Privacy Policy

Effective Date: 1 September 2026

Last Updated: 1 September 2026

What This Means for You

When you use Jasmine Pharmacy, you may share personal information and health information with us. We take that responsibility seriously.

This Privacy Policy explains what information we collect, why we collect it, how we use and protect it, when we may share it, how long we retain it, and the rights available to you under Kenyan law.

We collect and use personal data only for lawful and legitimate purposes connected with providing our pharmacy services, including receiving and verifying prescriptions, dispensing chronic-care medication, arranging delivery, communicating with you, maintaining appropriate records, processing payments, protecting our systems, and complying with legal and professional obligations.

We do not sell, rent, or trade your personal data. We do not use your health information for advertising or direct marketing without an appropriate lawful basis and, where consent is required, your consent.

Jasmine Pharmacy operates under Kenyan law, including the Data Protection Act, 2019, the Data Protection (General) Regulations, 2021, the Data Protection (Registration of Data Controllers and Data Processors) Regulations, 2021, the Pharmacy and Poisons Act (Cap. 244) and applicable regulations and professional requirements, the Health Act, 2017, the Consumer Protection Act, 2012, the Digital Health Act, 2023, the Digital Health (Health Information Management Procedures) Regulations, 2025, and other applicable Kenyan laws and regulatory requirements.

If anything in this Privacy Policy is unclear, please contact us using the details at the end of this policy.

1. Who We Are and Why This Policy Exists

Jasmine Dental and Medical Centre LLP, trading as Jasmine Pharmacy ("Jasmine Pharmacy", "we", "us", or "our"), provides specialist chronic-care pharmacy services in Kenya.

Jasmine Pharmacy dispenses prescription medicines for chronic conditions within its licensed pharmacy scope. Prescription medicines are not dispensed unless the prescription has been received and verified by an appropriately qualified pharmacist in accordance with applicable Kenyan law and professional requirements.

For purposes of the Kenya Data Protection Act, Jasmine Pharmacy is responsible for determining the purposes and means for which personal data is processed in connection with its pharmacy services and therefore acts as a data controller for the relevant processing activities.

This Privacy Policy applies to personal data processed when you:

submit a prescription to Jasmine Pharmacy;
request or receive pharmacy services;
communicate with us by telephone, WhatsApp, email, our website, or another channel we make available;
arrange payment for pharmacy services;
request delivery or provide delivery information;
communicate with our pharmacists or other members of our team;
visit our website or interact with its digital features; or
otherwise interact with Jasmine Pharmacy in connection with its services.

This policy applies to patients and, where applicable, caregivers, parents, guardians, authorised representatives, and website visitors.

2. The Legal Framework We Operate Under

Our processing of personal data is governed by applicable Kenyan law.

The principal legal and regulatory frameworks relevant to our services include:

Data Protection Act, 2019;
Data Protection (General) Regulations, 2021;
Data Protection (Registration of Data Controllers and Data Processors) Regulations, 2021;
Pharmacy and Poisons Act (Cap. 244) and applicable regulations and professional requirements;
Health Act, 2017;
Digital Health Act, 2023;
Digital Health (Health Information Management Procedures) Regulations, 2025;
Consumer Protection Act, 2012;
Computer Misuse and Cybercrimes Act, 2018; and
other applicable Kenyan legislation, regulations, standards, professional requirements, and lawful directions of competent authorities.

Where a particular processing activity is subject to a more specific legal or regulatory requirement, we will apply the requirements relevant to that activity.

The Digital Health Act recognises health data as a distinct category of information and establishes principles including privacy, confidentiality, security, accuracy, equity, and accountability in the management of health data.

3. What Personal Data We Collect

We collect only personal data that is reasonably necessary for the purposes described in this policy.

The exact information we collect depends on how you interact with Jasmine Pharmacy and the services you request.

3.1 Identity and Contact Information

This may include:

full name;
date of birth;
telephone number;
email address;
physical or delivery address;
identification information where reasonably necessary to verify identity or fulfil a legal, pharmacy, delivery, or security requirement;
information concerning a caregiver, guardian, authorised representative, or emergency contact where relevant; and
other contact details you voluntarily provide.

We do not routinely collect an identification document merely because you use our website. Where identity verification is necessary, we will request information appropriate to the particular purpose.

