Data Protection Policy

This policy is structured in accordance with Kenya's Data Protection Act, 2019.

Last updated: 19 September 2026.

1. Data controller identity

The data controller responsible for the personal data described in this policy is Edward Mwaniki Njeru, trading as ADOH THREE SIXTY SOLUTIONS, P.O. Box 1583-20300, Nyahururu, Kenya — a business name registered under the Registration of Business Names Act, under which the named proprietor trades. You can reach us at contact@adohpharma.com or by post at the address above.

2. Registration with the Office of the Data Protection Commissioner (ODPC)

The Data Protection Act, 2019 requires data controllers and data processors to register with the Office of the Data Protection Commissioner. AdohPharma acts in both capacities: as a data controller for the pharmacy staff account data described in section 4, and as a data processor for the patient and customer data a pharmacy enters into the platform. Where registration is required of us, we will obtain it and keep it current for as long as we process personal data.

AdohPharma is pending registration with the Office of the Data Protection Commissioner as a data controller and a data processor. An application was filed with the Office on 13 September 2026 and is awaiting its determination. No registration reference has been issued to us yet, so this policy states none, and nothing on this page should be read as claiming that our registration is complete. We will publish the reference here when it is issued. To ask where our registration stands in the meantime, write to dpo@adohpharma.com or contact@adohpharma.com and we will tell you. Registrations that have been issued also appear on the ODPC's own register, reachable from www.odpc.go.ke.

3. Lawful basis for processing

We process personal data only where we have a lawful basis under the Act. Depending on the activity, the basis will be one of the following:

• Consent — where you have given clear, informed agreement to a specific use of your data.
• Performance of a contract — where processing is necessary to provide the AdohPharma service you or your employer has subscribed to.
• Legal obligation — where processing is required to comply with a law or regulatory duty.
• Legitimate interests — where processing supports the secure and effective operation of the service and does not override your rights and freedoms.

4. Categories of personal data processed

As a controller, AdohPharma directly processes pharmacy staff account data, including name, email address, and assigned role, in order to operate user accounts and secure access to the platform.

Any patient or customer data that a pharmacy enters into the platform remains under the control of that pharmacy. In relation to such data, AdohPharma acts as a data processor and processes it only on the documented instructions of the pharmacy as the controller.

5. Data-subject rights under the Act

Subject to the conditions in the Act, data subjects have the following rights:

• Access — to be informed of and obtain a copy of the personal data we hold about you.
• Rectification — to have inaccurate or incomplete data corrected.
• Erasure — to request deletion of data where there is no lawful reason to retain it.
• Restriction of processing — to limit how we use your data in certain circumstances.
• Data portability — to receive your data in a structured, commonly used format.
• Objection — to object to processing based on legitimate interests.

To exercise any of these rights, contact our Data Protection Officer at dpo@adohpharma.com. Where AdohPharma acts as a processor for pharmacy-controlled data, we will direct your request to the relevant pharmacy.

5.1 Exercising access, portability and erasure in the app

A subscribing pharmacy does not need to write to us to exercise access, portability or erasure over its own account. Both are built into the product, under Settings → Data, and are available to an account owner:

• Export — produces a single archive containing every operational record the pharmacy holds in AdohPharma, as one CSV file per record type plus a machine-readable manifest, together with the prescription images stored against its dispensing register. The archive lists, file by file, what it deliberately omits. Sign-in credentials (password hashes, two-factor secrets and session tokens) and saved payment-provider secrets are excluded: releasing them would weaken the security of the account rather than serve a data right. The download link can be used once and expires after 24 hours.
• Deletion — an owner may delete the pharmacy's account. Nothing is deleted immediately: the request opens a 30-day period during which the pharmacy continues to operate normally and any owner may cancel. After that period we permanently delete the pharmacy's products, batches, stock movements, sales, payments, patient records, dispensing register and its prescription images, suppliers, purchase and payables records, staff records and audit trail, including the underlying files in storage. We do not retain a copy. The app requires an export to have been taken, or the owner to have explicitly declined one, before a deletion request is accepted.

What we keep after deletion. Four things survive the deletion, and none of them contains patient, stock, sales or staff data.

• A minimal record that the account existed — its identifier, its name, its country, and the date it was deleted — kept so that we can answer billing questions, resolve payment disputes and meet our own accounting obligations after an account has closed.
• Where we have taken enforcement action against an account, the finding and the action we took. A record of enforcement must not be erasable by closing the account it concerns, or closing and reopening an account would be a way to launder it. This is our record rather than the pharmacy's: the pharmacy can neither read nor export it.
• The hashed signals recorded when the account first signed up. They are hashed at the moment they are captured and hold no readable personal data — no raw network address and no device string — and they are kept so that closing an account cannot be used to open another one unrecognised.
• Any feedback left about AdohPharma itself, with the links to the pharmacy and to the person who wrote it removed, so what remains is anonymous product feedback rather than a record of your account.

Individual patients. Deletion in the app is account-level and is exercised by the pharmacy. A patient wishing to exercise erasure over their own records should contact the pharmacy that holds them, which is the controller for that data; the pharmacy can then remove the patient's record. Non-payment of a subscription is never treated as a deletion request, and we do not delete a pharmacy's data because an account has lapsed.

6. Data retention periods

We retain personal data only for as long as necessary. What is implemented today:

• When an owner requests deletion of their pharmacy, the account is scheduled for erasure 30 days later. The delay is deliberate — it is the window in which the request can be withdrawn — and after it runs, the pharmacy’s records are removed.
• Otherwise, account data, operational records, and audit and sync logs are retained for the life of the account. We do not currently run automated deletion against them.

Category-by-category retention periods have not been set yet. This section states what the system actually does rather than a period we have not implemented, and it will be updated when those periods are defined and enforced.

7. Cross-border transfer of personal data

In line with Sections 48 and 49 of the Act, personal data is transferred outside Kenya only where there is an adequacy finding, appropriate safeguards such as contractual clauses are in place, or the data subject has given consent. The pharmacy records themselves — the database and the application servers — are hosted in South Africa, in the Cape Town region.

Transfers outside Kenya are not hypothetical and are not only future: some personal data is processed in the United States today by the service providers we use for payments, email, SMS, background jobs and file storage. Those providers are listed in section 5 of our Privacy Policy. South Africa and the United States are the two countries declared in our data-handler registration. Any further transfer will be assessed against the requirements above before it takes place.

8. Data security measures

We apply technical and organisational measures designed to protect personal data, including encryption of data in transit and at rest, access controls, and role-based permissions that limit data to authorised users. Our offline-sync mechanism is designed to preserve the integrity of records synchronised between devices and the platform. AdohPharma holds no formal information-security certification, and nothing in this section should be read as claiming one.

9. Biometric data note

Biometric data is classified as sensitive personal data under the Act. Fingerprint attendance is not a current AdohPharma feature. If such a feature is ever introduced, we would first obtain explicit consent and complete a Data Protection Impact Assessment (DPIA) before launch, in keeping with the requirements of the Act.

10. Complaints and contact

For any questions or concerns about how we handle personal data, contact our Data Protection Officer at dpo@adohpharma.com. You also have the right to lodge a complaint with the Office of the Data Protection Commissioner. Details of how to do so are available from the ODPC atwww.odpc.go.ke.