Privacy Policy

1. Who This Policy Applies To

This Policy applies to business administrators and Authorized Users (pharmacists, cashiers, and other staff) who access the Service, as well as visitors to our public website. It does not directly govern the personal data of your own customers that you enter into the Service as Customer Data — you act as the data controller for that information, and we act as a data processor on your behalf as described in Section 5.

2. Information We Collect

• Account information: name, email address, phone number, and role (admin, pharmacist, cashier) when you sign in through our authentication provider.
• Business information: business name, store names, addresses, and phone numbers you provide during setup.
• Operational data: inventory records, sales transactions, purchase orders, and related pharmacy operations data you or your staff enter into the platform.
• Payment information: transaction records processed through supported payment methods. We do not store full payment card numbers; card processing is handled by our payment partners.
• Communications: records of correspondence when you contact our support team.
• Usage and device data: log data such as IP address, browser type, device identifiers, and pages visited, collected automatically to help us maintain and improve the service. See our Cookie Policy for details.

3. Legal Basis for Processing

Where applicable data protection law requires a legal basis, we process personal information on the following grounds: performance of a contract (providing the Service to you); our legitimate interests (such as securing the Service and improving it); compliance with legal obligations; and, where required, your consent.

4. How We Use Information

• To provide, operate, and maintain the platform
• To authenticate users and manage access by role and store
• To process sales, payments, and inventory transactions you initiate
• To communicate with you about your account or the service
• To detect, prevent, and address technical issues, fraud, or misuse
• To comply with legal and regulatory obligations relevant to pharmacy operations
• To improve and develop new features, using aggregated or de-identified data where possible

5. Our Role as Processor for Customer Data

When you enter information about your own customers into the Service (such as a customer's name or contact details for a delivery), you are the data controller for that information and we act as a data processor, handling it only on your instructions and for the purpose of providing the Service. You are responsible for ensuring you have a lawful basis to collect and process that information under applicable law.

6. How We Share Information

We do not sell your personal information. We share information only with:

• Our authentication provider, to verify your identity when you sign in
• Payment processors (such as Mpesa or other supported payment methods), to process transactions you initiate
• Cloud hosting and infrastructure providers who store and process data on our behalf, under confidentiality obligations
• Professional advisors (such as auditors or lawyers), where necessary and under confidentiality obligations
• A successor entity in the event of a merger, acquisition, or sale of assets, subject to equivalent privacy protections
• Authorities, where required by law, legal process, or to protect the rights and safety of others

7. International Data Transfers

Your information may be processed on servers located outside your country of residence. Where we transfer personal information across borders, we take steps intended to ensure it receives an adequate level of protection, consistent with applicable data protection law, including the use of contractual safeguards with service providers where appropriate.

8. Data Retention

We retain account and operational data for as long as your account is active, or as needed to provide the service, comply with legal obligations (including pharmacy record-keeping requirements), resolve disputes, and enforce our agreements. When data is no longer needed for these purposes, we take reasonable steps to delete or anonymize it.

9. Your Rights

Depending on your location and applicable law (including the Kenya Data Protection Act, 2019, where applicable), you may have the right to:

• Access the personal information we hold about you
• Request correction of inaccurate or incomplete information
• Request deletion of your personal information, subject to legal retention requirements
• Object to or request restriction of certain processing
• Request a copy of your data in a portable format
• Withdraw consent, where processing is based on consent, without affecting prior lawful processing
• Lodge a complaint with the Office of the Data Protection Commissioner (Kenya) or your local data protection authority

To exercise these rights, contact us using the details in Section 14. We may need to verify your identity before fulfilling a request.

10. Security

We use reasonable administrative, technical, and physical safeguards to protect your information, including access controls, encryption in transit, and authentication mechanisms. No method of transmission or storage is 100% secure, and we cannot guarantee absolute security.

11. Data Breach Notification

In the event of a data breach affecting your personal information, we will notify you and, where required, the relevant supervisory authority, without undue delay and in accordance with applicable law, describing the nature of the breach and the steps we are taking in response.

12. Automated Decision-Making

We do not currently use your personal information to make decisions with legal or similarly significant effects on you based solely on automated processing without human involvement.

13. Children's Privacy

Our platform is intended for business use by adults and is not directed at children. We do not knowingly collect personal information from children. If we become aware that we have inadvertently collected personal information from a child, we will take steps to delete it.

14. Contact Us

If you have questions about this Privacy Policy or wish to exercise any of your rights, contact us at [email protected].

15. Changes to This Policy

We may update this Privacy Policy from time to time. We will post the updated version on this page with a revised "Last updated" date, and where changes are material, we will provide additional notice such as an email or in-app notification.