Privacy Policy

Strongreed Technology Limited ("Strongreed", "we", "us", "our") respects your privacy and is committed to protecting the personal data of everyone who interacts with KwickPharm, including subscribing Pharmacies and their staff, Retail Users and patients (including those accessing pharmacy services via EazyMed), Wholesale Buyers, and clinicians connected through FastKlinik (together, "you"). This Privacy Policy explains what personal data we collect, how and why we collect it, how we use and share it, how long we keep it, and what rights you have in respect of it.

This Policy applies to all personal data processed through the KwickPharm platform and its related applications, dashboards, point-of-sale systems and APIs, operated on the shared Strongreed PaaS. It should be read together with our Terms of Service, which it is incorporated into by reference.

Because a KwickPharm transaction frequently begins or continues on EazyMed (patients ordering medication) or FastKlinik (doctors issuing prescriptions), this Policy is deliberately framed so that the treatment of retail/patient personal data on KwickPharm is implemented consistently with, and does not fall below the standard of, the EazyMed Privacy Policy. Section 15 sets this out in full.

Strongreed Technology Limited, with its registered office in Victoria Island, Lagos, Nigeria, is the data controller in respect of personal data processed through KwickPharm. Where your data also flows through EazyMed (patient ordering and payment), FastKlinik (electronic medical records and e-prescription) or KwickLab (laboratory results), the entity operating that product acts either as a joint controller together with Strongreed, or as an independent controller of its own product, in each case to the extent it determines the purposes and means of processing that data for its own product. Strongreed Books, a bookkeeping and accounting service made available to providers across the Strongreed Group (and which also makes embedded finance and credit decisioning available, whether or not a provider subscribes to its bookkeeping functionality), acts as an independent controller for the bookkeeping, credit-related or finance data it processes, subject to its own terms and privacy disclosures.

This layered structure reflects the fact that KwickPharm, EazyMed, FastKlinik, KwickLab and Strongreed Books are products of the Strongreed Group operating on a shared technical platform (the Strongreed PaaS) but serving distinct regulatory and commercial functions. We remain responsible for personal data while it is within KwickPharm’s processing scope, as described in this Policy.

• "Personal Data": Any information relating to an identified or identifiable natural person, as defined under the NDPR.
• "Special Category Data" / "Sensitive Personal Data": Personal data revealing health status, genetic or biometric data, and other categories the NDPR treats as requiring heightened protection.
• "Processing": Any operation performed on personal data, including collection, storage, use, disclosure, and deletion.
• "Data Subject": The identified or identifiable natural person to whom personal data relates (you).
• "NDPR": The Nigeria Data Protection Regulation 2019, the Nigeria Data Protection Act 2023, and subsidiary guidance issued by the Nigeria Data Protection Commission ("NDPC").
• "Healthcare Intelligence System": A planned automated fraud, medication-safety, interaction and longitudinal scoring layer, described prospectively in Section 8, which is not generally available as of the Effective Date and will be introduced in phases as it is built and released.
• "Poison Book": The statutory controlled-substance dispensing register a Pharmacy is required to maintain under the National Health Act 2014, NAFDAC regulations and applicable NDLEA rules, whether maintained manually, in a dedicated Service module as and when released, or by another lawful means.

The personal data we collect depends on whether you interact with KwickPharm as a Pharmacy/staff member, a Retail User/patient, a Wholesale Buyer, or a connected clinician. We collect the following categories:

• Identity and contact data: Full name, date of birth, gender, phone number, email address, residential or business address, National Identification Number (NIN).
• Account and verification data: Login credentials, device identifiers, account creation date, KYC verification status, professional licence number (PCN registration for pharmacists; MDCN folio number for doctors), institutional registration and CAC status for clinics/corporates.
• Transaction and financial data: Purchase history, order details, invoices, pricing channel (retail/wholesale), credit account balances and limits, refund and credit-note records, payment references. Card and bank account details are collected and held by our third-party payment service providers, not directly by Strongreed.
• Health and medication data: Prescriptions, dispensed medication history, dosage and frequency, dose-intake reports, allergies, medical conditions, acute infectious disease flags, adverse-effect reports, and controlled-medicine dispensing records (Poison Book entries).
• Behavioural and device data: App/device usage data, IP address, approximate location at time of order or prescription-image upload, prescription-image metadata used for fraud-integrity checks, dose-intake timing patterns.
• Professional and institutional data (staff/clinicians): Staff role and permissions, dispensing records attributed to a staff member, doctor verification tier, prescription-approval history.
• Communications data: Records of support requests, in-app messages, notification delivery logs (email, SMS, WhatsApp, push).

Because KwickPharm is a healthcare platform, a substantial portion of the personal data we process — prescriptions, dispensed medication, allergies, medical conditions, adverse-effect reports, and controlled-substance dispensing records — constitutes special category (sensitive) personal data under the NDPR. We process such data only: (a) with your explicit consent, given at registration or at the point a service requiring that data is used; (b) where necessary to protect your vital interests or those of another person (for example, an urgent drug-interaction alert); (c) where necessary for the provision of healthcare or pharmaceutical services by a licensed professional; or (d) where necessary to comply with a legal or regulatory obligation, including under the National Health Act 2014 and NAFDAC/NDLEA controlled-substance regulation.

We apply additional safeguards to special category data, including restricted internal access on a need-to-know basis, encryption at rest and in transit, and, in respect of controlled-substance dispensing records, logging of access and disclosure consistent with Poison Book record-keeping practice (including, once released, within a dedicated Poison Book audit trail module of the Service).

• Directly from you, when you register, place an order, upload a prescription, raise a return, or contact support.
• From Pharmacy staff, who enter customer, sale, dispensing and return information at the point of transaction.
• From other Strongreed Group products, including EazyMed (patient orders, payment and delivery data), FastKlinik (encounter records, prescriptions, doctor verification) and KwickLab (laboratory results relevant to a dispensing decision), where you have used those products in connection with a KwickPharm transaction.
• From third-party verification, payment and logistics providers, including identity/NIN verification services, payment service providers and POS terminal providers (for example Moniepoint or Opay), credit bureaus (where embedded finance is used), and delivery partners.
• From external clinical, drug-safety and regulatory databases used to populate the Healthcare Intelligence System’s knowledge base, such as NAFDAC’s registered-product database and recognised external drug-interaction and adverse-effect reference sources — this data relates to medications generally, not to you individually, but is combined with your data to generate the outputs described in Section 8.
• Automatically, through your use of the Service, including device, log, approximate location and prescription-image metadata collected for security and fraud-integrity purposes.

• Provide and operate the Service (orders, dispensing, inventory, billing)
  Legal basis: Performance of a contract with you
• Verify identity, licensing and KYC status; prevent fraud and abuse
  Legal basis: Legal obligation; legitimate interest; consent where required
• Operate the Healthcare Intelligence System, once released (fraud, safety, interaction and longitudinal scoring)
  Legal basis: Legitimate interest in patient safety and platform integrity; legal obligation (controlled-substance compliance); vital interests, where an alert concerns an immediate safety risk
• Support the Pharmacy’s Poison Book and other statutory record-keeping obligations
  Legal basis: Legal obligation under the National Health Act 2014 and NAFDAC/NDLEA regulation
• Process payments, credit, refunds and billing
  Legal basis: Performance of a contract; legal obligation (tax and financial record-keeping)
• Send transactional, regulatory and (where consented) marketing communications
  Legal basis: Performance of a contract / legal obligation; consent for marketing
• Improve, secure and develop the Service, including the Healthcare Intelligence System’s knowledge base, using de-identified or aggregated data where feasible
  Legal basis: Legitimate interest
• Respond to lawful requests from regulators, courts or law enforcement (NAFDAC, PCN, NDLEA, NDPC, tax authorities)
  Legal basis: Legal obligation

Where we rely on your consent, you may withdraw it at any time by contacting us as set out in Section 20, without affecting the lawfulness of processing carried out before withdrawal; however, withdrawal of consent does not extend to processing we carry out on the basis of a legal obligation (such as Poison Book record-keeping) or a continuing contractual necessity.

Planned Capability

The Healthcare Intelligence System described in this Section is a planned capability and is not generally available as of the Effective Date. We describe it here, in advance of its release, so that the basis on which we will process your data once it is introduced is transparent from the outset; this Section takes effect automatically, without requiring a further update to this Policy, from the date any Healthcare Intelligence System component is made available to and enabled by a Pharmacy in respect of your data.

Once released, KwickPharm will operate a Healthcare Intelligence System that automatically assesses each order against fraud, medication-safety, drug-interaction, adverse-effect and longitudinal dose-pattern signals, producing a unified risk score that can result in an order being automatically approved, flagged for pharmacist review, placed on hold, or automatically blocked, as described in our Terms of Service. This will constitute automated decision-making and profiling involving special category (health) data.

