; retrieve and present pathology and financial-crime screening information relevant to an insurance underwriting decision; produce underwriting-intelligence reports for the Client; bill Clients for the checks performed; maintain the security, integrity and auditability of the platform; comply with our legal obligations; and operate and support Client accounts.

7. Lawful basis and consent

Insurance underwriting relies on the Applicant's consent and on the legitimate interests of the insurer in assessing risk under sections 11 and 27 of POPIA. Pathology information is special personal information concerning health (section 26 of POPIA). It is processed on the basis of the Applicant's consent and the authorisation in section 32 of POPIA permitting processing of health information by, or for, parties involved in insurance, subject to confidentiality obligations. The Home Affairs photograph is biometric information and is processed on the basis of the Applicant's consent.

Consent is obtained by the Client from the Applicant as part of the insurance application. Each Client's approved consent form is held on file. When the pathology service goes live, the consent form will be attached to every request to a pathology data source, and we will not run a pathology query for a Client that does not have its consent form on file. Clients warrant to us that they have obtained valid consent from each Applicant and the necessary authority before submitting an Applicant for screening.

If you are an Applicant and wish to understand or withdraw the consent you gave, please contact your insurer (our Client) in the first instance, as they are the responsible party for the application. You may also contact our Information Officer.

8. Sharing of personal information

We share personal information only as needed to deliver the service and meet our legal obligations:

• with the Client that requested the screening, in the form of an underwriting-intelligence report;
• with the third-party data sources in section 5, to the extent needed to perform a requested query;
• with service providers (operators) who host or support the platform under written contracts requiring confidentiality and POPIA-compliant security, principally our cloud hosting provider; and
• where required by law, a court order, or a lawful request from a competent regulator or authority.

We do not sell personal information and we do not share it for third-party marketing.

9. Security safeguards

We maintain technical and organisational measures appropriate to the sensitivity of the information, as required by section 19 of POPIA. These include encryption of data in transit (TLS 1.2/1.3) and at rest; role-based access control on a least-privilege basis; mandatory two-factor authentication and a strong password policy for Client users; session timeouts and account-lockout controls; IP whitelisting and strict transport security on sensitive data integrations; a tamper-evident audit log of access and processing activity; daily cost and volume caps to limit unusual activity; and segregation of production data. We periodically review these measures and, before processing live Applicant data at scale, subject the platform to independent security testing.

If a security compromise affecting personal information occurs, we will notify the Information Regulator and affected parties as required by section 22 of POPIA.

10. Data residency and cross-border transfers

The platform and its databases are hosted in South Africa, in Amazon Web Services' Cape Town (af-south-1) region, to support local data residency. We do not transfer personal information outside South Africa in the ordinary course of operating the service. Should any cross-border processing become necessary in future, we will only do so on a basis permitted by section 72 of POPIA and will update this Policy accordingly.

11. Retention and deletion

We retain personal information only for as long as necessary for the purposes in this Policy. Identified Applicant information (results, names, identity number, date of birth and Home Affairs fields) is deleted from the platform 24 hours after a search is completed, or after a longer period only where the Client has requested one. For up to 90 days a pseudonymised record is kept so the Client can reconcile its invoice: a keyed hash of the identity number computed separately for each Client, the Client's own reference, the products, status, date and charge. At 90 days the keyed hash, the Client reference and any free-text fields are deleted, and the remaining record, which can no longer identify the Applicant, is kept for five years as our financial record. Applicant records are held separately for each Client and are never linked across Clients. Audit logs are kept for at least 12 months. Encrypted database backups expire after 7 days.

12. Your rights as a data subject

Subject to POPIA, you have the right to:

• be notified that your information is being collected or has been accessed in a compromise;
• request confirmation of whether we hold information about you, and to request access to it (through the PAIA process in our PAIA Manual);
• request that we correct or delete information that is inaccurate, irrelevant, excessive, out of date, incomplete, misleading or unlawfully obtained;
• object, on reasonable grounds, to the processing of your information;
• not be subject to a decision based solely on automated processing intended to profile you, where that has legal or similarly significant effects;
• withdraw consent, where processing is based on consent (this does not affect processing that already took place); and
• lodge a complaint with the Information Regulator.

Because we usually process Applicant information as an operator for an insurer, the most direct route for an Applicant to exercise these rights over an insurance application is through the insurer (our Client). We will assist our Clients in responding to such requests and will action requests that fall to us as responsible party.

13. Children's information

We may process information relating to a minor only where this is permitted under section 35 of POPIA, including with the consent of a competent person (such as a parent or guardian) obtained by the Client, or where otherwise authorised by law. We apply additional care to any such information.

14. Complaints

If you believe we have not handled your personal information in line with POPIA, please contact our Information Officer first so we can try to resolve the matter. You also have the right to complain directly to the Information Regulator:

15. Changes to this Policy

We may update this Policy from time to time to reflect changes in our processing, our data sources, or the law. The current version and its effective date are shown at the top of this document. Material changes will be communicated to Clients.

16. How to contact us

For any question about this Policy or your personal information, contact: