Customer information
Customer and patient privacy policy
Draft for pharmacy and legal review. Review version 2026-10-29, 29 October 2026. How RDC Pharmacy handles information through this storefront and its care services.
1. Who is responsible and how to contact us
RDC Pharmacy is responsible for the customer and patient records it collects for its sales and care purposes. Use the Contact page and the business details displayed on this website for privacy requests or the pharmacy's privacy contact. Aura Inventory is the software supplied by Savans Technologies, 1, Sunday Akinbo Street, Adebiyi Estate, Command Ipaja, Lagos, Nigeria; platform privacy contact: support@aurainventory.com. Aura normally processes pharmacy workspace records on the pharmacy's instructions and has separate responsibilities for its own platform administration. The pharmacy must confirm its full legal identity, address and privacy contact before adopting this notice.
2. Information and sources
We receive information from you, authorised representatives, pharmacy staff, uploaded prescriptions and reports, orders, calls, care interactions and connected providers. Records can include name, contacts, address, age/birth date, account and security records, purchases, payment references, delivery details, appointments, messages, preferences, loyalty activity and care records. Health records can include allergies, medicines, conditions, blood group, genotype, test results, clinical notes, prescription/lab pictures and follow-ups. Only provide another person's records with appropriate authority.
3. Uses and lawful grounds
We use necessary information to handle enquiries, authenticate accounts, assess prescriptions, provide care, process orders, take payment, deliver goods, send service updates, maintain required records and prevent misuse. We must identify an appropriate lawful ground for each purpose and an additional applicable condition for sensitive health or genetic data. Contract, legal duties, appropriate healthcare conditions and consent may apply depending on the purpose; no single ground automatically covers everything. Optional marketing, recording or sensitive AI processing requires its own assessment and permission where required. Accepting a general notice is not blanket consent.
4. People and providers who may receive information
Authorised pharmacy staff and lawful representatives may access relevant records. Aura and its approved hosting, storage and support providers process records for enabled services. Payment providers such as Paystack, couriers such as FEZ, messaging providers such as Brevo, Termii and Meta, and enabled meeting or AI providers can receive the information needed for the specific task. Paystack handles card entry and processing for enabled online-store payments. Aura does not store customers' full card numbers, CVV/security codes or card PINs. Payment references, provider authorisation tokens, webhook records and limited payment metadata may be retained to verify transactions, reconcile orders and resolve disputes. Some providers act independently for their own legal purposes. We may disclose information where legally required with an appropriate basis. We do not sell personal information. Ask the pharmacy for its actual recipient schedule; a possible integration is not evidence it is enabled.
5. Clinical AI, images and voice
If used, AI tools can process relevant health facts, notes, report/prescription pictures, conversations or speech through the actual configured provider. Text minimisation does not guarantee anonymity and does not redact pictures or live audio. The pharmacy must explain the proposed use and recipients, check provider retention/training terms and transfers, and establish the necessary lawful authority before use. AI is reviewed by clinical staff and does not replace professional judgement. Ask about an alternative where you object to an optional AI feature.
6. Calls, captions and recordings
Remote consultations can use Agora, Google Meet or another identified provider. Captions, translation or recording can generate transcripts or audiovisual files and may use separate storage. We must tell you the purpose, recipients and retention and obtain any specific permission required before starting. Joining a call does not itself authorise recording. Ask your clinician to stop an optional feature or discuss an alternative. Camera and microphone permissions can be changed on your device.
7. Messages, marketing and preferences
Order, account, appointment and security notices support the service you request. Promotional email, SMS and WhatsApp choices are separate; buying an item or receiving a receipt is not marketing permission. Birthday campaigns and loyalty messages must follow the relevant preference. Change available account settings, use an unsubscribe option or contact the pharmacy to object or withdraw consent. Withdrawing marketing permission does not stop essential service notices. Aura-branded WhatsApp fallback, where offered, has a separate choice.
8. Cookies, analytics and device copies
Authentication cookies, browser storage and app caches support sign-in, preferences and offline features. Configured analytics may include PostHog, Vercel Analytics and Google Analytics and can process device/network information, identifiers and page activity. Fields differ by provider; some configurations may include URLs and query strings. Do not put health information in a URL. Applicable non-essential tracking requires a real notice and consent choice; this page does not itself collect that consent. Device settings can limit permissions and storage. Downloaded records and offline copies need separate protection.
9. Location of processing, security and retention
Providers may process information outside Nigeria; the responsible parties must establish appropriate transfer protection before disclosure. Access restrictions and security features reduce risk but cannot guarantee absolute security. Records are kept for the relevant care, transaction, legal, security or claims purpose and then deleted or restricted appropriately. Clinical, tax, consent and audit records can need longer retention than an account. Ask for the pharmacy's category-specific retention periods and actual storage countries; deactivation does not automatically erase records or backups.
10. Children and representatives
Care for a child or another person must be supported by appropriate guardian or representative authority or another lawful ground. The pharmacy must give a suitable explanation and verify authority where required. Adult business-account rules are separate from a child's access to healthcare. Do not submit a child's sensitive record without the necessary authority.
11. Your rights, requests and complaints
Subject to applicable conditions, you may request information, access, correction, deletion, restriction, objection, portability and review of qualifying solely automated decisions, and withdraw consent. Contact the pharmacy through its Contact page; platform questions can go to support@aurainventory.com. We may verify identity proportionately and explain legal retention or other lawful limitations. We respond within applicable legal deadlines. Available patient JSON exports do not include every image, chat or recording; ask for any additional records needed. You may complain directly to the Nigeria Data Protection Commission at ndpc.gov.ng or seek a legal remedy without finishing an internal process.
12. Changes
The pharmacy must identify adopted versions and give appropriate notice of material changes, obtaining further consent or acceptance where needed. Expanding services or operating in another country requires review of the applicable local obligations. Editing a notice does not retrospectively authorise a new incompatible purpose.
Need help or clarification?
Contact the pharmacy