Privacy Policy

Mapalo Meds is a digital health and pharmacy platform based in Lusaka, Republic of Zambia. We connect patients with licensed clinicians, store consultation and prescription records, and fulfil medicine orders through Mapalo Meds Lusaka Pharmacy.

• Operator: Mapalo Meds
• Registered / operating address: Cairo Road, Lusaka, Zambia
• Clinic: Mapalo Meds Lusaka
• Pharmacy: Mapalo Meds Lusaka Pharmacy
• Phone: +260 211 000 100
• Privacy enquiries: privacy@mapalomeds.com
• General support: support@mapalomeds.com
• Time zone: Africa/Lusaka

For the purposes of the Data Protection Act, 2021 of Zambia, Mapalo Meds is the data controller for account, billing, and platform data. Licensed doctors and the dispensing pharmacy act as data processors or joint controllers when they create, access, or update clinical records in the course of care.

This Policy applies to everyone who uses Mapalo Meds, including:

• Patients booking consultations, viewing prescriptions, ordering medicines, and tracking deliveries.
• Doctors managing appointments, patient records, consultation notes, prescriptions, messages, lab results, and documents.
• Pharmacy staff processing prescriptions, inventory, customer records, and medicine orders.
• Administrators verifying doctors, managing users, pharmacies, medicines, and reports.
• Visitors to public pages such as login, sign-up, this Privacy Policy, the Terms and Conditions, and the Delete account page.

We collect only what we need to operate a safe healthcare and pharmacy service.

Account and identity information: full name, email address, phone number, password (stored in hashed form), role (patient, doctor, pharmacy, or administrator), profile photo where provided, and Google account identifiers if you sign in with Google.

Patient profile information: age or date of birth, sex/gender, contact details, preferred language, and clinic location.

Clinical and health information: chief complaints, consultation notes, diagnoses, treatment plans, medical history, prescriptions, dosages, lab results, uploaded documents, messages with clinicians or pharmacy staff, and appointment records. This is sensitive personal data and is handled under the Data Privacy section below.

Pharmacy and order information: medicine names, SKUs, quantities, prices in ZMW, prescription status, order numbers, delivery status, delivery address, and dispensing pharmacist details.

Professional information (doctors and pharmacy staff): practising name, specialty, licence or verification status, clinic affiliation, and work contact details.

Technical information: device type, browser, IP address, approximate location derived from IP, language preference, login timestamps, and security logs. We use this to keep the platform secure and working.

We do not knowingly collect national registration card numbers, bank PINs, or biometric templates unless a future feature requires them and you are told first.

This Data Privacy Notice explains how we process health and other sensitive information on Mapalo Meds. It forms part of this Privacy Policy.

Why we process health data: to provide teleconsultations, keep an accurate medical record, issue and dispense prescriptions, fulfil medicine orders, coordinate care between your doctor and the pharmacy, send clinically relevant reminders, meet medicines and professional-regulatory duties, and handle complaints or safety incidents.

Legal bases: we process health data because it is necessary to provide healthcare and pharmacy services you request; because a health professional who is subject to a duty of confidentiality is providing care; because you have given explicit consent where required (for example, optional sharing or marketing); and where the law requires us to keep records, report adverse events, or cooperate with regulators such as the Health Professions Council of Zambia (HPCZ), the Zambia Medicines and Medical Supplies Agency (ZAMRA), or the Data Protection Commissioner.

• Access is role-based. A patient sees their own records. A doctor sees patients under their care. Pharmacy staff see prescriptions and order details needed to dispense and deliver. Administrators see operational data, not full clinical notes, unless a safety, audit, or support case requires it.
• Messages between patients, doctors, and pharmacy staff may contain health information and are stored as part of the care record.
• Lab results and uploaded documents are stored so your clinician can review them during and after a consultation.
• We do not sell health information. We do not use health records to train public AI models or for unrelated advertising.
• We do not make solely automated decisions that produce legal or similarly significant effects about your diagnosis or treatment. Clinical decisions are made by licensed professionals.
• If we ever use decision-support tools, a clinician remains responsible for the prescription or advice issued to you.

Confidentiality: doctors, pharmacists, and authorised staff must keep patient information confidential in line with professional ethics and Zambian law. Unauthorised access, browsing of records without a care need, or sharing of screenshots of patient data is prohibited and may lead to account suspension and referral to the relevant regulator.

Minimisation: we ask clinicians and staff to record only information that is relevant to care, dispensing, billing, or legal duties. You can ask us to correct incomplete or inaccurate health information; we may need the treating clinician to confirm a clinical correction.

• Create and secure your account, including “remember me” and password reset.
• Book, remind, and manage appointments and consultations.
• Maintain medical history, prescriptions, lab results, and documents.
• Let doctors message patients and coordinate with the pharmacy on stock or substitutions.
• Process, pack, and deliver medicine orders within our delivery area.
• Verify doctors, manage pharmacy locations, inventory, and low-stock alerts.
• Produce operational reports (orders, revenue in ZMW, inventory) for authorised staff.
• Send service messages such as prescription ready, out for delivery, or appointment reminders.
• Detect fraud, abuse, and unauthorised access.
• Comply with medicines, tax, consumer, and data-protection law.
• Improve reliability, language support, and user experience of the Services.