1. The Healthcare Intelligence System will not replace the clinical judgment of a licensed pharmacist or doctor; every automated output will be a recommendation or a hold for human review, and a dispensing decision will always ultimately rest with a licensed professional.
2. Where an order is automatically held or blocked, you (or the Pharmacy acting on your behalf) will have the right to request human review of that decision by a licensed pharmacist or, where applicable, by our compliance team, and to request a general explanation of the category of concern that produced the outcome. Consistent with the Healthcare Intelligence System’s design principle of "no IP exposure," we will not disclose the specific scoring weights, model logic, or category-level scores underlying any individual decision.
3. Adverse-effect and interaction information shown to you will be sourced from a combination of doctor-submitted data, curated internal records, and recognised external drug-safety databases, each carrying its own confidence or verification status; we will not warrant that such third-party-sourced information is complete or free from error.
4. Once released, a complete audit record of every score, alert, decision and notification generated by the Healthcare Intelligence System will be retained permanently for compliance, audit and dispute-resolution purposes, as described in Section 11.

Your Right to Object

Once the Healthcare Intelligence System is released, you may object to being subject to a decision based solely on automated processing which produces a legal or similarly significant effect, to the extent such a decision is made without human involvement. Because every Healthcare Intelligence System hold or block will be subject to pharmacist or compliance review before a final dispensing decision is taken, such decisions are not expected, in our assessment, to be "solely automated" within the meaning of the NDPR; nonetheless, you will retain the right to request human review as described above.

We disclose personal data only as reasonably necessary for the purposes described in this Policy, and to the following categories of recipient:

9.1 Within the Strongreed Group

We share data with EazyMed, FastKlinik, KwickLab and Strongreed Books, each acting within its own role described in Section 2, strictly as necessary to deliver an interconnected transaction — for example, sharing a prescription from FastKlinik to KwickPharm for dispensing, or sharing a dispensing record from KwickPharm to EazyMed so a patient can see their order status.

9.2 Service providers and processors

• Payment service providers and POS terminal providers (such as Moniepoint and Opay), to process payments and settlements.
• Cloud hosting, infrastructure and messaging providers, who store and transmit data on our behalf under contractual confidentiality and security obligations.
• Identity and KYC verification providers, to confirm NIN, licence or institutional details.
• Logistics and delivery partners, to fulfil and track order deliveries and return shipments.
• Lenders and financing partners (where embedded finance is used), limited to the data necessary for credit assessment and repayment processing.
• External drug-safety and regulatory data sources, on an aggregated or non-identifying basis, to maintain the Healthcare Intelligence System’s knowledge base.

9.3 Regulators and legal disclosures

We disclose personal data, including Poison Book and controlled-substance dispensing records, to NAFDAC, the Pharmacists Council of Nigeria, the National Drug Law Enforcement Agency, the Nigeria Data Protection Commission, tax authorities, courts, and law enforcement, where required or permitted by applicable law, or to protect the rights, property or safety of Strongreed, its Affiliates, its users or the public.

9.4 Business transfers

In connection with a merger, acquisition, financing, or sale of some or all of our assets, personal data may be transferred to a successor entity, subject to the continued application of a privacy policy offering at least an equivalent standard of protection.

We do not sell your personal data to third parties for their own independent marketing purposes.

We primarily store and process personal data within Nigeria or in jurisdictions assessed as providing an adequate level of data protection. Where personal data is transferred outside Nigeria — for example, to a cloud infrastructure provider with servers in another jurisdiction, or to an external drug-safety data source — we ensure appropriate safeguards are in place consistent with the requirements of the NDPR, including contractual data protection clauses, prior to such transfer.

• Poison Book / controlled-substance dispensing records (however maintained): Retained permanently, or for the minimum period required by NAFDAC/NDLEA regulation, whichever is longer.
• Healthcare Intelligence System audit logs (scores, alerts, decisions, overrides), once that capability is released: Will be retained permanently for compliance, audit and dispute-resolution purposes.
• Transaction, invoice and financial records: Retained for the period required by applicable tax and financial record-keeping law (generally not less than six years).
• Prescription and dispensing history: Retained for the duration of your relationship with the relevant Pharmacy and for such further period as is necessary for continuity of care, audit, or legal defence.
• Account and KYC/identity verification data: Retained for the duration of your account and for a reasonable period thereafter to meet legal and anti-fraud obligations.
• Marketing consent and communication preferences: Retained until you withdraw consent or close your account, and for a short period thereafter to evidence compliance.

Where we no longer have a legal or legitimate business reason to retain personal data, we securely delete, anonymise or aggregate it, except where longer retention is required by law or necessary to establish, exercise or defend legal claims.

We implement administrative, technical and physical safeguards designed to protect personal data against unauthorised access, alteration, disclosure or destruction, including encryption of sensitive data at rest and in transit, role-based access controls, audit logging of access to special category and controlled-substance data, and contractual security obligations imposed on our service providers. No system is completely secure, and while we strive to protect your personal data, we cannot guarantee its absolute security, and you acknowledge that you provide personal data at your own risk to the extent permitted by law.

