Notice of Privacy Practices | Jasmine Pharmacy

What This Means for You

This notice tells you, in plain English, what personal data Jasmine Pharmacy collects, why we collect it, who we share it with, and what rights you have under Kenyan law. We collect only what is necessary to fill your prescription and manage your care safely. This Notice of Privacy Practices is a summary document. The full Jasmine Pharmacy Privacy Policy governs in all cases and is available here: Privacy Policy. This Notice summarises key practices. Our full Privacy Policy provides additional detail and applies alongside this Notice.

1. Who We Are

Jasmine Dental and Medical Centre LLP

Trading as: Jasmine Pharmacy

We are the data controller responsible for your personal data when you use our pharmacy services.

2. Privacy at a Glance

What We Collect	Why We Collect It	Lawful Basis	How Long We Keep It
Identity data (name, ID number, contact details)	Account management and service delivery	Performance of a contract	Adults: minimum 7 years from last interaction. Minor patients: until age 25, or 5 years from last interaction whichever is longer.
Prescription data (medication, dosage, diagnosis, prescribing clinician details)	To dispense medication safely and comply with the Pharmacy and Poisons Act Cap. 244	Legal obligations and provision of healthcare services	Adults: minimum 7 years from last interaction. Minor patients: until age 25, or 5 years from last interaction whichever is longer.
Payment data (transaction initiation metadata only; we do not store card numbers or full payment credentials)	To process your payment transaction, handled by DPO Pay	Performance of a contract	Minimum 5 years (KRA and tax law); records held by DPO Pay, not by us.
Website and technical data (IP address, browser type, device type, pages visited)	Security and performance of our website	Legitimate interests (website security and performance)	Maximum 12 months, unless a legal or security exception applies.

We also collect limited website and technical data (IP address, browser type, device type, pages visited) for security and performance purposes. We retain website and technical data for a maximum of 12 months unless a legal or security exception applies.

3. What We Collect And Why

We collect three categories of personal data: identity data, prescription and health data, and basic payment transaction data. We also collect limited website and technical data (such as IP address and browser type) for security and performance purposes. We retain website and technical data for a maximum of 12 months.

Personal data is collected directly from patients and authorised representatives. We may also receive personal data from prescribing clinicians, healthcare facilities, laboratories, caregivers, and other healthcare providers involved in your care.

We collect only the personal data reasonably necessary to provide our services and comply with our legal obligations. We do not collect data speculatively or in excess of what the relevant service requires.

Prescription medicines are dispensed only upon receipt and verification of a valid prescription.

We do not dispense over-the-counter medication. We are a specialist chronic-care pharmacy.

Prescription and health information are sensitive personal data as defined under Section 2 of the Kenya Data Protection Act 2019. The lawful bases for processing are the provision of healthcare services and compliance with legal obligations, including those under the Pharmacy and Poisons Act Cap. 244. Where the law requires explicit consent for any additional processing, we will obtain it before proceeding.

4. Who We Share Your Data With

We share the minimum data necessary in every case.

Delivery partners: Name, delivery address, and contact telephone number only. We share only the minimum information necessary to complete the delivery. Deliveries are restricted to our active service areas, as updated from time to time on our website.
Technology service providers (cloud hosting, communications, analytics (if any), and cybersecurity services.): bound by Kenya Data Protection Act 2019-compliant processor agreements. They act on our instructions and may not use your data for their own purposes. Where applicable, some technology service providers may process or host data outside Kenya. Any cross-border transfers are conducted in accordance with Section 48 of the Kenya Data Protection Act, 2019 and applicable regulations.
DPO Pay: for payment processing only. See Section 5.
Prescribing clinicians and healthcare facilities: prescription data for verification purposes only.
Kenyan regulatory authorities (ODPC, PPB, courts, and other competent authorities): on legal obligation only. We share the minimum required and will notify you where the law permits.

We do not sell, rent, or trade your personal data or health information.

5. Payment Data

Jasmine Pharmacy does not store your card details or financial data on its own servers.

All payment processing is handled by DPO Pay, which operates PCI-DSS compliant infrastructure.

Your financial data and your health data are stored in separate, access-controlled environments and are never combined.

For information on how DPO Pay handles your payment data, please refer to the DPO Pay Privacy Policy.

6. Minor Patients

A minor is any person under 18 years of age.

Parental or legal guardian consent is required for the registration and treatment of any minor. Minor patient data is retained until the patient reaches age 25, or for 5 years from the date of last interaction, whichever period is longer. We do not use minor patient data for marketing purposes. A parent or legal guardian may exercise any data subject right on behalf of a minor patient.

7. Your Rights

Under the Kenya Data Protection Act 2019, you have eight rights in relation to your personal data:

Right to be informed: to know what data we hold about you and how we use it.
Right of access: to receive a copy of your personal data.
Right to rectification: to have inaccurate data corrected.
Right to erasure: to have your data deleted, subject to our legal retention obligations.
Right to restrict processing: to limit how we use your data in certain circumstances.
Right to data portability: to receive your data in a structured electronic format (CSV, PDF, or equivalent).
Right to object: to object to any processing of your data, including an absolute right to object to direct marketing.
Right not to be subject to automated decision-making: no automated process will make decisions about your medication or care.

To exercise any of these rights, email privacy@jdmc.co.ke or write to us at our physical address below. We will respond within 14 days. Where permitted by law and where a request is unusually complex, we may extend this period by a further 14 days and will notify you before the original deadline expires. We will notify you of any extension before the original deadline expires. We may ask for information reasonably necessary to verify your identity. Documentary identification will only be required where necessary to protect personal data and prevent unauthorised disclosure. No fee applies to routine requests.

8. Data Breach Notification

Where a personal data breach presents a real risk of harm, we will notify the Office of the Data Protection Commissioner and affected individuals within the timeframes required by law.