Privacy Policy

Effective date: 5 November 2026

This policy takes effect on 5 November 2026. Until then, the version dated 29 June 2026 applies. It now covers payments and invoices, contact-detail sharing, patient privacy, error reports and sign-in alerts, and states how long we actually keep each kind of data.

Pharma Connect (“we,” “us,” or “our”) operates the Pharma Connect platform at pharmaconnectja.com. We protect your personal information in line with the Jamaica Data Protection Act 2020 (DPA 2020) and, where it applies, the EU General Data Protection Regulation (GDPR). This policy explains what we collect, why, who can see it, how long we keep it, and your rights.

1. Data Controller

Pharma Connect is the data controller for personal information processed through the platform. A pharmacy that receives your prescription is also responsible for how it handles that prescription under its own legal duties. Contact: pharmaconnectja@gmail.com

2. Information We Collect

Account and profile

• Name, email address, phone number, date of birth and parish
• Account role (patient, pharmacist, pharmacy technician, pharmacy, distributor, supplier or staff)
• Profile photo and biography; for professionals, work history, availability and CV
• Business details: name, address, parish, phone and registration details

Verification documents

Licences, certificates and business registrations you upload, with their expiry dates and our review decisions. These are reviewed only by the Pharma Connect team.

Health and prescription data

• Prescription images and documents, and the notes and status history around them
• Messages with the pharmacy about your prescription
• The name, relationship and phone number of anyone you authorise to collect it for you, and what the pharmacy may tell them

Jobs, bookings and messages

• Job applications and CVs, bookings, shifts and calendar entries
• Messages, connection requests, and your mute, block and inbox settings
• Contact details you choose to share with a business

Payments and invoices

• Proof of payment you upload for paid features, and the plans you hold
• If you use the invoice tool: bank details you choose to save and the invoices you archive. These are stored encrypted and are readable only by you.

We do not collect or store card numbers.

Security, technical and support data

• Sign-in device records: a fingerprint of your browser, its IP address and approximate location, used to email you when your account is signed in to from a new device
• Security and activity logs, including IP address and browser, for actions such as sign-in, verification and admin changes
• Error reports: when something breaks, we record the error, the page, your browser and device type, recent clicks, and a snapshot of the page with the text you typed or that was shown masked
• Feedback you send us, including any screenshot you attach, and your answers to the short “How easy was that?” question we sometimes ask after you finish something
• When you were last active on the platform (at most once a day), so we can see how many members keep using it
• Usage insights: the pages you visit, the main steps you complete, and recordings of how the public pages, sign-up and first-time setup are used, so we can improve them. What you type is never recorded, pages you see when signed in are never recorded, and you are identified only by your account number and account type. You can turn this off in Settings > Privacy choices; browsers that send Global Privacy Control or Do Not Track are left out.
• Records of your consent to these Terms and this policy, with the date and version
• Visit statistics: the pages you view, the site that referred you, your device type and browser, and your approximate location (country, parish and town) as reported by our hosting provider. We don't store your IP address or use cookies for this, and visits are counted with a code that changes daily and can't identify you. Browsers that send Global Privacy Control or Do Not Track aren't counted. Kept for 400 days.

3. How We Use Your Information

• Running the service: carrying prescriptions, jobs, bookings, orders and messages between the people involved.
• Verification: checking licences and business registrations, and reminding you before they expire.
• Account and security: signing you in, alerting you to new devices, and preventing fraud and misuse.
• Notifications: in-app alerts and matching emails about your activity and important changes to the platform.
• Moderation: reviewing marketplace listings and job posts.
• Payments: confirming payments and activating paid features.
• Fixing problems: using error reports and feedback to find and fix faults.
• Improving the service and advertising: understanding how the platform is used, and reporting audience figures to advertisers only as totals, never about individuals.
• Legal compliance: meeting our duties under Jamaican law.

We do not sell your data, use it for advertising profiles, or share it with advertisers.

4. Legal Bases for Processing

• Contract: what is needed to provide the services you signed up for (GDPR Art. 6(1)(b)).
• Consent: health and prescription data (GDPR Art. 9(2)(a)), sharing your contact details, and authorising someone to collect for you. You can withdraw it at any time.
• Legitimate interests: security, fraud prevention, error reports, moderation, and usage insights to improve the platform, where these do not override your rights. You can turn usage insights off at any time.
• Legal obligation: where Jamaican law requires it.

5. Who Can See Your Information

• Patients do not appear in search or directories. Your name, photo and parish are shown only to the pharmacists and pharmacies you contact. Your profile photo is kept private and shown through short-lived links.
• Professionals and businesses have public profiles. Anyone can make their personal profile private in Settings.
• Phone numbers and email addresses are not shown to other members unless you share them: a professional with a business they choose, or a patient with the pharmacy for a single prescription (that access ends when the prescription is completed).
• Prescriptions are visible only to you and the pharmacy you send them to.
• Job applications and CVs are visible only to you and the employer you apply to.
• The Pharma Connect team can see what it needs for verification, payments, moderation, support and security. Admin access requires two-factor sign-in and is logged.

6. Prescription and Health Data

• Prescription files are kept in private storage and are never publicly accessible.
• Files are shown only through short-lived links created on our servers.
• Only the pharmacy you selected can view your prescription.
• Collection permissions can be withdrawn by you at any time.

7. Service Providers

We use these providers to run the platform. They process data for us under contract:

• Supabase (on Amazon Web Services): database, sign-in and file storage.
• Vercel: website hosting and request logs.
• Resend: sending emails.
• PostHog: usage insights and recordings.
• Google: “Sign in with Google” if you use it, and Google Maps where it is enabled.
• OpenStreetMap: map images. Your browser requests them directly.
• ipapi: approximate location of a sign-in IP address, for new-device alerts.

We also disclose data when required by a valid court order or lawful request under Jamaican law.

8. International Transfers

Our providers process data outside Jamaica, mainly in the United States. We rely on their contractual protections and, where GDPR applies, Standard Contractual Clauses.

9. How Long We Keep Data

A pharmacy may need to keep its own dispensing records for longer under the law that applies to it.

10. Your Rights

Under the DPA 2020 you can ask to:

• Access a copy of the personal data we hold about you.
• Correct inaccurate or incomplete data. Most of it you can edit yourself.
• Erase your data, subject to the limits in section 9.
• Receive your data in a structured, machine-readable format.
• Object to processing based on legitimate interests.
• Withdraw consent at any time, without affecting what was done before.

Email pharmaconnectja@gmail.com and we will respond within 30 days. You can delete your account yourself in Settings. Deletion happens after 30 days, and you can cancel it until then. Messages, prescriptions and bookings the other party needs are kept under a “Deleted User” label instead of your name.

11. Security

We protect your data with encryption in transit, private storage for sensitive files, encryption of saved bank details and invoices, database rules that limit each account to its own data, two-factor sign-in for admins (optional for everyone else), new-device sign-in alerts, and audit logs. No system is completely secure. If a breach affects your personal data, we will tell you promptly.

12. Children

Pharma Connect is for people aged 18 and over. We do not knowingly collect data from anyone under 18. If you think we have, contact us and we will delete it.

13. Changes to This Policy

When we make material changes, we update the date at the top and tell registered members by email or in-app notification at least 14 days before they take effect.

14. Contact Us

You can also complain to Jamaica's Office of the Information Commissioner if you believe your rights under the DPA 2020 have been infringed.

Version effective 5 November 2026; replaces the version of 29 June 2026. See also our Terms of Service.