3.2 Prescription and Health Information

Because Jasmine Pharmacy provides healthcare-related pharmacy services, we may process sensitive personal data relating to your health.

This may include:

prescriptions you submit;
the name, strength, dosage, form, frequency, quantity, and directions of prescribed medicines;
prescribing clinician and healthcare-facility information;
information needed to verify a prescription;
information concerning chronic conditions where relevant to safe dispensing;
known allergies or adverse drug reactions that you provide;
relevant medication history;
information concerning previous dispensing;
information relevant to medication safety, including potential interactions or contraindications identified during professional review; and
other health information you provide to us for the purpose of providing pharmacy services.

Health data is subject to heightened legal and professional protections. Under section 46 of the Data Protection Act, personal data relating to health may only be processed by or under the responsibility of a healthcare provider, or by a person subject to an applicable duty of professional secrecy, subject to the statutory conditions.

3.3 Prescription Verification Information

Where necessary to verify a prescription or protect patient safety, we may communicate with:

the prescribing clinician;
the healthcare facility that issued the prescription; or
another authorised healthcare professional or provider.

The information exchanged will be limited to what is reasonably necessary for the verification or safety purpose.

3.4 Delivery Information

Where you request delivery, we may collect:

delivery name;
delivery address;
telephone number;
relevant delivery instructions;
information necessary to confirm delivery; and
information concerning failed, delayed, or disputed deliveries.

3.5 Payment and Transaction Information

Payments for Jasmine Pharmacy services may be processed through DPO PAY, our third-party payment service provider.

Where payment is processed through DPO PAY, Jasmine Pharmacy does not intend to collect or store full payment-card credentials such as a complete card number or CVV where those details are entered directly into the payment provider's payment environment.

We may receive or retain transaction-related information necessary to identify and reconcile a payment, such as:

transaction reference;
amount paid;
payment status;
date and time of transaction;
payment method category; and
other transaction metadata supplied for reconciliation or accounting purposes.

The precise information processed by DPO PAY is governed by the arrangements applicable to the payment service and DPO PAY's own privacy documentation.

3.6 Communications

We may process information contained in communications you send to us or that we send to you, including:

email correspondence;
WhatsApp messages;
telephone communications and related records where maintained;
enquiries;
prescription-related communications;
complaints and service requests; and
other communications concerning your pharmacy services.

We use this information to respond to you, provide pharmacy services, maintain appropriate records, investigate concerns, and comply with applicable obligations.

3.7 Website and Technical Information

When you visit our website, we may automatically collect limited technical information such as:

IP address;
browser type and version;
operating system or device type;
approximate technical information associated with the connection;
pages or resources requested;
date and time of access;
basic website activity information; and
information generated through cookies or similar technologies, where applicable.

We use technical information primarily to operate, secure, maintain, troubleshoot, and improve the website and to investigate suspected misuse or security incidents.

Our use of cookies is described separately in our Cookie Policy.

4. How We Collect Your Personal Data

We may collect personal data:

directly from you;
when you submit a prescription;
when you contact Jasmine Pharmacy;
when you provide information required for delivery or payment;
through communications with our pharmacy team;
from your prescribing clinician or healthcare facility where necessary and lawful;
from an authorised caregiver, guardian, or representative;
from delivery or service providers where necessary to provide the requested service;
from payment service providers in relation to payment transactions; and
automatically through your use of our website and its technical features.

We do not purchase personal data from data brokers for the purpose of building patient profiles.

We do not collect personal data speculatively. The information we request should be reasonably connected to the service or legal obligation for which it is required.

5. Why We Process Your Personal Data

We process personal data for specific and lawful purposes.

Depending on the circumstances, these purposes include the following.

5.1 Receiving and Reviewing Prescription Submissions

We process your identity, contact, prescription, and relevant health information so that our pharmacy team can receive and assess a prescription submission.

5.2 Verifying Prescriptions

We process prescription and related information to verify authenticity, completeness, validity, dosage and other relevant requirements and to identify issues that may need clarification before dispensing.

Where clarification is required, we may contact the prescribing clinician or issuing healthcare facility using only information reasonably necessary for that purpose.

