Your privacy matters. This Policy explains what personal data Cervos collects, how we use it, and the choices and rights you have.
1. Who We Are
Cervos operates the Cervos pharmacy management platform ("Service"). We are committed to protecting your personal information and being transparent about how we collect and use it. For questions, contact our Data Protection Officer at privacy@cervos.online.
2. Information We Collect
We collect information you provide directly: account registration details (name, email, phone, entity name, account type); payment and billing information (processed securely by our payment provider); pharmacy and branch operational data you enter into the Service (inventory, transactions, staff); and supplier catalogue and order data. We also collect automatically: usage logs, IP addresses, device identifiers, and session data through cookies and similar technologies.
3. How We Use Your Information
We use your information to: provide, maintain and improve the Service; process transactions and send related notices; send operational and security alerts; respond to your support requests; comply with legal obligations; and detect and prevent fraud or abuse. We do not sell your personal data to third parties. We may use anonymised, aggregated data for product research and public reporting.
4. Legal Basis for Processing (GDPR & Tanzania PDPA)
Where applicable, we process personal data on the following legal bases: performance of a contract (providing the Service); compliance with legal obligations (financial record-keeping, regulatory reporting); legitimate interests (security monitoring, fraud prevention, product improvement); and consent (marketing communications, which you may withdraw at any time).
5. Data Sharing
We share your data only with: (a) trusted service providers who process data on our behalf (cloud hosting, payment processing, email delivery) under strict data processing agreements; (b) regulators or law enforcement where required by law; and (c) a buyer or successor entity in the event of a merger or acquisition, with prior notice to you. We never sell your data for advertising purposes.
6. Data Retention
We retain your account data for the duration of your subscription and for up to 7 years thereafter for financial and compliance purposes, or as required by Tanzanian law. Operational pharmacy data (transaction logs, inventory records) is retained for the period you maintain an account plus 5 years for audit purposes. You may request earlier deletion of non-legally-required data by contacting privacy@cervos.online.
7. Security
We protect your data with TLS encryption in transit, AES-256 encryption at rest, role-based access controls, multi-factor authentication options, regular penetration testing, and comprehensive audit logging. If we become aware of a data breach affecting your personal data, we will notify you and the relevant authorities within 72 hours as required by law.
8. Your Rights
Depending on your jurisdiction, you have rights to: access your personal data; correct inaccurate data; request deletion of data we are not required to retain; object to or restrict certain processing; port your data in a machine-readable format; and withdraw consent at any time. To exercise these rights, email privacy@cervos.online. We will respond within 30 days.
9. Cookies
We use strictly necessary cookies to maintain your session and authentication state. We use analytics cookies (with your consent) to understand how the Service is used. You can manage cookie preferences in your browser settings. Disabling necessary cookies will prevent you from logging in to the platform.
10. International Transfers
Your data is primarily stored on servers in the European Union (Supabase infrastructure). Where data is transferred outside Tanzania or the EEA, we ensure adequate protections are in place through standard contractual clauses approved by relevant data protection authorities.
11. Children's Privacy
The Service is not intended for use by persons under 18. We do not knowingly collect personal data from children. If you believe a child has provided us with personal data, please contact privacy@cervos.online and we will promptly delete it.
12. Changes to This Policy
We will notify you of material changes to this Policy by email and in-platform notice at least 14 days before they take effect. The current version is always available at cervos.online/privacy.
13. Contact Us
Data Protection Officer: privacy@cervos.online · General: hq@cervos.online · Cervos, Dar es Salaam, United Republic of Tanzania.