Data Processing Agreement.

Effective October 2026 · Aligned with the Kenya Data Protection Act, 2019

This agreement ("DPA") forms part of your Dispensely subscription. It governs how we process personal data on your behalf. Because a pharmacy records patient health information — sensitive personal data under the Act — this document exists so that both sides' obligations are explicit, not implied.

1. Roles and scope

You (the pharmacy) are the Data Controller. You decide what patient, staff and business data goes into the system and why. Dispensely is the Data Processor. We process that data only to provide the subscribed service and only on your documented instructions, which include your configuration choices, the features you use, and written support requests.

Subject matter: pharmacy operations data, including sales, stock, supplier and expense records; staff account data; and patient contact, refill and care-note data entered by your pharmacist or manager roles. Duration: the life of your subscription, plus the 30-day export window after cancellation.

2. Our obligations as processor

• Instructions only. We process personal data only on your documented instructions, never for our own purposes, and never sell or share it for third-party use.
• Confidentiality. Access to production data is limited to named engineers bound by confidentiality obligations.
• Security. Per-shop isolated databases; encryption in transit; server-side role-based access (patient records restricted to pharmacist and manager roles); individual logins with a full audit trail; regular encrypted backups.
• Data subject rights. We assist you in honouring access, correction, deletion and objection requests, for example when a patient asks what you hold on them.
• Breach notification. If we become aware of a personal-data breach affecting your shop, we notify you without undue delay, and in any case within 72 hours, with what happened, what data is affected, and the mitigation taken, so you can meet your own duty to notify the ODPC where required.
• Deletion at the end. When your subscription ends, you get 30 days to export everything, after which we delete your data from production systems; encrypted backups age out within a further 90 days. On request we confirm deletion in writing.

3. Sub-processors

We use a small set of sub-processors strictly to deliver the service: cloud hosting infrastructure, Safaricom M-Pesa and PesaPal (payment processing), and SMS/WhatsApp gateways (only for messages you choose to send). Invoice data flows to KRA/eTIMS only when you submit it. We keep this list current on this page and give you 14 days' notice before adding a new sub-processor, during which you may object. Where a sub-processor handles data outside Kenya, we ensure safeguards consistent with the Act.

4. Your obligations as controller

• Ensure you have a lawful basis for the patient data you record, and that patients are informed (a short notice at your counter is usually enough, and we can provide wording).
• Keep your PPB registration and professional licences current; regulatory compliance of the pharmacy itself is outside this DPA.
• Manage your users honestly: individual logins, correct roles, prompt removal of leavers.
• Tell us if a data subject exercises their rights so we can assist within the legal timelines.

5. Audits and enquiries

You may ask us, once per year, reasonable written questions about our processing and security measures, and we will answer in writing. Where the Act or the ODPC requires more, we will cooperate with the regulator directly.

6. Liability and precedence

Liability under this DPA is subject to the caps in the Terms of Service. If this DPA conflicts with the Terms of Service or the Privacy Policy on a data-protection point, this DPA wins.