We process personal data under the Data Protection Act, 2021 on one or more of these bases:

• Contract: to provide the account, consultation, prescription, and pharmacy services you request.
• Consent: for optional cookies, marketing messages, Google sign-in, and any use that the law says needs explicit consent (including some health-data uses).
• Legal obligation: record-keeping, medicines regulation, professional regulation, tax, and lawful requests from authorities.
• Vital interests: to protect life or health in an emergency, where we have enough information to act.
• Legitimate interests: platform security, service improvement, and preventing misuse, balanced against your rights.
• Healthcare: processing of health data by or under the responsibility of a professional subject to confidentiality, for the provision of health or pharmacy services.

You may withdraw consent at any time where processing is based on consent. Withdrawal does not affect care already provided or records we must keep by law.

We share information only as needed to deliver care and run the platform:

• With your treating doctor and authorised clinic staff at Mapalo Meds Lusaka.
• With Mapalo Meds Lusaka Pharmacy to validate prescriptions, dispense, substitute when clinically appropriate, and deliver orders.
• With delivery partners, limited to name, phone, address, and parcel details — not your full medical file.
• With payment providers if you pay for consultations or medicines (amount, reference, and payer details — not clinical notes).
• With Google if you choose “Continue with Google”, subject to Google’s own privacy policy.
• With infrastructure, hosting, email, and security vendors who process data on our instructions and under contract.
• With regulators, courts, or law-enforcement where Zambian law requires or permits disclosure.
• With a successor organisation if Mapalo Meds is reorganised, provided they continue to protect the data to this standard.

We do not sell personal information. We do not share health records with advertisers.

We use necessary cookies and similar storage to keep you logged in, remember language (for example English), and protect the session. These are required for the Services to function.

If you sign in with Google, Google provides us with the account identifiers needed to create or match your Mapalo Meds profile. Google’s processing is governed by Google’s privacy policy. You can disconnect Google sign-in by contacting support.

We do not use third-party advertising cookies on the clinical portals.

We store information on systems designed for healthcare operations, with access controls, encryption in transit, hashed passwords, role-based permissions, and audit logs for administrative and clinical access where appropriate.

• Account data: kept while your account is active and for a reasonable period afterwards so we can restore access or resolve disputes.
• Health and prescription records: kept for at least the period required for medical and pharmacy records in Zambia, and longer if a claim, investigation, or law requires it.
• Order, inventory, and billing records: kept for tax and accounting periods applicable in Zambia.
• Security logs: kept for a limited period to investigate incidents.

No online service is perfectly secure. You must keep your password private, log out on shared devices, and tell us promptly at support@mapalomeds.com if you suspect unauthorised access.

If a personal-data breach is likely to affect your rights, we will notify you and the Data Protection Commissioner as required by law.

Mapalo Meds is established in Zambia. Some vendors (for example cloud hosting or Google authentication) may process data outside Zambia. Where that happens, we take steps required by the Data Protection Act, 2021, such as contractual safeguards and limiting the data sent, so that your information remains protected.

Subject to the Data Protection Act, 2021 and medical-record rules, you may:

• Be informed about how we use your data (this Policy).
• Access a copy of personal data we hold about you.
• Request correction of inaccurate or incomplete data.
• Request erasure where the law allows (we may retain clinical and dispensing records we are required to keep).
• Request deletion of your account and associated personal data on the public Delete account page, without signing in.
• Request restriction of, or object to, certain processing.
• Withdraw consent where processing is based on consent.
• Request portability of data you provided, in a commonly used format where technically feasible.
• Lodge a complaint with Mapalo Meds and with the Data Protection Commissioner of Zambia.

To delete your account, open the Delete account page (/delete-account) or email privacy@mapalomeds.com from the address on your account. For other rights, email the same address and tell us what you need. We may verify your identity before responding. We aim to reply within the timeframes set by law.

Parents or legal guardians may exercise rights on behalf of a child whose account they manage.

Mapalo Meds accounts are intended for adults aged 18 years or older. A parent or legal guardian may use the Services on behalf of a child, including booking a consultation or ordering prescribed medicines. We do not knowingly allow a child to create an unsupervised account. If you believe we have collected a child’s data without proper authority, contact us and we will take appropriate action.

We send service messages that are part of care and orders (appointment reminders, prescription alerts, delivery updates). These are not marketing and you cannot opt out of them while you use the Services, except by closing your account.

Optional health tips or promotional offers are sent only with your consent. You can opt out by using the unsubscribe link or emailing support. Currency for any priced offer is ZMW (K).

We may update this Privacy Policy and Data Privacy Notice from time to time. The effective date at the top of this page will change. Material changes that affect your rights will be notified in the app or by email where we have a working address. Continued use after the effective date means you accept the updated Policy, except where the law requires fresh consent.

Questions about privacy, data access, or this notice:

• Privacy officer: privacy@mapalomeds.com
• Support: support@mapalomeds.com
• Phone: +260 211 000 100 (Monday–Saturday, 08:00–20:00 CAT)
• Address: Cairo Road, Lusaka, Zambia

If we cannot resolve your concern, you may complain to the Data Protection Commissioner of Zambia. You also keep any rights you have under consumer and health-professional law.