At PrimeCare Pharmacy ("we," "our," or "us"), we value your health and your privacy. This Privacy Policy details how we collect, handle, store, use, and safeguard your personal information and sensitive medical data when you access our digital pharmacy platform, buy products, or interact with our licensed pharmacists.
By accessing and purchasing products on PrimeCare Pharmacy, you consent to the data collection and usage practices described in this policy.
1. Compliance with the Kenya Data Protection Act 2019
PrimeCare Pharmacy is fully compliant with the Kenya Data Protection Act, 2019 and is registered as both a Data Controller and a Data Processor with the Office of the Data Protection Commissioner (ODPC) of Kenya.
We adhere strictly to the core principles of data protection as mandated by the Act. This means your personal and sensitive data is:
- Processed lawfully, fairly, and in a transparent manner.
- Collected for specified, explicit, and legitimate health-fulfillment purposes and not further processed in a manner incompatible with those purposes.
- Adequate, relevant, and limited to what is necessary in relation to the purposes for which they are processed.
- Accurate and, where necessary, kept up to date.
- Kept in a form which permits identification of data subjects for no longer than is necessary.
- Not transferred outside the Republic of Kenya unless safe and adequate data protection safeguards are verified.
2. Personal & Sensitive Data We Collect
To fulfill your prescriptions and process medical orders, we collect different categories of data:
- Identity Data: Full name, date of birth, gender, and national identification details (when verifying prescriptions).
- Contact Data: Shipping address, billing address, active email address, and phone number (primarily Safaricom M-Pesa contact number).
- Health & Clinical Data (Sensitive Personal Data): Under Section 2 of the Kenya Data Protection Act, health details are classified as Sensitive Personal Data. This includes:
- Scanned copies or clear photographs of medical prescriptions uploaded by you.
- Medical history and clinical notes related to chronic conditions (if you choose to register for our chronic condition registry).
- Details of medications ordered and therapeutic dosage forms.
- Inquiries made directly to our licensed pharmacists.
- Transaction & Billing Data: Payment method selected (such as M-Pesa reference details), items ordered, transaction totals, and payment status. Please note: We do not directly store credit/debit card numbers; they are securely processed by PCI-DSS compliant third-party gateways.
- Technical & Usage Data: IP address, device operating system, browser type, and navigation paths on our website.
3. How We Use Your Data
We process your data for the following legitimate purposes:
- Order Processing: Managing shopping carts, preparing medication, processing M-Pesa payments, and generating invoices.
- Clinical & Legal Verification: Enabling our licensed on-duty pharmacists to review and verify uploaded prescriptions prior to the dispatch of prescription-only (Rx) medications.
- Delivery Fulfillment: Providing physical addresses and phone contacts to our trusted internal riders or partner courier services to execute order delivery.
- Chronic Care Program: Managing specialized delivery schedules and reminders for patients registered under our chronic condition care program.
- Communications: Sending order status updates, delivery alerts, pharmacist consultations, and critical health advisories.
4. Data Storage, Security, & Retention
We implement industry-standard administrative, physical, and digital security measures:
- Database Security: All transactional and customer data is securely housed in Supabase databases. We utilize Row Level Security (RLS) policies to guarantee that only you can access your personal address, profile, and order records.
- File Encryption: Uploaded medical prescriptions are stored in private Supabase Storage buckets. Access keys are strictly limited to authorized pharmacists on duty and are never made publicly reachable.
- Data Retention: We retain clinical records, including prescription files and transaction details, in accordance with the regulations set by the Pharmacy and Poisons Board of Kenya and standard medical records retention acts (typically 6 years). Non-essential data is erased or fully anonymized once it is no longer required.
5. Third-Party Data Sharing
We do not sell, rent, or trade your personal or health data to third-party marketing companies. We only share essential, scoped data with trusted service providers to run our operations:
- Payment Processors: Core payment details are shared with Safaricom (M-Pesa API) or credit card processors to authenticate and complete your payment transaction.
- Delivery riders/Couriers: Name, delivery address, and phone number are shared to ensure successful package delivery. We restrict drivers from utilizing your personal data for any purpose other than executing the specific delivery.
- Legal Authorities: We may share information if mandated by law, court order, or if requested by the Pharmacy and Poisons Board of Kenya during official clinical audits.
6. Your Legal Rights under the Act
Under the Kenya Data Protection Act 2019, you have robust rights regarding your personal and sensitive data. These include:
- Right to be Informed: To know what personal data we collect, why we collect it, and who we share it with.
- Right to Access: To request a free digital copy of all personal and health records we maintain about you.
- Right to Rectification: To request immediate corrections to inaccurate, outdated, or incomplete details in your account profile.
- Right to Erasure (Right to be Forgotten): To request that we delete your personal and transactional information, subject to overriding statutory obligations (e.g. pharmacy regulation laws mandating medical prescription record keeping).
- Right to Object/Restrict Processing: To restrict or withdraw your consent to the processing of your data at any time.
7. Cookie Policy
We utilize small files known as cookies to maintain your active shopping cart state, store user preferences (like recently searched items), and analyze site traffic patterns. You can manage or disable cookies in your web browser preferences; however, disabling them may prevent you from adding items to your cart or checking out.
8. Contact Our Data Protection Officer (DPO)
If you wish to exercise any of your statutory rights, raise a privacy concern, or request access to your records, please contact our designated Data Protection Officer:
Data Protection Officer
PrimeCare Pharmacy Ltd
Email: dpo@primecare.co.ke
Alternative contact: info@primecarepharmacy.co.ke
Phone: +254 715 512 386
HQ Address: Westlands Road, Nairobi
You also have the right to lodge a formal complaint directly with the Office of the Data Protection Commissioner of Kenya (ODPC) via their official channels if you believe your data rights have been infringed.