Privacy Policy

1. Who we are

DrugHub Pharmacy Limited (RC 1315950) runs a community pharmacy at House 21, Opposite Harmony Estate, Langbasa, Ajah, Lagos State, Nigeria, registered with the Pharmacy Council of Nigeria (premises No. LAG2026AD69CA). We are the data controller for the personal information described in this policy, and we handle it in line with the Nigeria Data Protection Act 2023.

2. Information we collect

When you message us on WhatsApp

• Your WhatsApp number and profile name. Your number is how we recognise you. We do not ask you to create a password or account.
• Your messages, including text, menu selections, images and documents you send us.
• Order details: the products in your cart, your delivery address and delivery zone, and your order history.
• Payment receipts: the screenshot or photo of your bank transfer that you send as proof of payment. We do not collect card details.
• Prescriptions: images of prescriptions you send for prescription medicines.
• Identity verification details, only if you order a prescription medicine: the identity information you provide for the check described in section 5.
• Lab test bookings: the tests you choose, your preferred collection option and collection address.
• Your acceptance of our Terms, with the date and time you accepted.
• Your preferences, such as whether you want health updates and refill reminders.

When you visit this website

See section 13. We do not ask you for personal information on this website.

3. How we use your information

• To show you products, take your order, and deliver it or prepare it for pickup.
• To have a licensed pharmacist review your prescription before supplying a prescription medicine.
• To verify your identity before supplying a prescription medicine.
• To confirm your bank transfer and update you on your order status.
• To book and confirm lab tests and arrange sample collection.
• To connect you with a pharmacist or consultant when you ask for one.
• To answer general questions about medicines through our WhatsApp assistant (see section 6).
• To send refill reminders and health updates, but only if you have not opted out.
• To keep the records that pharmacy law and regulators require of us.
• To prevent fraud, protect our customers and staff, and improve our service.

We do not sell your personal information, and we do not use your health information for advertising.

4. Our legal basis

• Contract: to process orders, payments, deliveries and lab bookings you ask for.
• Legal obligation: to check prescriptions and keep pharmacy records as required by law.
• Consent: for health updates and refill reminders, and for processing health information you choose to share with us. You can withdraw consent at any time.
• Vital interests: if you describe a medical emergency, we may act to protect your life or health.
• Legitimate interests: to keep our service secure and working well, where your rights do not override those interests.

5. Health and identity information

Prescriptions, the medicines you buy, lab test bookings and consultation messages are sensitive health information. Only our pharmacists and authorised staff who need it to serve you can access it.

Identity checks. For prescription medicines only, we verify your identity through Dojah, a licensed identity verification provider. We do this once and reuse the result for later prescription orders. We never ask for identity checks for over-the-counter purchases.

Prescription review is separate from the identity check. A pharmacist reviews each prescription for the specific order it comes with.

6. Our WhatsApp assistant

When you ask a general question that is not a menu choice, our assistant may send the text of your question to an artificial intelligence service provider to help write a reply. We share only what is needed to answer: your question, recent messages in the conversation, your first name, your preferred language and whether you are verified for prescription orders. We do not send your full order history, payment details, prescription images or identity documents.

The assistant gives general information with a named source. It cannot place orders, change your cart, approve prescriptions or diagnose you. If your message suggests an emergency, the assistant does not use artificial intelligence to reply. It shows fixed emergency guidance and alerts our staff. We keep a record of assistant conversations to check their safety and quality.

7. Who we share information with

We share information only as needed to run our service, with:

• Meta Platforms (WhatsApp), which carries our messages under its own terms and privacy policy.
• Dojah, for identity verification on prescription orders.
• Supabase, which hosts our database and securely stores files such as prescriptions and payment receipts.
• Vercel, which hosts this website.
• Our artificial intelligence provider, for the limited purpose in section 6.
• Delivery riders and couriers, who receive your name, phone number and delivery address.
• Laboratory staff and phlebotomists, for tests you book.
• Regulators, law enforcement and courts, when the law requires it.

Our service providers may use your information only to provide their service to us.

8. Transfers outside Nigeria

Some of our providers store or process information outside Nigeria. When that happens, we rely on the safeguards permitted by the Nigeria Data Protection Act 2023, such as contractual protections, so your information stays protected.

9. How long we keep information

We keep your information for as long as we need it to serve you, and for as long as pharmacy, tax and other laws require us to keep records such as prescriptions and sales. When we no longer need it, we delete or anonymise it. You can ask us to delete information we are not required to keep (see section 11).

10. Security

We protect your information with access controls, encrypted connections and restricted storage for prescriptions and payment receipts. Staff access depends on their role, and only pharmacists can approve prescriptions. No system is completely secure. If a breach affects you, we will notify you and the regulator as the law requires.

11. Your rights

Under the Nigeria Data Protection Act 2023, you can:

• Ask for a copy of the personal information we hold about you.
• Ask us to correct information that is wrong or incomplete.
• Ask us to delete your information, unless the law requires us to keep it.
• Object to or ask us to restrict how we use your information.
• Withdraw your consent at any time. Reply STOP in our WhatsApp chat to stop health updates and reminders.
• Ask for your information in a portable format.

To use these rights, message us on WhatsApp or email admin@drughubpharmacy.ng. We may need to confirm it is you before we act. If you are unhappy with how we handle your information, you can complain to the Nigeria Data Protection Commission.

12. Children

Our WhatsApp service is for adults aged 18 and over. A parent or guardian can order on behalf of a child and is responsible for the information they share about that child.

13. This website

This website does not use advertising or tracking cookies, and it does not ask for personal information. Our hosting provider keeps standard technical logs, such as IP addresses and request times, to run and secure the site. The site loads fonts from Google Fonts, so Google receives your IP address when you visit. Links to WhatsApp, Facebook and other services are governed by those services' own policies.

14. Changes to this policy and how to contact us

We may update this policy as our service changes. We will change the date at the top of this page, and for significant changes we will let you know on WhatsApp.