1.About this policy
PharmaCare ("we", "us") is an online pharmacy in Kenya. This policy explains what personal data we collect when you use this website or order from us, why we collect it, who we share it with, how long we keep it and what rights you have. We handle personal data in line with Kenya’s Data Protection Act, 2019, and we are the data controller for the information described here.
Some of the data we handle, such as prescriptions, concerns your health. The law treats this as sensitive personal data, and we take extra care with it.
2.What we collect
The data we collect depends on how you use the site.
- Order details: your name, phone number, email address, delivery address and the items you order.
- Account details, if you create an account: your name, contact details, a securely hashed password, saved addresses, wishlist and order history.
- Health information: prescriptions you share with us, and any details you give a pharmacist about the patient, such as allergies, other medicines or conditions.
- Payment information: confirmation that a payment was made and its reference. M-PESA PINs are never seen or stored by us.
- Communications: messages you send us by WhatsApp, phone, email or the contact form, and your newsletter sign-up.
- Technical data: your device and browser type and how you use the site, and information stored in your browser so the site works (see Cookies and browser storage).
3.How we collect it
Mostly directly from you, when you place an order, create an account, upload or send a prescription, contact us or sign up for updates. Some technical data is collected automatically when you use the site. If you order for someone else, we collect their details from you, and you confirm you are entitled to share them.
4.Why we use your data
We only use your data for the purposes above, or for a closely related purpose, or where the law requires or allows it. We do not sell your personal data.
| Purpose | Basis |
|---|---|
| Process, dispense, deliver and support your order | Contract |
| Verify prescriptions and supply medicines safely | Legal obligation and your consent |
| Keep the records pharmacy law requires | Legal obligation |
| Send order updates by SMS, WhatsApp, email or phone | Contract and legitimate interests |
| Prevent fraud, misuse and abuse of prescriptions | Legitimate interests and legal obligation |
| Send offers and news you have asked for | Consent |
| Keep the site secure and improve it | Legitimate interests |
5.Prescriptions and health information
Prescriptions and health details are used only to verify and fulfil your order and to meet our legal duties as a pharmacy. They are stored securely and only licensed pharmacists and the staff who need them to complete your order can access them. We may contact your prescriber to confirm a prescription.
You can choose not to share health information, but we may then be unable to supply a prescription-only medicine.
8.Marketing and your choices
We send offers and news only if you have signed up for them. Every message tells you how to stop, or you can contact us at any time. Order and delivery messages are not marketing and will continue while you have an open order.
9.How long we keep data
We keep personal data only for as long as we need it for the purposes above, and for as long as the law requires. Pharmacy and tax rules oblige us to keep certain records, such as prescription and order records, for set periods. When data is no longer needed, we delete or anonymise it.
If you delete your account, we remove your profile, saved addresses and wishlist, but we may keep order and prescription records we are legally required to retain.
10.Keeping your data secure
We use measures appropriate to the sensitivity of the data. These include encrypted connections, hashed passwords, access limited to people who need it and secure storage of prescriptions. No system is completely secure, so please protect your password and tell us at once if you suspect misuse of your account.
If a breach is likely to put your rights at risk, we will notify you and the Office of the Data Protection Commissioner as the law requires.
11.Transfers outside Kenya
Some of our service providers may process data outside Kenya. Where that happens, we take steps to make sure your data stays protected as the Data Protection Act requires, for example through contracts with the provider and appropriate safeguards.
12.Your rights
Under the Data Protection Act, 2019, you have the right to:
- be told how your data is used, which is the purpose of this policy
- access the personal data we hold about you
- ask us to correct data that is wrong or incomplete
- ask us to delete data we no longer need or have no right to keep
- object to, or ask us to restrict, how we use your data, including for marketing
- receive your data in a commonly used format, where that applies
- withdraw your consent at any time, without affecting what we did before you withdrew it
Some rights have exceptions. For example, we cannot delete records that the law requires pharmacies to keep. We may need to confirm your identity before acting on a request, and we will reply within the time the law allows.
13.Children
This website is for adults. We do not knowingly collect data from children. If you order medicine for a child, you are responsible for their information, and we will use it only to supply the order safely.
14.Complaints
If you are unhappy with how we have handled your data, please contact us first and we will try to put it right. You also have the right to complain to the Office of the Data Protection Commissioner of Kenya.
15.Changes to this policy
We may update this policy from time to time. The date at the top shows when it was last changed. If we make a significant change, we will tell you on the site or by other suitable means.
16.Contact us
For privacy questions or to use any of your rights, contact us at our support team, on WhatsApp at +254700000000 or by phone on +254 700 000 000. You can also write to us at Nairobi, Kenya.