Subject to applicable exceptions, you have the right to:

• Be informed about how your personal data is processed (this Policy being part of that information);
• Access the personal data we hold about you;
• Request rectification of inaccurate or incomplete personal data;
• Request erasure of your personal data, subject to our legal obligation to retain certain regulatory records (including Poison Book entries and, once released, Healthcare Intelligence System audit logs) for the periods described in Section 11;
• Request restriction of, or object to, certain processing, including processing based on legitimate interest;
• Request portability of personal data you have provided to us, in a structured, commonly used, machine-readable format, where technically feasible;
• Withdraw consent at any time, where processing is based on consent, without affecting the lawfulness of prior processing;
• Lodge a complaint with the Nigeria Data Protection Commission or another competent supervisory authority.

To exercise any of these rights, please contact us using the details in Section 20. We may need to verify your identity before responding, and we will respond within the timeframes required under the NDPR.

KwickPharm is not directed at children, and we do not knowingly collect personal data directly from children except where a parent or legal guardian is managing that child’s healthcare and medication on their behalf and has accepted this Policy and our Terms of Service for that purpose. If we become aware that a child’s personal data has been collected without appropriate parental or guardian consent, we will take reasonable steps to delete it, save where retention is required for the child’s own medical continuity of care under the supervision of a parent, guardian or licensed professional.

This section is the operative commitment that retail and patient privacy treatment on KwickPharm is implemented consistently with EazyMed’s own Privacy Policy. Where this Policy and the EazyMed Privacy Policy address the same category of patient data, the more protective standard applies to that data.

Because most Retail Users and patients encounter the Strongreed Group’s pharmacy services primarily through EazyMed before a transaction is fulfilled through KwickPharm, we have designed this Policy so that, in respect of Retail Users and patients specifically:

1. The categories of personal data collected, the purposes of processing, the consent mechanisms, and the data-subject rights available to a Retail User or patient under this Policy mirror those set out in the EazyMed Privacy Policy, as that policy may be amended from time to time, save to the extent a KwickPharm-specific regulatory obligation (such as Poison Book record-keeping) requires additional processing not applicable to EazyMed alone.
2. Health and medication data originating from a patient’s EazyMed activity and subsequently used to fulfil an order on KwickPharm is processed under the same lawful bases, security standards and retention principles described in the EazyMed Privacy Policy, read together with Sections 5, 8 and 11 of this Policy.
3. A Retail User or patient exercising a data-subject right described in Section 13 may do so once, through either the EazyMed or KwickPharm support channel, and that request will be honoured across both products to the extent the same underlying personal data is implicated, rather than requiring separate requests to each product.
4. Where the EazyMed Privacy Policy is updated, we will review and, where necessary, update this Section and the corresponding KwickPharm practices to maintain consistency for Retail Users and patients.

This alignment does not extend the EazyMed Privacy Policy’s terms to Pharmacy staff accounts, Wholesale Buyers acting in an institutional or corporate capacity, or FastKlinik clinician accounts, whose data is governed by this Policy in full.

The KwickPharm web and application interfaces may use cookies, local storage and similar technologies to maintain your session, remember your preferences, and understand usage patterns for security and service-improvement purposes. Where required by applicable law, we will obtain your consent before placing non-essential cookies, and you may manage cookie preferences through your browser or device settings.

We send transactional and regulatory communications (such as order confirmations, return and refund notifications, credit-note updates, and payment reminders) by email, SMS, WhatsApp or in-app notification as necessary to operate the Service; these cannot be opted out of while you maintain an active account, as they are necessary for contract performance or legal compliance. Where we send marketing communications, we will only do so with your consent (or on another permitted legal basis), and you may opt out at any time using the unsubscribe mechanism provided or by contacting us directly.

We may update this Privacy Policy from time to time to reflect changes in our practices, the Service, or applicable law, including any update to the EazyMed Privacy Policy that affects Section 15. We will notify you of material changes through the Service, by email, or by other reasonable means, and will update the effective date at the top of this Policy. Your continued use of the Service after the effective date of a revised Policy constitutes acceptance of the revisions.

If you have concerns about how we process your personal data, we encourage you to contact us first using the details in Section 20 so that we may address your concern directly. You also have the right to lodge a complaint with the Nigeria Data Protection Commission (NDPC), or any successor supervisory authority with jurisdiction over data protection in Nigeria.

Strongreed Technology Limited
Registered Office: Victoria Island, Lagos, Nigeria

For privacy-related inquiries, data-subject rights requests, or to contact our Data Protection Officer, please use the official support and privacy channels published within the KwickPharm application or on the KwickPharm website.