LifeMed Pharmacy Limited ("we", "us", "our") is committed to protecting your privacy and personal data. This Privacy Policy describes how we collect, use, store, and share your information when you use our services.

We process personal data in accordance with the Data Protection Act, 2019 (No. 24 of 2019) of Kenya.

2.1 Information You Provide

• Account Information: Name, email address, phone number
• Delivery Information: Physical address, delivery instructions
• Payment Information: M-Pesa number, card details (processed by payment providers)
• Health Information: Prescriptions, medication history, and any symptoms or health concerns you choose to describe when booking a consultation (with your consent)
• Communications: Customer support inquiries, feedback

2.2 Information Collected Automatically

• Device Information: Device type, operating system, browser type
• Usage Data: Pages visited, products viewed, search queries
• Location Data: Approximate location for delivery (with permission)
• Log Data: IP address, access times, referring URLs

2.3 WhatsApp Enquiries

When you tap a WhatsApp button on this website, we record the enquiry so we can answer it and measure how well our branches respond. We record this at the moment you tap, before you are handed over to WhatsApp:

• What you were asking about: the products in your basket, their quantities and prices, or the single product you were viewing
• Which branch the message was addressed to, and which page you tapped from
• A reference code included in your message, so the branch can link your order back to your enquiry
• Your device and network: IP address and browser identification
• Your account, if you were signed in at the time

We do not receive, read or store the conversation itself. What you type in WhatsApp is between you and the branch, and is governed by WhatsApp's own privacy policy. This record is kept indefinitely as a business record of enquiries and orders. You can ask us to delete it at any time using the contact details below.

2.4 Sensitive Personal Data

We use your information for the following purposes:

3.1 Service Delivery

• Processing and fulfilling your orders
• Verifying prescriptions with healthcare providers
• Coordinating delivery or pickup
• Processing payments and refunds

3.2 Communication

• Sending order confirmations and receipts by email
• Responding to your inquiries and support requests
• Sending important service announcements
• Marketing communications (only with your consent)

3.3 Improvement & Safety

• Analyzing usage patterns to improve our services
• Preventing fraud and ensuring platform security
• Complying with legal and regulatory requirements
• Pharmacovigilance and adverse event reporting (as required by law)
• Measuring how quickly and how well our branches answer WhatsApp enquiries, and whether they led to an order

Under the Kenya Data Protection Act, 2019, we process your data based on the following legal grounds:

We may share your information with:

5.1 Service Providers

• Delivery Partners: Name, address, phone number for order delivery
• Payment Processors: Safaricom (M-Pesa), card processors for transactions
• Cloud Services: Secure data storage and hosting

5.2 The LifeMed branch handling your consultation

When you book a consultation, the LifeMed branch that will contact you receives your booking reference, the format you chose, your preferred date and time, your name and your phone number, so that they can reach you. Anything you write in the symptoms field is not included in that email — it is stored securely and read by the pharmacist handling your booking when they open it. Describing your symptoms is optional.

5.3 Healthcare Providers

We may contact prescribing doctors to verify prescriptions. We share only the minimum information necessary for verification.

5.4 Legal & Regulatory Bodies

• Pharmacy and Poisons Board (regulatory compliance)
• Kenya Revenue Authority (tax obligations)
• Law enforcement (when legally required)
• Courts (in response to valid legal process)

5.5 Data Processing Agreements

All third parties who process data on our behalf are bound by data processing agreements that ensure they protect your information to the same standard we do.

We retain your data for as long as necessary for the purposes described in this policy, or for as long as the law requires. Most categories have a fixed period; one is held indefinitely and is marked as such below.

Where a retention period is given above, data is securely deleted or anonymised once it ends. WhatsApp enquiry records are the exception: they are kept as an ongoing business record of enquiries and orders, and are deleted when you ask us to.

We implement comprehensive security measures to protect your personal data:

7.1 Technical Measures

• Encryption: All data transmitted using TLS 1.3 encryption
• Secure Storage: Data at rest encrypted using AES-256
• Access Controls: Role-based access with multi-factor authentication
• Regular Audits: Penetration testing and security assessments

7.2 Organizational Measures

• Staff training on data protection and confidentiality
• Strict access policies limiting data access to authorized personnel
• Incident response procedures for potential breaches
• Regular review and update of security policies

7.3 Data Breach Notification

Under the Kenya Data Protection Act, 2019, you have the following rights:

How to Exercise Your Rights

Submit requests to our Data Protection Officer at info@lifemedpharmacyonline.co.ke. We will respond within 30 days. You may be required to verify your identity.

Right to Complain

If you believe your data protection rights have been violated, you have the right to lodge a complaint with the Office of the Data Protection Commissioner (ODPC) at www.odpc.go.ke.

Our services are not directed to individuals under 18 years of age. We do not knowingly collect personal data from children.

If you are a parent or guardian and believe your child has provided us with personal information, please contact us immediately. We will take steps to delete such information.

Your data is primarily stored and processed in Kenya. In some cases, data may be transferred to countries outside Kenya for processing by our service providers.

When transferring data internationally, we ensure appropriate safeguards are in place:

• Standard contractual clauses approved by the ODPC
• Adequacy decisions (transfers to countries with adequate protection)
• Your explicit consent for specific transfers

You may contact us for information about the specific safeguards applied to international transfers of your data.

For any questions about this Privacy Policy or to exercise your data protection rights, please contact:

Policy Updates

We may update this Privacy Policy from time to time. Material changes will be notified via email or prominent notice on our platform. Continued use of our services after changes constitutes acceptance of the updated policy.