Privacy Policy

1. What we collect

When you register and set up your account: your name, your email address, the pharmacy's name and country, then your mobile number, the pharmacy's city, area and street address, and its location as reported by your device or as you place it on a map, a photo or scan of the pharmacy's registration or licence if you choose to submit one, the language you use, the time you registered and the network address it came from, and the fact that you accepted the Terms and this Policy and which version.

When an account is opened: the pharmacy's licence number, address, city and area as entered by you or by an administrator, the contact person, and any further verification documents you upload.

When you use the Platform: the listings you publish, the requests, offers, counter-offers, acceptances, cancellations and completions you make, the medicines you follow and the listings you save, what you search for, the listings and pages you open, when you sign in, which client you use (web, Android or iOS), and the notifications and emails sent to you.

When you write to us, by email or through the contact form: your name, the email address and pharmacy you give, your message and whatever it contains, the language you wrote in, the account you were signed in to if any, and the network address it came from.

We do not collect payment card details, patient data, or the contents of prescriptions. Do not enter such data anywhere on the Platform.

2. Why we collect it

To open and secure an account and to verify that the applicant represents a licensed pharmacy. To operate the Platform: show listings, compute distances, match requests to stock, send verification and password emails and deliver notifications. To let two pharmacies that have agreed terms reach each other, and to show a request posted under "I need" to the pharmacies it reaches. To keep the Platform secure, to detect and prevent misuse, fraud and unlawful transfers, and to enforce the Terms. To keep records that demonstrate compliance and resolve disputes. To understand how the Platform is used and improve it. To meet legal obligations and respond to lawful requests from competent authorities.

3. Who sees it

Other pharmacies see your pharmacy's name, city, area, approximate distance, listings and, once you and they have agreed terms on a specific deal, the pharmacy's phone number, contact person and street address for that deal only. A selling pharmacy's name and area are hidden until it accepts a request; until then a buyer sees only its city and approximate distance. They never see your application, your documents, your email address, your searches or your other deals. When you post a request under "I need" and agree to it, pharmacies in your country within the distance you choose also see your pharmacy's name, city, approximate distance and telephone number, and the medicine and quantity you asked for, until the request closes.

RxLoop's administrators see everything above in order to verify, support and supervise accounts.

Service providers that host, store, back up, send email for or transmit data for RxLoop process it on RxLoop's instructions and may not use it for their own purposes. Some of them operate outside your country, so data may be stored or processed abroad.

Competent authorities, including medicines regulators, ministries of health, pharmacists associations, courts and law enforcement, receive data where RxLoop is required to provide it, where RxLoop reasonably believes a transfer may be unlawful or unsafe, or to establish, exercise or defend legal claims.

A buyer or successor of the Platform receives the data as part of the business. RxLoop does not sell personal data and does not use it for third-party advertising.

4. What you are responsible for

You are responsible for the personal data you enter about anyone else, including your staff and your contact person: for being entitled to provide it, for its accuracy, and for telling that person that it is on the Platform.

Once another pharmacy's contact details are shared with you, you are responsible for what you do with them. Use them only to complete the agreed transfer, or to offer a pharmacy what it asked for under "I need", keep them secure, and do not publish them, sell them, add them to a marketing list or use them for any other purpose. RxLoop is not responsible for what another pharmacy does with data you give it, on or off the Platform.

5. Location

The location you provide when setting up your account is taken as the pharmacy's location, which is why you are asked to be at the pharmacy when your device provides it, or to place it where the pharmacy is when you use the map. The map is Google Maps, except in Syria, where Google does not offer it, and whenever Google's map cannot load, when it is OpenStreetMap. While it is open, your browser or the app loads the map from Google or from the OpenStreetMap Foundation, which receives your network address, your browser's identification, the address of this site and the area shown, under its own privacy policy (Google's: https://policies.google.com/privacy). The location is used to sort and filter listings by distance, to decide which pharmacies a request under "I need" reaches, and to show other pharmacies an approximate distance, never your coordinates. You can correct it under Account, and an administrator can correct it on request.

6. How long we keep it

Applications and verification documents, whether approved or declined, are kept for as long as the Platform operates and for as long afterwards as the law or a reasonable need to demonstrate due diligence requires. Account, listing, deal and audit records are kept for the life of the account and for a further period sufficient to resolve disputes and meet legal obligations. Usage records may be kept in aggregated form indefinitely. Where data is no longer needed it is deleted or anonymised. Messages sent through the contact form are kept for as long as needed to answer them and as a record of the exchange, then deleted or anonymised.

7. Security

Passwords are stored only as salted hashes. Email verification and password reset links are single use and expire. Documents are stored outside the web root and are served only to their owner and to administrators over an authenticated connection. Data is transmitted over encrypted connections. Administrator actions are logged. No system is perfectly secure, RxLoop does not warrant that it is, and you must keep your password confidential and report any suspected compromise at once.

8. Your rights

You may ask to see the personal data RxLoop holds about you or to correct it, and you may delete your account yourself under Account, or ask RxLoop to close it. RxLoop will act on such requests within a reasonable time, subject to its need to retain records for the purposes in section 6, and may need to verify your identity before acting. Requests are made to [email protected].

9. Contact

Questions about this Policy may be sent to [email protected] or through the contact form on the Platform. These are the only contact channels RxLoop operates. RxLoop does not publish a postal address or a telephone number during this phase.

10. Changes and law

RxLoop may change this Policy by publishing a new version on the Platform; continued use is acceptance. This Policy is available in Arabic, English and French. Where the versions differ or are interpreted differently, the Arabic version prevails.