DawaFill Privacy Policy

This Privacy Policy explains how DawaFill handles personal information when people visit the website, create or use accounts, subscribe, request support, or when authorized pharmacies and medical centres use DawaFill to support chronic-care operations.

1. Information we may process

DawaFill may process account and organization information, contact details, authentication and security events, subscription and payment references, support communications, system usage and audit information. Where a subscribing organization uses patient-care features, DawaFill may also process patient identity, contact, medication, refill, communication, delivery and related health information supplied or generated by that organization.

2. Why information is used

Information may be used to provide and secure the platform, authenticate users, manage subscriptions, process payment status, deliver requested communications, operate refill and care workflows, provide support, maintain audit trails, detect misuse, meet legal obligations, troubleshoot incidents and improve reliability and usability.

3. Organization and DawaFill responsibilities

For patient information entered by a pharmacy or medical centre, the organization generally determines the care and operational purposes for which that information is used and is responsible for the lawful basis, notices, permissions and accuracy required for that processing. DawaFill processes such information to provide the contracted service and related support.

4. Communications

DawaFill may send service, security, MFA, subscription, payment and support communications from its platform communication address. Pharmacies and medical centres may separately configure their own verified senders for patient refill, care and outreach communications. Patient outreach should respect the applicable communication preferences and permissions recorded by the organization.

5. Service providers and integrations

DawaFill may use authorized infrastructure, payment, email, SMS, security, backup and technical service providers where necessary to operate the service. Information is shared only to the extent reasonably required for those services, subject to appropriate contractual, security and legal controls.

6. Security

DawaFill uses technical and organizational controls such as authenticated access, role-based permissions, tenant separation, MFA where configured or required, audit logging, encrypted secrets, secure transport in production, backups and monitoring. No system can guarantee absolute security, and organizations must also protect their accounts, users and endpoints.

7. Retention

DawaFill retains information for as long as reasonably required to provide the service, maintain security and audit records, satisfy contractual or legal obligations, resolve disputes, recover systems and protect legitimate business interests. Retention periods may differ by information type and applicable legal requirement.

8. Access, correction and privacy requests

Patients should normally direct requests concerning records controlled by their pharmacy or medical centre to that organization first. DawaFill will support subscribing organizations in handling valid privacy requests where appropriate. Account holders may also contact DawaFill about platform-account information or privacy concerns.

9. International processing

Where approved service providers process information outside Uganda, DawaFill will seek appropriate safeguards and contractual protections consistent with applicable requirements and the sensitivity of the information.

10. Cookies, public-site analytics and advertising measurement

DawaFill uses essential session, security and preference storage required for authentication, CSRF protection and reliable operation. On public marketing pages only, DawaFill may also use Google Analytics and Google Ads measurement after a visitor chooses “Allow analytics.” This measurement is used to understand aggregated website visits, evaluate public calls to action and attribute completed business enquiries. Visitors may choose “Essential only” or reopen analytics preferences at any time. Google measurement is not loaded in authenticated workspaces, and DawaFill does not send patient records, email addresses, phone numbers, names, form contents or other sensitive health information to Google Analytics or Google Ads.

11. Children's data

DawaFill is intended for use by authorized healthcare organizations and their personnel. Where an organization records information about a minor patient, the organization remains responsible for the appropriate lawful basis, authority and safeguards for that patient's information.

12. Changes to this Policy

DawaFill may update this Privacy Policy to reflect legal, security, product or operational changes. Material changes may require renewed acknowledgement or acceptance where appropriate.

13. Contact

Privacy questions may be sent to info@dawafill.com.