Privacy Policy

Last Updated: February 2026. This Privacy Policy describes how Brown's Pharmacy (collectively, "we", "us", or "our") collects, uses, and discloses your personal information when you visit or make a purchase from brownspharmacy.co.ke (the "Site").

1. Legal Framework and Consent

By using our services, you explicitly consent to the processing of your data as outlined here. We operate under the Data Protection Act of Kenya (2019) and the Pharmacy and Poisons Act (Cap 244). We act as both a Data Controller and a Data Processor for your health-related information.

2. Comprehensive Data Collection

We collect information in three primary categories:

• A. Personal Identification: Full legal name, date of birth (to verify age for restricted medication), and Gender.
• B. Sensitive Health Information: Digital copies of prescriptions, doctor’s notes, symptomatic descriptions, and diagnostic results from Dr. Kalebi Labs. This is treated as "Special Category Data" under Kenyan law.
• C. Transactional and Device Data: M-Pesa phone numbers, billing addresses, IP addresses, and browsing behavior via cookies to optimize your user experience.

3. Purpose of Processing

We process your data only when we have a legal basis to do so:

1. Clinical Fulfillment: To verify the authenticity of prescriptions and ensure the correct dosage is dispensed by our licensed pharmacists.
2. Last-Mile Logistics: To fulfill our promise of 30-minute to 3-hour delivery within Nairobi.
3. Regulatory Compliance: To maintain the mandatory 'Prescription Book' records required by the Pharmacy and Poisons Board (PPB).
4. Health Monitoring: To provide follow-up care and medication adherence reminders.

4. Data Sharing and Third Parties

Your privacy is not for sale. We share information only with the following entities:

• Diagnostic Partners: Relevant details shared with Dr. Kalebi Labs for lab test processing.
• Courier Partners: Name and location shared with our internal and external riders for secure delivery. All riders are bound by strict confidentiality agreements.
• Payment Gateways: M-Pesa (Safaricom) and encrypted card processors for secure transaction settlement.

5. Security, Storage, and Retention

We employ 256-bit SSL encryption. Your data is stored on secure servers with restricted access. Pursuant to the Pharmacy and Poisons Board regulations, certain medical records must be retained for at least 2 years, after which they are securely purged or anonymized for statistical research.

6. Your Rights as a Data Subject

Under Kenyan law, you have the right to:

• Request a copy of the personal data we hold about you.
• Object to the processing of your data for marketing purposes.
• Request the correction of inaccurate medical or personal information.
• Request the deletion of your account and associated data (subject to legal retention requirements).