Privacy
What we collect, and what we do with it.
Last updated 15 September 2026
This page covers www.coba.health — the Coba Biomedical site, including the Surgeon Advisory Board pages. It is short because the site does little: it describes what we make and how we work, and it has one enquiry form.
Who is responsible
The responsible party — the controller, under the GDPR — is Coba Biomedical, based in Bloemfontein, South Africa.
Questions, requests and complaints, including anything for our Information Officer under South Africa's POPIA, can be sent through the contact page.
Kingfisher Medical distributes our instruments and is in the operating room alongside us. Where a submission concerns an instrument they distribute, we may discuss it with them. They are named here because the work is done jointly, not because they receive a copy of everything.
The form
The site's enquiry form asks for the same things wherever it appears:
| Field | Why |
|---|---|
| Name | So we know who we are speaking to. |
| Hospital, practice or company | To understand the setting the instruments are used in. |
| To answer you. It is the only way we make contact. | |
| Reason for contact | To route the enquiry to the right people. |
| Message Optional | Whatever you want us to know before we speak. |
The Surgeon Advisory Board page carries the same form with one extra field, specialty, used to route the conversation to the right engineers.
We ask for nothing about patients, and nothing about your health. Please do not put patient information in the message field — if you do, we will delete it.
Why we are allowed to hold it
You gave it to us so that we would answer you. Under the GDPR that is Article 6(1)(b) — steps taken at your request before entering into a contract — and, for the part of the conversation that is simply us developing instruments, Article 6(1)(f), our legitimate interest in developing them with the surgeons who use them. Under POPIA it is section 11(1)(b) and 11(1)(f). You can object at any time, and we will stop.
Where it goes
The submission is sent to Nexus Communications, which runs the form service atforms.nexshub.com on our behalf. It stores the submission and emails it on to the people who answer enquiries — today those are addresses atGood Fortune Agency, who operate our correspondence for us.
It goes nowhere else. We do not sell it, we do not trade it, and it does not go into an advertising audience.
How long we keep it
For as long as the conversation is live, and then only for as long as we need it to follow up, after which it is deleted. If you tell us you are not interested, we delete it at that point unless you ask us to keep you in mind.
Stopping spam
The form is protected by Cloudflare Turnstile, which decides whether a submission is coming from a person or a machine. To do that, Cloudflare receives your IP address and signals about your browser. It is a condition of the form working: without it the form refuses every submission, including yours. Turnstile does not build an advertising profile from what it sees.
The form service also checks how quickly the form was filled in and whether a hidden field was touched. Both are ordinary anti-spam measures and neither is used to identify you.
Measurement
If you agree to it, we use Google Analytics 4 to count how many people open these pages and which parts they read. If you do not, it is not loaded in a form that can store anything. Nothing is measured before you choose. What is stored, and for how long, is set out on thecookies page, and you can.
Advertising
We are not running any advertising today.
If that changes — a campaign on Google or on Meta to reach surgeons more widely — the tags that measure it are already wired to your choice and to nothing else. They load only for a visitor who has accepted marketing cookies, and never for a visitor who has not. We will list them on the cookies page before any of them is switched on, and update the date at the top of this one. We do not upload your email address to an advertising platform to build an audience from it.
Links from this site to our other properties carry a tag that tells the site you land on that you came from here. It records the page you left, not who you are.
The rest of what the site loads
| Who | What they get | Why |
|---|---|---|
| Vercel | Your IP address and browser, in ordinary server logs | They host the site. |
| Cloudflare | Your IP address and browser signals | The form's spam check. |
| Nexus Communications | What you typed into the form | Receiving and storing it. |
| Google Analytics | A cookie identifier and page views — only if you agree | Counting visits. |
The typefaces are served from this site rather than fetched from Google, so loading a page does not hand your IP address to a font service.
Several of the parties above are outside South Africa and outside the EU, mostly in the United States. That means your information is transferred there, under the safeguards those providers offer for international transfers.
Your rights
Wherever you are, you can ask us for a copy of what we hold about you, ask us to correct it, and ask us to delete it. Send the request through the contact page and we will answer within 30 days.
If the GDPR applies to you, you also have the right to restrict or object to how we use your information, the right to receive it in a portable form, and the right to complain to your national supervisory authority. If POPIA applies, you may complain to the Information Regulator of South Africa at enquiries@inforegulator.org.za.
You never need an account or a reason.
Security
The site is served over HTTPS and so is the form. Submissions are held by Nexus Communications on our behalf, and reach us by email. We keep access to them to the people who answer enquiries.
Confidentiality of the advisory board
The Surgeon Advisory Board is reached by an invitation addressed to a named surgeon. That invitation is personal and is not transferable. We would ask you not to forward it: the board is small on purpose, and we would rather extend an invitation ourselves than have one arrive without context.
What is shared with you under the programme — instruments in development, prototypes placed in your hands, drawings, designs, and any commercial terms discussed — is confidential. It is shared so that you can shape it, not so that it can be circulated. Where a separate confidentiality undertaking or member agreement is in place, that document governs and nothing on this page narrows it.
What this site is, and is not
These pages describe what we make and the work behind it. They are not a specification, not an offer, and not a substitute for the instructions for use of any instrument. Nothing here is clinical or medical advice, and nothing here is a representation about the performance of any device in a particular procedure.
Instruments described or shown may still be in development. They may not be registered, cleared or available for sale in your country, and their availability, regulatory status and specification may change. If you are deciding whether to use an instrument clinically, the labelling and the instructions for use govern — not this site.
We keep these pages accurate and correct them when they are not, but we do not warrant that everything here is complete or current at the moment you read it.
Changes
If we change what we collect or who receives it, we will change this page and move the date at the top. If the change is significant and we are already in touch with you, we will tell you directly rather than expecting you to come back and check.