Privacy Policy
Draft — not reviewed by a lawyer. Adapted from
General-Legal's CC0 templates,
which is written for U.S. law (CCPA etc.). Rewritten around Nigeria's
Data Protection Act/NDPR instead — see the change list at the bottom.
Sections describing data we don't actually collect (accounts, social
login, AI chat, marketing profiling) were removed rather than kept as
unused boilerplate.
Effective: [DATE]
What we collect
When you place an order, we collect: your name, phone number, email
address, delivery address, and the items you ordered. We do not
require an account or a password to buy from us.
We do not currently use tracking cookies or analytics beyond what's
operationally necessary to run the Site (e.g. remembering a
part-filled checkout form in your browser's local storage, which
never leaves your device). If that changes — analytics, marketing
pixels — this policy will be updated first, not after.
How we use it
- To create your order and arrange delivery.
- To process payment through [Paystack — confirm], who
handles your card/bank details directly; we don't store them.
- To contact you about your order (confirmation, delivery updates).
- To meet legal and regulatory obligations.
Who we share it with
- The fulfilling pharmacy hub — your name, phone,
address, and order contents, so they can pack and deliver it.
- Our payment processor — to process your payment.
- Law enforcement or regulators, where legally required.
We do not sell your personal information to anyone.
Your rights
Under Nigeria's Data Protection Act 2023 (and the NDPR), you have the
right to know what personal data we hold about you, ask us to correct
it, ask us to delete it, and object to certain processing. To
exercise any of these, contact us at
[privacy email — see Contact page].
How long we keep it
We keep order and delivery information for as long as needed to
fulfil the order, handle any dispute or return, and meet our legal
and tax record-keeping obligations.
Security
We use reasonable technical safeguards to protect your information,
but no method of transmission or storage is 100% secure.
Children
The Site is not intended for anyone under 18. We do not knowingly
collect information from children.
Changes to this policy
We may update this policy. Material changes will be posted here with
a new effective date.
Contact
Questions about this policy or your data: [privacy email].
What needs changing before this is real
- Confirm this is actually governed by NDPR/Nigeria Data Protection
Act and not some other framework — get a Nigerian data-protection
lawyer to check, don't take my word for it.
- Confirm Paystack is the only payment processor.
- Add a real privacy contact email (can be the same support address
as Contact, or a dedicated one).
- If analytics/marketing tracking gets added later, this policy
needs updating before that ships, not after.
- Confirm data retention period against any real regulatory/tax
record-keeping requirement, not the vague placeholder above.
- Add a real effective date once approved for publishing.