5.3 Dispensing Medication Safely and Lawfully

We process prescription and relevant health information to enable an appropriately qualified pharmacist to dispense medication accurately and in accordance with applicable pharmacy law, professional requirements, and patient-safety considerations.

5.4 Maintaining Patient and Dispensing Records

We maintain records necessary for safe continuity of pharmacy services, prescription verification, dispensing, legal compliance, accountability, quality assurance, and the resolution of disputes or complaints.

5.5 Processing Payments

We process transaction information necessary to request, confirm, reconcile, document, and account for payment for pharmacy services.

5.6 Arranging Delivery

We process the minimum information necessary to prepare, dispatch, and deliver your medication.

5.7 Communicating With You

We use your contact information to communicate about:

receipt and status of a prescription submission;
prescription verification;
clarification requests;
payment;
dispensing;
dispatch and delivery;
collection arrangements where applicable;
service-related enquiries;
complaints or concerns; and
other information directly connected to the pharmacy service you have requested.

Service-related communications are not marketing communications.

5.8 Patient Safety and Professional Pharmacy Practice

We process relevant information to identify potential dispensing problems, prescription irregularities, medication-safety concerns, suspected fraud, and other issues requiring pharmacist or regulatory attention.

5.9 Security and Fraud Prevention

We may process technical, transaction, communication, and operational information to:

protect our systems;
detect unauthorised access;
investigate suspicious activity;
prevent misuse;
detect suspected prescription fraud;
protect patients and staff; and
maintain the integrity of our pharmacy services.

5.10 Legal and Regulatory Compliance

We may process and retain information where necessary to meet legal or regulatory obligations, including requirements relating to pharmacy records, taxation, consumer protection, health-data management, lawful requests from authorities, and other applicable obligations.

5.11 Service Improvement

Where appropriate and lawful, we may use information that has been aggregated, anonymised, or otherwise de-identified so that it no longer identifies an individual to analyse service performance, identify trends, improve processes, and improve our pharmacy services.

6. Lawful Basis for Processing

Under Kenyan data-protection law, personal data must be processed lawfully, fairly, transparently, for explicit and legitimate purposes, and in accordance with the requirements of the Data Protection Act and applicable regulations. We will not rely on a general legitimate-interest claim where a more specific legal basis or safeguard is required for processing health or other sensitive personal data.

Depending on the particular processing activity, the lawful basis may include:

6.1 Performance of a Contract or Steps Requested by You

We may process personal data where it is necessary to provide the pharmacy service you have requested, including receiving your prescription submission, arranging fulfilment, processing your payment, and communicating with you about the requested service.

6.2 Compliance With a Legal Obligation

We may process personal data where processing is necessary to comply with an obligation imposed by applicable Kenyan law or a lawful requirement of a competent authority.

6.3 Provision of Healthcare and Pharmacy Services

Health-related processing may occur in the course of providing healthcare and pharmacy services and under the legal and professional confidentiality obligations applicable to healthcare providers and professionals.

Kenyan law contains specific conditions governing the processing of health and sensitive personal data. We will not rely on a general commercial interest as a substitute for the specific safeguards applicable to health information.

6.4 Consent

Where consent is required by law for a particular processing activity, we will seek it in an appropriate manner.

Where processing is based on consent, you may withdraw that consent at any time, subject to the legal effect of withdrawal and to situations where we have another lawful basis for continuing the processing.

Withdrawal of consent does not invalidate processing that took place lawfully before withdrawal.

6.5 Legitimate Interests

Where permitted by Kenyan law, we may rely on legitimate interests for appropriate activities such as website security, fraud prevention, service administration, and protection of our systems, provided that the relevant legal requirements and balancing considerations are satisfied.

7. Who We Share Your Personal Data With

We do not sell, rent, or trade your personal data. If Jasmine Dental and Medical Centre LLP or Jasmine Pharmacy undergoes a lawful restructuring, merger, acquisition, financing, sale of assets, or similar business transaction, personal data may be transferred where legally permitted and subject to appropriate confidentiality and data-protection safeguards.

We may disclose personal data to the following categories of recipients where reasonably necessary, lawful, and proportionate to the relevant purpose.

