Privacy & Data Protection Policy

1. Purpose & Scope

Pharma ገበያ ("we," "our," or "the platform") is committed to protecting the privacy, commercial confidentiality, and regulatory integrity of all healthcare institutions, procurement directors, pharmacists, and medical suppliers who interact with our directory and B2B services.

This Privacy Policy outlines our procedures concerning the collection, storage, encryption, use, and disclosure of data obtained through pharmagebeya.com, our REST APIs, Progressive Web App (PWA), and our official Telegram Bot ecosystem (@PharmaGebeya_bot).

2. Categories of Information Collected

We collect only the information strictly necessary to facilitate verified wholesale healthcare procurement:

• Facility & Institutional Credentials: Official pharmacy or hospital legal name, physical facility address (region, sub-city, woreda, city), authorized contact person, institutional email, phone number, and commercial registration number.
• Regulatory Documents (Suppliers): Scanned copies of Ethiopian Food and Drug Authority (EFDA) Certificates of Competence (CoC), Tax Identification Number (TIN) certificates, and principal trade licenses submitted for verification.
• Procurement & Commercial Records: Requisitions (RFQs), requested active molecules (INN), target quantities, expected delivery dates, supplier proforma bids, accepted proforma records, and direct inquiry messages.
• Market Watchlist Subscriptions: Active molecules (INN), target dosage forms, strength parameters, and designated alert email or Telegram bindings for stock arrival notifications.
• Technical Metadata: IP address, browser user-agent, session identifiers, PWA service worker caching indicators, and anonymized search analytics.

3. Telegram Bot & Telegram WebApp Data Handling

Pharma ገበያ offers deep integration with Telegram to provide instant notifications and a mobile WebApp portal. When you interact with our Telegram Bot:

• Identifiers Stored: We store your numerical Telegram User ID, your Telegram username (if public), and your preferred notification channel settings. We never have access to your personal Telegram private chats, contacts, or phone numbers unless you explicitly share them for verification.
• Cryptographic Authentication: Single sign-on (SSO) via the Telegram WebApp is verified using strict HMAC-SHA256 signature validation against our secure bot token. Session tokens are short-lived and cryptographically signed.
• Provisional vs. Linked Accounts: Interacting directly with the bot without a web account creates an isolated provisional profile. When you link your web account via a single-use token or magic link, data is merged securely with zero constraint duplication.

4. How We Utilize Your Information

We process your information exclusively for legitimate medical supply chain facilitation:

• Procurement Execution: Enabling verified suppliers to view active requisitions and deliver binding proformas to purchasing healthcare facilities.
• Regulatory Due Diligence: Reviewing supplier Certificates of Competence and licenses to maintain an authentic, EFDA-compliant wholesale directory.
• High-Priority Alert Dispatch: Alerting buyers when a scarce drug on their watchlist arrives in stock, or when a supplier responds to an RFQ with a proforma.
• Search Relevance: Calibrating INN molecule synonyms, dosage forms, and brand matching algorithms to improve discovery speed for pharmacists.

5. Data Sharing & Disclosure Boundaries

Your information is shared only under specific, operational circumstances:

• Between Transactional Counterparties: When a buyer posts an RFQ or accepts a proforma, relevant facility contact details and delivery specifications are shared with the participating supplier to facilitate physical delivery and VAT invoicing.
• Direct Wholesaler Communication: When you tap "Call Sales" or "WhatsApp" on a product card, the connection is handed off to your local telephony or WhatsApp client. We do not record or intercept your phone calls.
• Legal & Regulatory Mandatory Compliance: We may disclose information if required to comply with an enforceable court order, formal EFDA safety recall directive, or official investigation into counterfeit or illicit pharmaceutical trafficking in Ethiopia.

6. Technical & Cryptographic Security Standards

Pharma ገበያ employs multi-layered technical security to protect medical supply data:

• Encryption in Transit: 100% of network traffic is encrypted via HTTPS with modern TLS 1.3 cryptographic suites.
• Credential Protection: Passwords are protected using industry-standard PBKDF2 with SHA-256 salted password hashing. We never store plain text passwords.
• Document Access Isolation: Uploaded regulatory business licenses and EFDA competency certificates are stored in restricted access media buckets accessible solely by system verification administrators.
• CSRF & Injection Defenses: All form submissions enforce CSRF token validation and parameterized database queries to prevent unauthorized data manipulation.

7. Notification Preferences & Opt-Out Controls

Every user retains full autonomy over automated communications:

• Profile Notification Toggles: From your Profile Settings, you can independently toggle Telegram vs. Email notifications for Proforma RFQ responses, Direct Inquiries, and Market Watchlist restock alerts.
• 1-Click Watchlist Unsubscribe: Every automated stock alert email contains a secure, 1-click unsubscribe link to immediately deactivate alerts for that specific molecule without requiring login.
• Telegram Unlinking: You may unlink your Telegram account at any time either via the Telegram Settings panel on the web or by sending /stop to the bot.

8. Data Retention & Institutional Rights

In compliance with commercial and pharmaceutical record-keeping norms in Ethiopia, procurement history and accepted proforma transaction logs are retained for auditing and fiscal compliance purposes for a standard period of 5 years.

Registered healthcare entities possess the right to:

• Access and review all registration and licensing data recorded in their profile.
• Request correction of outdated facility details or updated EFDA competency certificates.
• Request account deactivation or removal of unfulfilled active requisitions from the public Procurement Board.

9. Compliance with Ethiopian Data & Electronic Commerce Standards

Pharma ገበያ adheres to the applicable laws and regulatory instruments of the Federal Democratic Republic of Ethiopia, including:

• The Electronic Signature Proclamation and Electronic Commerce regulatory guidelines issued by the Ministry of Innovation and Technology (MInT).
• The National Data Protection and Privacy Principles governing information integrity and fair processing in Ethiopia.
• EFDA proclamations and directives governing the advertisement, disclosure, and wholesale traceability of pharmaceutical substances.

10. Data Protection Officer (DPO) Contact

For questions regarding data protection, document verification, or to exercise your institutional privacy rights, please reach out to our designated Data Protection Officer: