Privacy Policy

1. Introduction

Arteries Online Pharmacy ("we", "our", "us") operates the platform at medicalarteries.com and is committed to protecting your personal data in accordance with the Nigeria Data Protection Act, 2023 (NDPA) and the PCN Electronic Pharmacy Regulations. This policy explains what personal data we collect, why we collect it, how we store, use, share and protect it, and the rights you have over it.

By registering an account or using our services, you agree to the collection and handling of your personal data as described in this policy and in our Terms of Service.

2. Who We Are and How to Contact Us

We are a Nigerian online pharmacy platform that connects patients with licensed pharmacies and registered pharmacists. Our Data Protection Officer may be contacted at any time:

• Email: privacy@medicalarteries.com
• For support enquiries, see our Support page.

3. Information We Collect

We collect and process the following categories of personal data about customers and users:

• Identity and contact information: full name, email address, phone number, delivery address, date of birth, gender, and profile information you voluntarily provide.
• Government-issued identification: national identification number (NIN), International Passport or Driver's Licence number, submitted during registration or account verification.
• Health and prescription data: prescription details and any prescription files you upload, the prescriber's name and Medical and Dental Council of Nigeria (MDCN) registration number, clinic details, and medication order history. This is special-category data under the NDPA.
• Transaction and order data: order contents, amounts, payment method used, delivery information and order history. We do not collect or store your full card numbers — card payment details are handled directly by our licensed payment processors.
• Technical and usage data: IP address, browser and device information, pages visited, and time of access. This data is recorded in our security and audit logs when you interact with the platform.
• Account sign-in data: if you choose to sign in with Google, we receive the name, email address and unique Google identifier you authorise Google to share with us.
• Messages and support data: records of your correspondence with our support team.

Pharmacy and business accounts may also provide company registration details, pharmacy and superintendent pharmacist information, staff details, bank account (NUBAN) information and KYC documents during onboarding. These are used only for the purposes of onboarding, verification and lawful operation described below.

4. How We Use Your Information

We use your personal data only where we have a lawful basis to do so, and only for the purposes described here:

• To provide our services (contract): create and manage your account, process orders, arrange delivery, verify prescriptions with licensed pharmacists and dispense medicines as ordered.
• To comply with legal and regulatory obligations: maintain prescription and dispensing records, comply with PCN requirements, NDPA obligations, tax law and lawful requests from regulators or courts.
• To keep your account secure (legitimate interest): authenticate you, protect against fraud, unauthorised access and abuse, and maintain security audit trails.
• To communicate with you about your account (contract/legitimate interest): order confirmations, delivery updates, verification codes, password resets and account-related notifications by email, SMS or WhatsApp message.
• To improve the platform (legitimate interest): understand how the platform is used, monitor performance and fix faults. We do not use analytics to profile you for advertising.

We do not sell, rent or share your personal data for advertising or marketing purposes.

5. How Your Data Is Stored and Protected

We implement a combination of technical and organisational measures to protect your personal data:

• Encryption of health files: prescription files and other sensitive health documents you upload are encrypted at rest using AES-256-GCM encryption and stored outside the public web root. File integrity is verified using cryptographic hashes.
• Encryption in transit: all traffic to the platform is protected with Transport Layer Security (TLS) and HTTP Strict Transport Security (HSTS), which force secure, encrypted connections in production.
• Password security: passwords are never stored in plain text — they are hashed using bcrypt with a strong cost factor.
• Session and access security: authentication is handled through short-lived, encrypted sign-in tokens stored in HttpOnly cookies, together with CSRF protection, request rate limiting, and optional two-factor authentication on your account.
• Access control: access to customer data is restricted to authorised roles (for example, pharmacists verifying prescriptions, couriers managing delivery, and platform staff) on a least-privilege, need-to-know basis. Couriers receive only the delivery and contact information they need — never your health data.
• Audit trail: access and account events are recorded in an append-only audit log (including user, IP address and time) to detect and investigate unauthorised activity.
• Upload controls: documents you upload are checked for allowed file types and sizes.

No security measure is perfect. While we work hard to protect your data, we cannot guarantee absolute security, and we encourage you to keep your password and devices safe.

6. Who We Share Your Data With

We disclose personal data only where necessary to operate and secure the platform, and only to the extent required:

• Licensed pharmacies and pharmacists: the order and prescription information needed to verify and dispense your medication to you.
• Courier and dispatch partners: your name, delivery address and phone number, solely to deliver your order to you.
• Payment processors: when you pay, your transaction is processed by PCI-DSS compliant payment providers (Squad). Card details are entered directly on the provider's secure pages and are not stored by us; we retain transactional records for accounting and regulatory purposes.
• Messaging and communication providers: we use service providers to deliver transactional emails (e.g., SMTP services) and SMS/WhatsApp notifications (e.g., Termii) for order updates and verification codes.
• Google: if you sign in with Google, Google provides us with your name, email address and Google identifier you have authorised. Google's collection and use of your data on its sign-in services is governed by Google's own privacy policy.
• Regulators and law enforcement: we may disclose data where required by law, regulation or a lawful request from the Pharmacists Council of Nigeria (PCN), the Nigeria Data Protection Commission (NDPC), courts or other authorities.

Where we use service providers, we require them to process your data only on our instructions and to apply appropriate safeguards. We remain responsible for the personal data we control.

7. Data Retention

We keep personal data only for as long as it is needed for the purposes described in this policy and for as long as we are required to keep it by law.

• Prescription and dispensing records are retained for the period required by PCN and pharmacy regulations to meet professional and regulatory record-keeping obligations.
• Order and transaction records are retained for accounting, tax and dispute-resolution purposes.
• Account data is retained while your account is active and for a reasonable period after deactivation to allow for reactivation or to meet legal obligations.
• Security and audit logs are retained for the periods needed to investigate and protect against misuse.

When personal data is no longer needed for these purposes, we delete or anonymise it. Note that we cannot delete records that law or regulation requires us to keep, even where you close your account.

8. Your Rights

Under the NDPA you have the following rights in relation to your personal data, which you can exercise by contacting us at privacy@medicalarteries.com:

• Right to access: obtain confirmation of whether we hold your personal data and a copy of it.
• Right to rectify: have inaccurate or incomplete data corrected.
• Right to erasure and account deactivation: request deletion of your personal data or closure of your account. You can deactivate your account from the Delete Account page; some records may be retained where required by law.
• Right to restriction: ask us to restrict processing in certain circumstances, such as while a dispute about the accuracy of your data is being resolved.
• Right to data portability: receive the personal data you provided to us in a structured, machine-readable format, where technically feasible.
• Right to withdraw consent: where processing is based on consent, withdraw that consent at any time (for example, to stop receiving certain notifications).
• Right to object: object to processing carried out on the basis of our legitimate interests, where we do not have a compelling legitimate ground to continue.
• Right to complain: lodge a complaint with the Nigeria Data Protection Commission (NDPC) if you believe your data protection rights have been infringed.

We will respond to your request within the period required by the NDPA (normally one month). Before acting on a request, we may need to verify your identity so that your data is not disclosed to anyone unauthorised.

9. Security Breach Notification

In the event of a personal data breach that is likely to result in a risk to your rights and freedoms, we will notify the Nigeria Data Protection Commission and, where the risk is high, affected individuals, as required by the NDPA. We maintain and exercise incident-response practices aimed at containing, investigating and remediating any security incident.

10. Cookies

We use cookies and similar technologies that are strictly necessary for the platform to function securely — for example, to keep you signed in and to protect forms from cross-site request forgery. We do not use cookies for advertising or cross-site tracking. For full details, please see our Cookie Policy.

11. Children's Privacy

The platform is intended for individuals aged 18 and over. We do not knowingly collect personal data from children under 18. If you believe a child has provided us with personal data, please contact us at privacy@medicalarteries.com so that we can review and delete it where appropriate.

12. Changes to This Policy

We may update this policy from time to time to reflect changes in our practices, the law or our services. We will post the updated policy on this page and, where materially significant, notify you by email or in-app notice before it takes effect. The "Last updated" date at the top of this page will show when the policy was last revised.

13. Contact Us

For any questions about this policy or how we handle your personal data, please contact our Data Protection Officer at privacy@medicalarteries.com.