7.1 Prescribing Clinicians and Healthcare Facilities

Where necessary to verify a prescription, clarify an instruction, confirm authenticity, or address a patient-safety concern, we may communicate with the prescribing clinician, issuing healthcare facility, or another authorised healthcare provider.

We aim to disclose only the minimum information reasonably required for the particular purpose.

7.2 DPO PAY

We use DPO PAY as a third-party payment service provider.

DPO PAY processes payment information in accordance with the services it provides to Jasmine Pharmacy and its own applicable privacy and security obligations.

Jasmine Pharmacy may receive transaction information required to identify and reconcile your payment, while payment credentials entered into the payment environment are handled by the relevant payment provider.

For detailed information about DPO PAY's own processing activities, please consult DPO PAY's privacy documentation.

7.3 Delivery Partners

Where medication is being delivered, we may provide a delivery partner with information necessary to complete the delivery, such as:

recipient name;
delivery address;
telephone number; and
information necessary to identify or complete the delivery.

We will not provide health information to a delivery partner unless it is reasonably necessary for a lawful and specific delivery-related purpose.

7.4 Technology and Service Providers

We use third-party providers that support the operation of our pharmacy services, website, communications, hosting, infrastructure, security, software, payment processes, and other business functions.

Depending on the services used, such providers may process personal data on our behalf.

Where a provider acts as a data processor for Jasmine Pharmacy, we will use appropriate contractual, confidentiality, security, and data-protection safeguards consistent with applicable Kenyan law.

A service provider will not be authorised to use personal data entrusted to it by Jasmine Pharmacy for unrelated purposes merely because it provides services to us.

7.5 Professional Advisors

Where necessary, personal data may be accessed by professional advisors such as legal, audit, accounting, compliance, or other professional service providers, subject to applicable confidentiality and data-protection obligations.

7.6 Regulatory and Government Authorities

We may disclose personal data to the Pharmacy and Poisons Board, Office of the Data Protection Commissioner, Kenya Revenue Authority, courts, law-enforcement bodies, health authorities, or other competent authorities where disclosure is required or authorised by Kenyan law.

Where legally permitted, we will seek to limit disclosures to what is necessary for the lawful purpose.

7.7 Business Transactions

If Jasmine Dental and Medical Centre LLP or Jasmine Pharmacy undergoes a lawful restructuring, merger, acquisition, financing, sale of assets, or similar business transaction, personal data may be transferred where legally permitted and subject to appropriate confidentiality and data-protection safeguards.

8. Cross-Border Processing and Transfers

Some technology, hosting, communication, payment, or other service providers may process personal data outside Kenya.

Where personal data is transferred outside Kenya, Jasmine Pharmacy will apply the requirements of Kenyan data-protection law concerning international transfers and appropriate safeguards.

Where the law requires specific safeguards, consent, or other conditions before a transfer may take place, we will implement the applicable requirements.

Where a third-party processor outside Kenya handles data on our behalf, the relevant contractual, organisational, and technical safeguards will be considered as part of the arrangement.

Our use of a service provider located outside Kenya does not remove your rights under Kenyan data-protection law.

9. How We Protect Your Data

We use appropriate technical and organisational measures designed to protect personal data against unauthorised access, disclosure, loss, alteration, destruction, or other unlawful processing.

Depending on the type of information and the processing involved, safeguards may include:

access controls and role-based permissions;
encryption or other appropriate protection for data in transit and, where appropriate, at rest;
authentication and access-management controls;
secure handling and storage of prescription records;
staff confidentiality obligations;
staff training and awareness;
system monitoring and security measures;
backups and recovery controls where appropriate;
measures to prevent unauthorised access to systems and information; and
periodic review and improvement of our security practices.

Access to prescription and health information is limited to persons who require that information to perform authorised duties or where access is otherwise lawfully permitted.

No method of storing or transmitting information over the internet can be guaranteed to be completely secure. We therefore continuously review our safeguards and respond to identified risks.

10. Confidentiality of Patient Information

Patient health and prescription information is confidential.

Pharmacists, pharmacy personnel, healthcare professionals, employees, contractors, professional advisors, and service providers who are authorised to access patient information are expected to comply with applicable confidentiality, professional, contractual, and legal obligations.

Access should be limited to what is reasonably necessary for the person's authorised role.

