Privacy Policy.

Effective October 2026 · Applies to all Dispensely shops in East Africa

Dispensely is a retail pharmacy point-of-sale and operations system. This policy explains what data we handle, why, and the controls around it. It is written in line with the Kenya Data Protection Act, 2019, and we apply the same standard in every country we operate in.

1. Who is responsible for what

Two roles matter here. The pharmacy (our customer) is the Data Controller: it decides why and how data about its patients, staff and sales is processed. Dispensely is the Data Processor: we store and process that data on the pharmacy's documented instructions, through the software. For the data we collect to run our own business (billing contacts, support conversations), Dispensely acts as the controller.

2. What data we handle

• Account & billing data : shop name, branch, owner name, phone, email, M-Pesa and card payment references.
• Staff user accounts : names, logins, roles (cashier, pharmacist, manager, accountant), and a full activity audit trail.
• Shop operations data : products, batches, stock counts, purchases, sales, shifts, controlled-drug (DDA) register entries, expenses and the money split.
• Patient data entered by the pharmacy : phone numbers, refill schedules and care notes (e.g. blood pressure, glucose readings). This is health data, treated as sensitive personal data under the Act, and processed strictly on the pharmacy's instructions.
• Technical logs : login events, device/browser metadata and error logs used to keep the service secure and reliable.

3. What we use it for

• Providing the service: till, stock, patients, insurers and the books.
• Billing the subscription (M-Pesa or card) and the one-time onboarding fee.
• Support, onboarding and the monthly scorecard / VAT-watch emails the pharmacy opts into.
• Improving the product: using aggregated, de-identified statistics only.

4. What we never do

• We never sell any data, whether patient, sales or otherwise.
• We never share patient data with third parties for their own purposes.
• We never use your shop's data for anything other than running your shop, and never to benefit another pharmacy.
• Staff inside a shop see only what their role allows. Patient records are limited to pharmacist and manager roles; cashiers never see them. This is enforced on the server, not just on screen.

5. How the data is protected

• Each shop runs on its own isolated database.
• All traffic is encrypted in transit (HTTPS).
• Role-based access with per-user logins (no shared accounts) and an audit trail on every sale, price change and stock adjustment.
• Regular encrypted backups, and access to production data limited to named engineers under confidentiality obligations.

6. Who we share data with

Only the service providers needed to run your shop, and only on your instructions: Safaricom M-Pesa and PesaPal (payments), SMS/WhatsApp providers (receipts and refill nudges you choose to send), and KRA/eTIMS (invoice data you choose to submit). Where any provider processes data outside your country, we ensure safeguards consistent with the Data Protection Act.

7. Retention, export and deletion

Your data is yours while you subscribe. You can export everything (stock, sales, patients and books) in standard formats at any time. If you cancel, we keep your data available for export for 30 days, then delete it from production systems; encrypted backups age out within a further 90 days. You can ask us to delete specific records (for example, a patient who requests it) at any time.

8. Your rights

Under the Kenya Data Protection Act, 2019, individuals have the right to be informed, to access their data, to correction, to deletion, and to object to processing. Patients should direct these requests to their pharmacy (the controller); we assist the pharmacy in honouring them. You may also lodge a complaint with the Office of the Data Protection Commissioner (ODPC).

9. Changes & contact

We will post any change to this policy on this page and give active customers at least 14 days' notice by email before material changes take effect. Questions about privacy: reach us through the support channel provided in your onboarding pack.