This Privacy Policy explains what personal data Supreme Pharmacy LTD ("Supreme Pharmacy", "we", "us") collects when you use our website, WhatsApp ordering, or in-store services, why we collect it, who we share it with, and the rights you hold over it. It is written to comply with the Data Protection Act, 2019 (Laws of Kenya) and the guidance of the Office of the Data Protection Commissioner (ODPC). Health information receives the additional protection the Act gives to sensitive personal data.
1. Who is responsible for your data
Supreme Pharmacy LTD is the data controller for the information described here. That means we decide why your data is collected and how it is used, and we are accountable to you and to the ODPC for both.
- Address: Pioneer Plaza, Mburu Gichua Road, Near Jamia Mosque, Nakuru, Kenya
- Email: supremepharmacy@ymail.com
- Phone / WhatsApp: +254 706 124 102
2. What we collect
2.1 Information you give us
- Your name, phone number, email address and delivery location when you place an order or create an account.
- Prescription images and the details on them, where you upload one for a prescription-only medicine.
- The contents of messages you send us on WhatsApp, by email, or through the site.
- Reviews you submit about products you have bought.
2.2 Information collected automatically
- Pages you visit and products you view, so the shop can show what is relevant and we can see what is not working.
- Device and browser information, and the approximate location your network reports.
- A location you deliberately share when asking for a delivery quote — we use the coordinates to measure distance, and we do not track you.
2.3 What we do not collect
- Card numbers. Payments are handled by M-Pesa and our payment providers; we receive confirmation of a payment, not your credentials.
- Any health information beyond what you choose to tell us or what appears on a prescription you send.
3. Why we use it, and on what basis
- To fulfil an order, deliver it, and handle returns — necessary to perform our contract with you.
- To dispense a prescription safely and keep the dispensing records the Pharmacy and Poisons Act requires — a legal obligation, and the protection of your vital interests.
- To answer your questions and provide pharmacist advice — our legitimate interest in serving customers who ask.
- To send marketing messages — only with your consent, which you may withdraw at any time.
- To detect fraud, abuse and repeat non-payment — our legitimate interest in operating safely.
4. Health data and prescriptions
A prescription tells us something about your health, and the Data Protection Act treats that as sensitive personal data. We handle it accordingly: prescription images are visible only to pharmacy staff who need them to dispense your order, they are never used for marketing, and they are never sold or shared with advertisers.
We keep dispensing records for the period the Pharmacy and Poisons Board requires, even where you ask for deletion, because retaining them is a legal obligation we cannot waive.
5. Who we share it with
We do not sell your personal data, and we do not share it with advertisers.
- Riders and courier partners — the name, phone number and delivery location needed to bring your order to you, and nothing else.
- Payment providers, including Safaricom M-Pesa, to take and confirm payment.
- Technology providers who host the site and store our data under contract, bound to use it only on our instructions.
- Regulators and law enforcement where we are legally obliged to disclose, including the Pharmacy and Poisons Board.
6. Where your data is held
Our systems are hosted with providers that may store data outside Kenya. Where data leaves the country we rely on the safeguards the Data Protection Act requires, including contractual commitments that the recipient will protect it to the same standard. You may ask us which providers are involved.
7. How long we keep it
- Order and delivery records: seven years, for tax and accounting purposes.
- Prescription and dispensing records: for the period required by the Pharmacy and Poisons Board.
- Account details: while your account is open, and for a short period afterwards in case you return.
- Marketing consents: until you withdraw them.
- Website analytics: no longer than twenty-six months.
8. Your rights
Under the Data Protection Act, 2019 you may ask us to give you a copy of your data, correct it, delete it, restrict or object to how we use it, or send it to another provider. You may also withdraw consent at any time where we relied on it.
Write to supremepharmacy@ymail.com and we will respond within the statutory period. There is no charge for a reasonable request. If you are not satisfied with our answer you may complain to the Office of the Data Protection Commissioner.
9. Keeping it secure
Access to customer records is restricted to staff whose work requires it, traffic to the site is encrypted, and prescription uploads are stored separately from general order data. No system is perfect: if a breach ever affects your rights and freedoms, we will notify you and the ODPC as the Act requires.
10. Children
Our services are intended for adults. We do not knowingly collect data from a child without the consent of a parent or guardian. A parent ordering for a child may of course give us the details needed to dispense safely.
11. Changes to this policy
We may update this policy to reflect changes in the law or in how we work. The effective date above always shows the version in force, and material changes will be announced on the site.