We will not disclose confidential patient information merely because a person asks for it. Where a third party seeks access to your information, we may require appropriate evidence of authority or another lawful basis for disclosure.

11. Data Retention

We retain personal data only for as long as reasonably necessary for the purpose for which it was collected, or for longer where retention is required or permitted by applicable law. Because retention periods may depend on the type of record and the applicable legal requirement, Jasmine Pharmacy does not treat one universal retention period as applying to every category of patient information.

Different categories of information may therefore have different retention periods.

Retention considerations may include:

pharmacy and dispensing-record requirements;
health and patient-record requirements;
tax and accounting obligations;
legal claims and dispute resolution;
regulatory requirements;
fraud and security investigations;
contractual requirements; and
other lawful operational purposes.

Where a specific legal requirement establishes a minimum retention period, we will retain the relevant information for that period.

When personal data is no longer required and there is no lawful basis for continuing to retain it, we will take appropriate steps to securely delete, anonymise, or otherwise dispose of it.

12. Children and Minor Patients

Jasmine Pharmacy may provide pharmacy services involving medicines prescribed for minors.

Where a parent, legal guardian, or other authorised representative acts on behalf of a minor, Jasmine Pharmacy may process information necessary to establish the representative's authority and provide the relevant service.

Where a person seeks to exercise a data-subject right on behalf of a child, we may require reasonable evidence of identity and authority before disclosing or changing sensitive personal data.

The applicable rights and arrangements will take into account Kenyan law concerning children, consent, health information, and authorised representatives.

We do not knowingly use children's health information for direct marketing.

Where we become aware that processing presents particular risks to a child, we will apply appropriate safeguards required by law.

13. Your Data Protection Rights

Subject to the conditions and limitations provided by Kenyan law, you have rights in relation to your personal data.

13.1 Right to Be Informed

You have the right to receive information about the collection and use of your personal data, including the purposes for which it is processed.

This Privacy Policy provides information about our principal processing activities.

13.2 Right of Access

You may request access to personal data that Jasmine Pharmacy holds about you, subject to applicable legal requirements and exemptions.

This may include relevant prescription, dispensing, and other personal information forming part of our records.

13.3 Right to Rectification

You may request correction of personal data that is inaccurate, incomplete, outdated, or misleading.

Where a requested correction concerns a clinical or dispensing record, we may need to verify the underlying information before making the change so that the integrity of the health record is preserved.

13.4 Right to Erasure

You may request deletion of personal data in circumstances provided for by Kenyan law.

This right is not absolute. We may be required or permitted to retain information to comply with a legal obligation, protect a legal claim, fulfil a lawful public-interest function, maintain required pharmacy or health records, or for another lawful purpose recognised under Kenyan law.

13.5 Right to Restrict Processing

You may request restriction of processing in circumstances provided by law, including while certain disputes concerning the accuracy or lawfulness of processing are being considered.

13.6 Right to Object

You may object to certain processing of your personal data where the law gives you that right.

Where processing is for direct marketing purposes, you have an absolute right to object to that processing, including related profiling.

13.7 Right to Data Portability

Where applicable under Kenyan law, you may request your personal data in a structured, commonly used, and machine-readable format or request transmission to another data controller where the statutory conditions are satisfied and transfer is technically feasible.

14. Automated Decision-Making and Profiling

We do not make dispensing decisions solely through automated processing.

A prescription submitted to Jasmine Pharmacy is subject to pharmacist review before medication is dispensed.

We may nevertheless use automated or technical tools for limited purposes such as:

website security;
fraud detection;
system monitoring;
prevention of abuse; or
operational administration.

Where automated processing is used in circumstances covered by Kenyan data-protection requirements concerning automated decision-making or profiling, we will apply the safeguards required by law.

Automated security or fraud-detection tools do not replace the professional judgment required for prescription verification and dispensing.

15. Direct Marketing and Your Choices

We distinguish between service communications and marketing communications.

Service communications may be sent without being marketing simply because they are necessary to fulfil or administer the pharmacy service you have requested. Examples include prescription verification messages, payment instructions, dispensing notifications, and delivery updates.

Where we send direct marketing, we will use an appropriate lawful basis and, where required, obtain consent before doing so.

You may object to direct marketing at any time.

