Privacy Policy

This policy applies to all Famasia services (including the website famasia.app, the Famasia console console.famasia.app, the administration panel admin.famasia.app, and the iOS/Android mobile app called “Famasia”). We refer to them together as the “Services”.

The owner of the data is Famasia Limited, a company registered in Tanzania. To contact us, send an email to hello@famasia.app.

1. Information we collect

1.1 Information you provide

• Account: name, phone number, PIN (hashed with bcrypt), role (Owner, Admin, Pharmacist, Seller), profile photo (optional).
• Your pharmacy: pharmacy name, address, location (latitude/longitude if you choose to share it), licence number, logo image (optional).
• Stock and sales: medicines, batches, prices, estimates, sales, debts, customers, expenses, that is, the data you enter to run your pharmacy.
• Payments:payment details (amount, the customer's phone number for M-Pesa/Tigo Pesa/Airtel Money, Selcom identifier). We do not store mobile money PINs or full bank card numbers. Those are processed directly by Selcom.

1.2 Information we collect automatically

• Usage logs: IP address, date and time of sign-in, device type (iPhone/Android/browser), app version, pages visited.
• Cookies: the authentication token famasia_token (15 minutes), the refresh token famasia_refresh_token (7 days), the device identifier famasia_device_id (1 year). More about cookies here.

1.3 Your customers' information

When you record your customers (name, phone number, debt details) in Famasia, that information becomes part of your pharmacy's database and is governed by you as the data controller. Famasia acts as a data processoron your behalf. It is your responsibility to obtain your customers' consent to store that information.

1.4 Permissions on your device (mobile app)

The mobile app may request the following permissions. Each permission is requested only when you start the action that needs it, and you can decline without blocking other uses of the app:

• Contacts:when you tap “Choose from phone contacts” while adding a customer, the app reads only the single contact you pick (name and phone number) to fill in the customer form. We do not read, upload or store your whole contact list.
• Location:when signing up you can tap “Use my location” to capture latitude/longitude once and set your pharmacy's location. It is optional, and you can skip this step. We do not track your location while you are outside the app (there is no background tracking).
• Camera: to scan medicine barcodes and to take photos you choose to upload (logo, medicine photos, proof of payment).
• Photos (photo library): to read photos you choose and to save receipts to your photos when you share a receipt.
• Bluetooth: only to connect a receipt printer.

2. How we use information

• To let you sign in and use our services.
• To operate, protect and improve the Services (for example preventing fraud, fixing errors, adding new features).
• To send you important messages (plan changes, payment reminders, warnings about medicines nearing expiry, system notices).
• To process payments through Selcom.
• To comply with the law (for example TRA requirements, consumer protection laws).

We do not sell your personal information to advertisers, and we do not shareyour customers' information with other pharmacies.

3. Third-party service providers

To run Famasia, we use the following trusted service providers, who receive only part of the information and only for technical purposes:

• Vercel Inc. (USA): hosting the website and console. Data travels through an edge cache before reaching our servers.
• Amazon Web Services (Cape Town, af-south-1): PostgreSQL database and S3 bucket (images). We choose the Cape Town region so your data stays close.
• Selcom Payments (Tanzania): processing mobile money and card payments. You are given a secure token; we do not see your PINs or cards.
• Africa's Talking (Kenya/Tanzania): sending SMS and WhatsApp messages to your customers and users.
• Twilio (USA): sending WhatsApp messages (alternative route).
• OpenAI (USA): interpreting images and stock sheets you upload (AI for the daily summary and stock entry). Data you send to the AI is not used to train their models.
• Google: Google Fonts (typography only), Google Play Services (for the Android app).
• Apple: App Store + iOS push notifications.

Each partner has signed a data protection agreement. Information cannot be transferred to any third party without your consent or a legal obligation.

4. Where data is stored

The main database is in Cape Town, South Africa (AWS region af-south-1). Backup copies are stored on S3 within the same region. Some data (for example Vercel logs, Twilio messages) may briefly pass through servers in the United States or Europe as part of technical operation.

5. Retention period

• Account and pharmacy data: for as long as your account is active. If you delete your account (see Delete your account), the main data is deleted within 30 days. Backup copies are deleted within 90 days.
• Security logs: 365 days, then deleted automatically.
• Payment information: 7 years, in line with Tanzania tax law (TRA).

6. Security

• PINs are stored securely with bcrypt (no PINs are stored as plain text).
• All connections use HTTPS/TLS.
• Account tokens (JWT) are signed with an unshared secret, expire after 15 minutes, and carry httpOnly, secure, sameSite: lax.
• Every administrative action is written to an “audit log”.
• Protection against PIN guessing (lockout after 5 failed attempts within 10 minutes).

No system is completely secure. If we find that your information has leaked, we will inform you within 72 hours, in line with Tanzanian law.

7. Your rights

You have the following rights over your personal information:

• Access: request a copy of all the information we hold about you.
• Rectification: correct inaccurate information through settings or by email.
• Erasure: ask us to delete your account and all data. Follow the instructions in Delete your account.
• Portability: ask to receive your data in an electronic format (CSV / JSON).
• Objection: if you feel we are using your data improperly, send a complaint.

To submit a request, send an email to hello@famasia.app. We will reply within 30 days.

8. Children

Our services are not intended for children under 18. We do not collect information about children. If you discover that a child has registered, let us know and we will delete that account promptly.

9. Changes to this policy

We may update this policy from time to time. We will notify you of significant changes by email or an in-app notice at least 14 days before they take effect. The date of the latest review is shown at the top of this page.

10. Governing law

This policy is governed by the laws of the United Republic of Tanzania, including the Personal Data Protection Act, 2022 (Act No. 11 of 2022). Any dispute arising from this policy will be handled through the designated courts in Dar es Salaam.

11. Contact us

For privacy questions, a data access request, or complaints, send an email to: hello@famasia.app. Postal address: Dar es Salaam, Tanzania.

Note: this document is general information, not legal advice. For individual legal matters, contact your own lawyer.