Skip to Content

Notice of Privacy Practices

Effective Date: 10 June 2026

What This Means for You1. Who We Are2. Privacy at a Glance3. What We Collect And Why4. Who We Share Your Data With5. Payment Data6. Minor Patients7. Your Rights8. Data Breach Notification9. How to Contact Us10. How to Make a Complaint

What This Means for You

This notice tells you, in plain language, what personal data Jasmine Pharmacy collects, why we collect it, who we share it with, and what rights you have under Kenyan law. We collect only what is necessary to fill your prescription and manage your care safely. 

This Notice of Privacy Practices is a summary document and is available alongside our full Jasmine Pharmacy Privacy Policy. This Notice summarises key practices. Our full Privacy Policy provides additional detail and should be read together with this Notice.

 

1. Who We Are

Jasmine Dental and Medical Centre LLP, trading as Jasmine Pharmacy, is a specialist chronic-care pharmacy registered and licensed in Kenya and regulated by the Pharmacy and Poisons Board (PPB).

We are the data controller responsible for your personal data when you use our pharmacy services.

We process your personal data in accordance with the Kenya Data Protection Act 2019 and are taking the steps required to achieve full compliance with applicable regulatory requirements, including being in the process of statutory registration with the Office of the Data Protection Commissioner.


2. Privacy at a Glance

Identity Data

Collected to set up your account and deliver your medication.

  • Includes: name, identification number, contact details
  • Retention: Adult records — minimum 7 years from date of last interaction. Minor records — until age 25, or 5 years from last interaction, whichever is longer.


Prescription Data

Collected to dispense medication safely and comply with the Pharmacy and Poisons Act Cap. 244.

  • Includes: medication details, dosage, diagnosis, prescribing clinician information
  • Legal basis: Provision of healthcare services and compliance with legal obligations
  • Retention: Adult records — minimum 7 years from date of last interaction. Minor records — until age 25, or 5 years from last interaction, whichever is longer.


Payment Data

We do not store card numbers or full payment credentials. Payment processing is handled independently by DPO Pay.

  • Includes: transaction initiation metadata only
  • Legal basis: Performance of our contract with you
  • Retention: Accounting and transaction records necessary to meet legal and tax obligations — minimum 5 years.


Website & Technical Data

Collected for website security and performance. Cookies are used to support website functionality — see our Cookie Policy for details.

  • Includes: IP address, browser type, device type, pages visited
  • Legal basis: Legitimate interests in maintaining our systems
  • Retention: Generally no more than 12 months, unless a legal or security exception applies.


3. What We Collect And Why

We collect identity data, prescription and health data, basic payment transaction data, and limited website and technical data necessary to provide our services and maintain the security and performance of our systems.

We collect only the personal data reasonably necessary to provide our services and comply with our legal obligations. We do not collect data speculatively or in excess of what the relevant service requires.


Sources of Personal Data

Personal data is collected directly from patients and authorised representatives. We may also receive personal data from:

  • Prescribing clinicians
  • Healthcare facilities
  • Laboratories
  • Caregivers
  • Other healthcare providers involved in your care


Prescription Medicines

No medication will be dispensed without a valid prescription. Prescription medicines are dispensed only upon receipt and verification of a valid prescription. We do not dispense over-the-counter medication. We are a specialist chronic-care pharmacy.


Sensitive Health Information

Prescription and health information are sensitive personal data as defined under Section 2 of the Kenya Data Protection Act 2019.

  • Legal bases for processing: Provision of healthcare services and compliance with legal obligations, including those under the Pharmacy and Poisons Act Cap. 244.
  • Where the law requires explicit consent for any additional processing, we will obtain it before proceeding.
  • We never rely on "legitimate interests" as a legal basis for processing sensitive health information.


4. Who We Share Your Data With

We share the minimum data necessary in every case.