You may withdraw consent to marketing by:

using the unsubscribe mechanism included in the communication;
contacting us at privacy@jdmc.co.ke; or
contacting Jasmine Pharmacy using the general contact details below.

Withdrawal of consent does not affect processing that was lawful before the withdrawal.

16. Cookies and Similar Technologies

Our website may use cookies and similar technologies for purposes such as:

essential website functionality;
security;
remembering preferences;
performance and technical monitoring; and
analytics, where used.

Some cookies may be necessary for the website to function and may not be optional. Other cookies may be subject to consent requirements.

For detailed information about the types of cookies used, their purposes, retention periods, third-party involvement, and how to manage your preferences, please read our Cookie Policy.

You may also manage certain cookies through your browser or device settings, although disabling some cookies may affect website functionality.

17. Personal Data Breaches

We maintain procedures for identifying, assessing, containing, investigating, and responding to suspected personal-data breaches.

Where a breach meets the legal threshold for notification, Jasmine Pharmacy will notify the relevant authority and affected data subjects within the timelines and in the manner required by Kenyan law.

The Data Protection Act requires notification to the Data Commissioner without delay and, where the statutory conditions are met, within 72 hours of the controller becoming aware of the breach. Where a processor becomes aware of a breach, the processor has separate notification obligations to the controller under the Act.

We will take reasonable steps to contain and remediate a confirmed incident and to prevent recurrence.

18. Complaints and Regulatory Oversight

If you have a concern about how Jasmine Pharmacy has handled your personal data, please contact our JDMC Privacy Office at privacy@jdmc.co.ke.

For general pharmacy complaints, our complaint procedure, active licences, regulatory escalation routes, and current contact details for the relevant regulatory authorities, please visit our Regulatory & Complaints page.

19. How to Exercise Your Data-Subject Rights

To exercise a data-protection right, contact our Privacy Office:

Email: privacy@jdmc.co.ke

Please provide enough information for us to understand and locate your request, which may include:

your full name;
your contact details;
a description of the information or processing concerned;
the right you wish to exercise; and
any other information reasonably necessary to process the request.

We may request reasonable information to verify your identity before releasing or changing personal data, particularly where the request concerns sensitive health or prescription information.

We will process your request within the applicable time period required by Kenyan law for the particular right concerned.

Where a request cannot lawfully be fulfilled in full, we will explain the applicable limitation where permitted to do so.

We will not require unnecessary information merely for the purpose of exercising a data-subject right.

20. Information Security and Third-Party Services

Jasmine Pharmacy relies on a range of technology and service providers to operate its services.

Depending on the service involved, these providers may support:

website hosting and infrastructure;
secure communications;
email and SMS;
payment processing;
delivery and logistics;
cybersecurity;
data storage;
technical maintenance;
analytics; and
other operational functions.

Where these providers process personal data on Jasmine Pharmacy's behalf, appropriate contractual and security safeguards will apply as required by Kenyan law.

We do not publish an exhaustive list of technical vendors in this Privacy Policy because service providers may change as our infrastructure develops. Material changes to how personal data is processed will be addressed in accordance with applicable transparency requirements.

21. Accuracy of Personal Data

We take reasonable steps to ensure that personal data used for pharmacy services is accurate and, where necessary, kept up to date.

You should tell us promptly if information relevant to your pharmacy service changes, particularly:

your contact details;
delivery information;
prescribing clinician information; or
information relevant to the safe dispensing of your medication.

Where information is clinically relevant, we may ask you to provide the updated information through an appropriate channel so that it can be assessed by a pharmacist where necessary.

22. Changes to This Privacy Policy

We may update this Privacy Policy from time to time to reflect:

changes in our services;
changes in technology;
changes in our data-processing activities;
changes in applicable Kenyan law or regulatory requirements; or
improvements to our privacy practices.

When we make material changes, we will publish the updated policy on our website and, where appropriate, provide additional notice through a reasonable communication channel.

The Effective Date and Last Updated dates at the beginning of this policy will identify the applicable version.

23. Related Policies

This Privacy Policy should be read together with the other Jasmine Pharmacy policies applicable to your use of our services, including:

Where a policy addresses a particular subject in greater operational detail, that policy should be read together with this Privacy Policy.