Privacy Policy

NiftyRx provides online stores to licensed Kenyan pharmacies. Each pharmacy is the data controller for its customers' orders and prescriptions; NiftyRx is the data processor that hosts them. For pharmacy applications and accounts on niftyrx.store, NiftyRx is the controller. Contact: niftycafe254@gmail.com.

Your name, phone number, optional email, delivery address and directions, the medicines you order, any prescription you upload, and payment confirmations from M-Pesa. We never see or store your M-Pesa PIN. Prescriptions and medicines are health data, a sensitive category under the Act.

To check prescriptions, dispense and deliver your order, send you order and receipt messages by SMS, WhatsApp or email, keep the dispensing and tax records the law requires, and prevent fraud. If you agree to refill reminders, the pharmacy you order from may text you when a long-term medicine is due. You can stop these any time by replying STOP or asking the pharmacy.

We rely on your consent at checkout, on performing your order, and on legal obligations.

Only the pharmacy you order from's team. Prescriptions open only for the owner and licensed pharmacists, and every view is logged. Riders see only what they need to deliver. Service providers (hosting, SMS, email and M-Pesa payment channels) handle data under contract. Your data is never sold or used for advertising.

Prescription images are deleted automatically 2 years after the order closes; the pharmacist's decision record stays on the register. Order and tax records are kept as long as pharmacy and tax law requires.

You can ask to see, correct or delete your data, object to processing, or withdraw consent. Delete your account yourself from My orders. Records the law requires us to keep are anonymised rather than deleted. We reply within 30 days. You may also complain to the Office of the Data Protection Commissioner (odpc.go.ke).

Data is encrypted in transit, stored in access-controlled systems and separated per pharmacy. Public tracking pages show only a masked name and phone number. If a breach affects you, we will tell you and the Data Commissioner within 72 hours.