PharmaSuite Privacy Policy

DRAFT — NOT LEGAL ADVICE

This is a starting template, not legal advice. Have a lawyer review this before relying on it, especially for compliance with Ghana's Data Protection Act 2012 (Act 843). It has not been reviewed by counsel, has not been registered with Ghana's Data Protection Commission, and contains placeholder contact details that must be filled in with real ones before this document is published or relied upon in any way.

Last updated: [insert date of legal review]

1. Who this policy covers

PharmaSuite PMD is operated by Number Seven Solutions Ltd. ("PharmaSuite", "we", "us"), a company registered in Ghana, which provides software-as-a-service pharmacy management tools to independent pharmacies in Ghana — inventory, point-of-sale, billing, purchasing, and regulatory record-keeping (including the controlled-drug register).

This policy explains what personal data PharmaSuite collects, why, and what happens to it. It covers two very different categories of people, treated differently below:

• Pharmacy owners and staff who sign up for and use PharmaSuite directly — for this group, PharmaSuite is the data controller.
• Patients whose prescription and dispensing records a pharmacy's own staff enter into PharmaSuite — for this group, PharmaSuite is only a data processor acting on the pharmacy's instructions. See Section 5.

2. Information we collect

2.1 From the pharmacy owner, at signup and afterward

• Full name, email address, phone number, and a password (stored as a salted hash, never in plain text).
• Pharmacy business details: business name, and whatever company profile information the owner later fills in (address, tax details, branch information).
• Anything sent to verify an email or phone number (a one-time code, sent once — see Section 4 on mNotify and email delivery).

2.2 From pharmacy staff, during ordinary use

• Name, role, and login credentials for each staff account the owner creates.
• Actions taken in the system (an audit trail of who recorded what, and when) — this exists for accountability and regulatory record-keeping (e.g. the controlled-drug register), not for monitoring staff.

2.3 Patient / prescription data entered by the pharmacy

A pharmacy's own staff may enter, as part of ordinary dispensing and sales workflow:

• Patient name and, where the pharmacy chooses to record it, contact details.
• Prescription and dispensing details: medicines dispensed, quantities, prescriber information, and — for controlled substances — the legally-required controlled-drug register entries.

PharmaSuite does not decide to collect this data, and does not use it for its own purposes. It is entered by the pharmacy's staff, for the pharmacy's own recordkeeping and regulatory compliance. See Section 5.

2.4 Billing information

Card and mobile-money payment details are collected and processed directly by Paystack, our payment processor — PharmaSuite never sees or stores full card numbers. We do store the outcome (amount, date, status, and a reference number) needed for invoicing and accounting.

2.5 Technical data

Standard technical data any web/API service collects: IP address, request timestamps, and device/browser information from logs, kept for security and troubleshooting.

3. Why we collect it

• To create and operate an owner's or staff member's account, and to let a pharmacy run its business through PharmaSuite (inventory, sales, billing, purchasing, regulatory records).
• To send OTP codes for signup/verification, and transactional notifications (e.g. billing reminders).
• To process subscription payments.
• To maintain the regulatory records Ghanaian pharmacy law requires (e.g. the controlled-drug register), on the pharmacy's behalf.
• To keep the service secure and to diagnose problems.
• We do not sell personal data, and we do not use patient data collected on a pharmacy's behalf for advertising, profiling, or any purpose beyond providing the service to that pharmacy.

4. Who we share data with

• Paystack — our payment processor, for subscription billing and reseller payouts. Paystack has its own privacy policy governing the payment details it collects directly.
• mNotify — our SMS provider, used to deliver OTP codes and SMS notifications to phone numbers, only for that purpose.
• Our hosting/infrastructure providers — who host the database and application on our behalf, under contractual confidentiality obligations, and do not access data except to operate the service.
• Ghana's regulatory authorities, where a pharmacy or PharmaSuite is legally required to produce records (e.g. controlled-drug register inspections).
• We do not share personal data with any other third party for their own marketing purposes.

5. Patient data: PharmaSuite as processor, the pharmacy as controller

This is the most important distinction in this policy.

For account data (Section 2.1–2.2), PharmaSuite is the controller: we decide why and how that data is processed, and this policy is our commitment to that data's owners.

For patient data entered by a pharmacy's staff (Section 2.3), the pharmacy is the data controller and PharmaSuite is only a data processor. In practice, this means:

• The pharmacy decides what patient data it records, and is responsible for having a lawful basis to collect and process it (e.g. providing pharmaceutical care, complying with Ghanaian pharmacy law).
• PharmaSuite processes that data only as instructed by the pharmacy, through the ordinary functioning of the software — we do not access, use, or repurpose it independently, except as needed to operate, secure, or support the service, or as required by law.
• A patient with a question about their own data held in a pharmacy's PharmaSuite records should contact that pharmacy directly — they are the controller responsible for handling data subject requests.
• PharmaSuite will assist a pharmacy in responding to a lawful patient data request, and will cooperate with Ghana's Data Protection Commission where required.

[This section should be reviewed against, and likely paired with, a written data processing agreement between PharmaSuite and each pharmacy customer — a DPA is not yet part of this repository.]

6. Data retention

• Account data is kept for as long as the account is active, and for a reasonable period afterward to satisfy legal, accounting, and regulatory obligations.
• Patient and controlled-drug register data is retained for however long the pharmacy's own retention policy and Ghanaian pharmacy/controlled-drug regulations require — the controlled-drug register in particular exists as a tamper-evident record specifically because it must be retained and auditable.
• _[Exact retention periods should be set once counsel confirms the minimum periods Act 843 and Ghana's pharmacy regulations require.]_

7. Security

We apply reasonable technical and organizational measures: encrypted connections, hashed/salted passwords, per-pharmacy data isolation at the database level, and access logging. No system is perfectly secure, and we will notify affected parties and the Data Protection Commission as required by law in the event of a data breach affecting personal data.

8. Your rights under Ghana's Data Protection Act 2012 (Act 843)

Subject to Act 843, a data subject has rights including access to their own personal data, correction of inaccurate data, and objection to certain processing. For account-holder data, contact PharmaSuite directly (Section 9). For patient data held in a specific pharmacy's records, contact that pharmacy first, as described in Section 5.

9. Contact

For any question about this policy, or to exercise a data protection right regarding your own PharmaSuite account data:

Number Seven Solutions Ltd. 84 Spintex Road, opp. Baatsonaa Total, Accra, Ghana

Email: pharmasuite@nsslgh.com WhatsApp: +233 53 470 1707

10. Changes to this policy

We may update this policy as the service evolves. Material changes will be communicated to account holders before they take effect.