  • Delivery partners: name, delivery address, and contact number only. Delivery services are available within the service areas operated by Jasmine Pharmacy.
  • Technology service providers (including cloud hosting, communications, website services, and cybersecurity): bound by Kenya Data Protection Act 2019-compliant processor agreements. They act on our instructions and may not use your data for their own purposes. Any cross-border transfers are conducted in accordance with Section 48 of the Kenya Data Protection Act, 2019, and we ensure appropriate safeguards (including contractual and technical measures) are in place.
  • DPO Pay: for payment processing only. See Section 5.
  • Prescribing clinicians and healthcare facilities: prescription data for verification purposes only.
  • Kenyan regulatory authorities (ODPC, PPB, courts, and other competent authorities): on legal obligation only. We share the minimum required and will notify you where the law permits.

We do not sell, rent, or trade your personal data. We only use your data for marketing where you have given explicit consent, and you can withdraw this at any time as detailed in our Privacy Policy.


5. Payment Data

Jasmine Pharmacy does not store your card details or financial data on its own servers. All payment processing is handled by DPO Pay, which acts as an independent data controller and operates PCI-DSS compliant infrastructure.

Payment information and health records are maintained under separate security controls, with access restricted to authorised personnel. For information on how DPO Pay handles your payment data, please refer to the DPO Pay Privacy Policy.

 

6. Minor Patients

A minor is any person under 18 years of age.

  • Consent: Parental or legal guardian consent is required for the registration and treatment of any minor.
  • Retention: Minor patient data is retained until the patient reaches age 25, or for 5 years from the date of last interaction, whichever is longer.
  • Marketing: We do not use minor patient data for marketing purposes.
  • Rights: A parent or legal guardian may exercise any data subject right on behalf of a minor patient.
  • Transition to adulthood: Once a patient reaches 18 years of age, requests relating to their personal data will generally be handled directly with the patient, unless otherwise authorised by law.


7. Your Rights

Under the Kenya Data Protection Act 2019, you have eight rights in relation to your personal data:

  • Right to be informed: to know what data we hold about you and how we use it.
  • Right of access: to receive a copy of your personal data.
  • Right to rectification: to have inaccurate data corrected.
  • Right to erasure: to have your data deleted, subject to our legal retention obligations.
  • Right to restrict processing: to limit how we use your data in certain circumstances.
  • Right to data portability: to receive your data in a structured electronic format (CSV, PDF, or equivalent).
  • Right to object: to object to any processing of your data, including an absolute right to object to direct marketing.
  • Right not to be subject to automated decision-making: no automated process will make decisions about your medication or care.


How to Exercise Your Rights

To exercise any of these rights, contact us at privacy@jdmc.co.ke or write to us at our physical address in Section 9.

  • Response time: We will respond without undue delay, generally within 14 days, as required by applicable law.
  • Extensions: Where a request is unusually complex, we may extend the response period and will notify you before the original deadline expires.
  • Verification: We may request information reasonably necessary to verify your identity before responding.
  • Fees: No fee applies to routine requests.


8. Data Breach Notification

Where required by law, we will notify the Office of the Data Protection Commissioner and affected individuals within the timeframes prescribed by the Kenya Data Protection Act 2019 and applicable regulations.


9. How to Contact Us

For any question, concern, or request relating to your personal data or this policy, contact our designated privacy contact using the details below.


For Data Protection & Privacy

JDMC Privacy Office

All privacy rights requests, data protection complaints, and data protection enquiries should be directed to this address. We will acknowledge your communication promptly and respond within the timelines set out in Section 10.


For General Enquiries

Jasmine Pharmacy

10. How to Make a Complaint

If you are not satisfied with how we have handled your personal data, you have the right to complain to any of the following bodies.


For Data Protection Matters

Office of the Data Protection Commissioner (ODPC)


For Pharmacy Practice Matters

Pharmacy and Poisons Board (PPB)


For Consumer Protection Matters

Competition Authority of Kenya (CAK)

  • Phone: +254 20 262 8233

  • Phone (Alternative): +254 20 277 9000

  • Email: info@cak.go.ke

  • Website: cak.go.ke

  • Physical Address: CBK Pension Towers, 15th Floor, Harambee Avenue, Nairobi

  • Address: P.O. Box 36265-00200, Nairobi, Kenya