Last updated 10 November 2026
Privacy policy
What DawaPoints keeps, why, who can see it, and how long we keep it. Written to be read.
Two kinds of data
Your account data: the pharmacy's name, the owner's name, phone and email, the PPB licence number, billing details and payments. We are responsible for it (the controller).
Your pharmacy's records: products, stock, sales, staff, and patients and prescriptions. Your pharmacy decides what is recorded and why; we keep and process it only on your behalf and on your instructions (we are the processor).
Data processing (patients and prescriptions)
- We process patient data only to provide the service to your pharmacy.
- We do not sell it, share it for advertising, or look at it except to help you when you give support access.
- Each pharmacy's data is kept apart at the database level, so one pharmacy can never see another's.
- Connections are encrypted (HTTPS); backups are kept encrypted and access to servers is limited to named staff.
- Reading patient records is logged in your pharmacy's audit trail.
- At the end of the service we return your data as CSV and delete it, as below.
What we collect and why
- Account and billing details: to run your account, issue invoices and take payments.
- Sign-in records (time, device): to keep accounts secure.
- Error reports from the app (no patient details): to fix problems.
- On the public demo: nothing about you; a scrambled form of your IP address limits misuse, and the demo pharmacy is deleted within 24 hours.
Who can see your data
Only the people your pharmacy adds, each limited by their role. Our support staff can sign in to your pharmacy only while you have given support access in Settings, for the hours you chose; you see when it is on and can revoke it. Our platform staff see account and billing details, never your sales, stock or patients.
M-Pesa payments are processed by Safaricom. Emails (codes, invoices, reminders) go through an email provider. Servers are run by our hosting provider. They get only what they need.
How long we keep it
While your account is active, and after a lapse as set out below. After day 90 without payment we contact you, then delete the pharmacy's data. Invoices and payment records are kept as long as tax law requires.
| State | When | What works |
|---|---|---|
| Trial | 14 days from signup | Everything, with Premium features. |
| Paid | Your paid period | Everything in your plan. A renewal invoice appears 7 days before the end. |
| Grace | Day 0 to day 7 after the paid period ends | Everything still works. A banner asks you to pay. (A trial that ends has no grace days.) |
| View-only | Day 7 to day 30 | Sign in, view, print and download receipts, invoices and reports, export your data, pay. No new sales, receiving or edits. Sales a till made offline before the cut-off still upload. |
| Paused | Day 30 to day 90 | Sign in, billing, export your data and change your password. Your data is kept. |
| Due for deletion | After day 90 | We contact you before deleting anything. Deletion is done by a person, never automatically. |
If something goes wrong
If we learn of a breach that affects your data, we tell you without delay (and within 72 hours) with what happened, what data, and what we are doing, so you can meet your own duties to patients and the Data Commissioner.
Your rights
You can see, correct, export and ask us to delete your data. Patients who want to use their rights should ask the pharmacy; we help the pharmacy answer. Contact us by WhatsApp during support hours (Mon–Sat 8:00–18:00 EAT) or at the email on your invoice.