Privacy Policy

How AdohPharma collects, uses, and protects personal data for pharmacies and their staff who use the service.

Last updated: 13 September 2026.

1. Who we are

AdohPharma is a pharmacy inventory and expiry-tracking service operated by Edward Mwaniki Njeru, trading as ADOH THREE SIXTY SOLUTIONS, P.O. Box 1583-20300, Nyahururu (“AdohPharma”, “we”, “us”), business name registration BN-8DSZY27P. For data relating to your account and your pharmacy staff, AdohPharma acts as the data controller. You can reach our data protection contact at dpo@adohpharma.com.

2. What data we collect

We collect the information needed to provide the service, including:

Account data — names, email addresses, roles, and authentication details for pharmacy staff who sign in.
Pharmacy and inventory data — product records, batch numbers, expiry dates, and stock levels entered into the platform.
Usage and device data — logs, approximate location, and diagnostic information generated when you use the service.
Product usage data — a fixed, limited set of events recording which parts of the service are used and when: sign-up and set-up milestones, which sections of the dashboard are opened, that a sale, purchase, stock take or write-off was recorded, and that a synchronisation or page error occurred. These events carry your account identifier, your role, counts (such as the number of lines on a sale), and technical details about your device and browser supplied by our analytics provider. They never carry patient or customer names, phone numbers, product names, batch numbers, quantities dispensed, or prices, and web addresses are reduced to a page template before being sent, so anything typed into a search box is removed. The service does not record your screen, does not record your clicks or mouse movement, and does not automatically capture the contents of the pages you view.
Feedback you send us — the message and category you submit through the in-app feedback form, together with your account identifier, your pharmacy, the page you were on, and the software version. The message is free text, so please do not include patient or customer details in it.
Account integrity data — registration details such as pharmacy licence or registration numbers, and technical signals recorded when an account is created, including network address and browser information. Network address and browser information are stored in hashed form so they can be compared between accounts without being read back.

Where a pharmacy records information about its own patients or customers, that pharmacy is the data controller for that information and AdohPharma acts only as a data processor, handling it on the pharmacy’s instructions.

3. How we use data

We use personal data to create and secure accounts, deliver inventory and expiry-tracking features, provide support, send service notifications, and improve the reliability and performance of the platform. We do not sell personal data.

We also use account integrity data to prevent misuse of the service — in particular, to detect where the same pharmacy has registered more than once in order to obtain or extend a free trial or promotional period, as described in our Acceptable Use Policy. These signals are indicative only: they are reviewed by a person before any action is taken on an account, and they are never used to make an automated decision about you.

4. Legal basis for processing

Depending on the activity, we rely on one or more lawful bases under Kenya's Data Protection Act, 2019: performance of our contract with your pharmacy, our legitimate interests in operating and securing the service, compliance with legal obligations, and, where required, your consent. What each basis covers is set out in section 3 of our Data Protection Policy.

5. Data sharing and third parties

We share data with service providers who help us run AdohPharma under appropriate agreements. Today those are Vercel (application hosting), Amazon Web Services (database, hosted in South Africa), Vercel Blob (file storage), Polar (subscription billing), Safaricom (M-Pesa payments, where that rail is used), Resend (email), Twilio (SMS and WhatsApp reminders, where enabled), Inngest (scheduled and background processing), and Google (only if you choose to sign in with a Google account). We may also disclose data where required by law.

AdohPharma integrates PostHog as its product analytics processor, on European Union infrastructure, to understand how the service is used. It is currently switched off in production, and while it is, no analytics data leaves your browser and the vendor script is never loaded. Were it enabled, the categories of data sent would be the product usage data described in section 2: your account identifier, your role, the names of the events listed there and their non-identifying properties (counts, categories, and whether the device was offline), page addresses reduced to a page template, and standard device, browser and approximate location information derived by PostHog from the connection. No patient or customer records, product records, batch numbers or prices are sent to PostHog. PostHog also stores an identifier in your browser so repeat visits can be counted as one person; see our Cookie Policy. Analytics is switched off entirely in deployments where it has not been configured, in which case no data is sent to PostHog at all.

6. Data retention

We keep personal data only for as long as needed to provide the service and to meet legal, accounting, or reporting obligations, after which it is deleted or anonymised. One period is fixed today: when an owner asks us to delete their pharmacy, the account is scheduled for erasure 30 days later, and that window exists so the request can be withdrawn before anything is destroyed. Beyond that, we do not yet run automated deletion on operational records and audit history — they are kept for the life of the account. Specific periods for each category are still being set, and this section will be updated when they are.

7. Your rights

Subject to applicable law, you may have the right to access, correct, delete, or export your personal data, to object to or restrict certain processing, and to withdraw consent. To exercise these rights, contact us at dpo@adohpharma.com. Where AdohPharma acts as a processor, requests relating to patient or customer data should be directed to the relevant pharmacy.

8. Cookies

We use cookies and similar technologies to keep you signed in and to understand how the service is used. For details on the cookies we set and how to manage them, see our Cookie Policy.

9. Security measures

We use technical and organisational measures — including encryption in transit, access controls, and role-based permissions — to protect personal data. No system is completely secure, and these measures are described as product intent for this preview build.

10. Changes to this policy

We may update this policy from time to time. Material changes will be communicated through the service or by email, and the “last updated” date above will be revised. This policy takes effect on 13 September 2026.

11. Contact us

For any questions about this policy or how we handle personal data, contact our data protection contact at dpo@adohpharma.com or write to Edward Mwaniki Njeru, trading as ADOH THREE SIXTY SOLUTIONS, P.O. Box 1583-20300, Nyahururu.

1. Who we are

2. What data we collect

We collect the information needed to provide the service, including:

Account data — names, email addresses, roles, and authentication details for pharmacy staff who sign in.

Pharmacy and inventory data — product records, batch numbers, expiry dates, and stock levels entered into the platform.

Usage and device data — logs, approximate location, and diagnostic information generated when you use the service.

Product usage data — a fixed, limited set of events recording which parts of the service are used and when: sign-up and set-up milestones, which sections of the dashboard are opened, that a sale, purchase, stock take or write-off was recorded, and that a synchronisation or page error occurred. These events carry your account identifier, your role, counts (such as the number of lines on a sale), and technical details about your device and browser supplied by our analytics provider. They never carry patient or customer names, phone numbers, product names, batch numbers, quantities dispensed, or prices, and web addresses are reduced to a page template before being sent, so anything typed into a search box is removed. The service does not record your screen, does not record your clicks or mouse movement, and does not automatically capture the contents of the pages you view.

Feedback you send us — the message and category you submit through the in-app feedback form, together with your account identifier, your pharmacy, the page you were on, and the software version. The message is free text, so please do not include patient or customer details in it.

Account integrity data — registration details such as pharmacy licence or registration numbers, and technical signals recorded when an account is created, including network address and browser information. Network address and browser information are stored in hashed form so they can be compared between accounts without being read back.

3. How we use data

4. Legal basis for processing

5. Data sharing and third parties

6. Data retention

7. Your rights