PRIVACY POLICY — PHARMACY BI

Version: 1.0
Effective Date: 2026-10-04
Last Updated: 2026-10-04

1. INTRODUCTION

This Privacy Policy describes how Pharmacy BI, operated by Optima Solution ("Company," "we," "us," or "our"), collects, uses, discloses, and protects personal data when you use our Service.

This Policy applies to:

• Pharmacy owners, managers, and authorized users;
• Employees of subscribing pharmacies;
• Customers of subscribing pharmacies;
• Other individuals whose data appears in pharmacy systems.

This Policy does NOT apply to:

• Data that stays in your pharmacy's own system and is not synchronized to Pharmacy BI;
• Patient health information (which we do not collect).

2. DATA WE COLLECT

2.1 Data from Pharmacy Systems

When you authorize Pharmacy BI access via VPN, we synchronize and process the following categories of data:

Operational Data

• Sales transactions (items, quantities, prices, times);
• Sales returns;
• Purchase orders and supplier invoices;
• Inventory levels, SKU information, and product classifications;
• Supplier names and contact details;
• Expenses and operating costs by category.

Financial Data

• Accounting records (receipts, payments, bank transfers and account balances);
• Transaction summaries and daily financial totals;
• Revenue and cost analyses.

Employee Data

• Names;
• Job titles and roles;
• Salary and payroll information;
• Attendance and work schedule data;
• Login information and access records.

Customer Data

• Names;
• Contact information (telephone numbers, email addresses);
• Purchase history and transaction records;
• Payment method breakdown (cash vs. card vs. credit).

Payment Data

• Transaction method (cash, card, check);
• Payment dates and amounts;
• NOT stored: Full credit card numbers, banking credentials, or complete payment details.

Data We Do NOT Collect

• Prescription records or medicine details linked to patients;
• Patient names or identifiable patient health information;
• Doctor/prescriber information;
• Medical diagnoses or health conditions;

2.2 Data About Your Use of Pharmacy BI

When you access Pharmacy BI dashboards, we collect:

• IP address and device information;
• Login timestamps and session duration;
• Features and reports accessed;
• Dashboard interactions and data queries;
• Support requests and communications.

2.3 Device and Connection Data

• Browser type and version;
• Operating system;
• Device identifiers;
• VPN connection logs;
• Network diagnostic information.

3. PURPOSE OF PROCESSING

We process personal data for the following purposes:

Primary Purposes

1. Service Delivery

   • Synchronizing and aggregating your pharmacy data;
   • Generating dashboards, KPIs, and analytics;
   • Providing AI-assisted insights;
   • Calculating financial and operational ratios.

2. Account Management

   • Creating and maintaining your account;
   • Authenticating users;
   • Managing roles and permissions;
   • Processing subscription payments.

3. Technical Support

   • Responding to support inquiries;
   • Troubleshooting technical issues;
   • Analyzing and improving system performance.

Secondary Purposes

4. Analytics and Product Improvement

   • Analyzing platform usage patterns;
   • Identifying feature usage and dashboard preferences;
   • Improving Pharmacy BI performance and reliability.

5. Aggregated Analytics (with Data Minimization)

   • Creating anonymized and aggregated datasets;
   • Generating industry benchmarks;
   • Conducting market research;
   • Improving algorithms.

Legal and Compliance Purposes

6. Legal Compliance
   • Complying with applicable laws and regulations;
   • Responding to lawful government requests;
   • Protecting against fraud and misuse;
   • Maintaining audit and security logs.

4. LEGAL BASIS FOR PROCESSING

We process your data based on:

Contract

• Processing necessary to provide the Service you have subscribed to;
• Management of your account and subscription.

Legitimate Interests

• Protecting the security and integrity of Pharmacy BI;
• Improving and optimizing the Service;
• Preventing fraud and unauthorized use;
• Conducting necessary analytics.

Legal Obligation

• Retaining financial and billing records as required by law;
• Responding to valid legal requests.

Consent (Where Required)

• For optional analytics and product improvement features;
• For aggregated data usage not essential to service delivery.

5. DATA SUBJECTS AND YOUR PRIVACY RESPONSIBILITIES

5.1 Pharmacy Employees

You are the data controller. Pharmacy BI acts as your processor. You are responsible for:

• Informing employees that their data (names, roles, payroll) will be processed by Pharmacy BI;
• Obtaining necessary consents;
• Enabling employees to exercise their privacy rights (access, deletion).

The Company will cooperate with requests for employee data deletion, subject to backup retention schedules.

5.2 Pharmacy Customers

You are the data controller. You are responsible for:

• Informing customers that their purchase history and contact information will be processed by Pharmacy BI;
• Obtaining necessary consents;
• Complying with any privacy notices required in your jurisdiction.

Customer data is processed for analytics purposes only—not for marketing or commercial use by the Company.

5.3 Other Individuals

Any other individuals whose data appears in your pharmacy systems (suppliers, contractors, etc.) benefit from the same protections described herein.

6. DATA STORAGE AND RETENTION

6.1 What We Store

Pharmacy BI stores the data described in section 2.1 as it is recorded in your pharmacy system, kept up to date every 5 minutes:

• Individual sales, sales-return and purchase lines, with quantities, prices and times;
• Stock levels, products and suppliers;
• Customer names, telephone numbers and purchase history;
• Employee names, payroll entries and attendance records;
• Expenses, payments, collections and bank transfers;
• Calculated KPIs and summaries.

We do NOT store:

• Prescription records or medicine details linked to patients;
• Patient names or health information;
• Full payment card numbers or banking credentials.

6.2 Data Retention Periods

6.3 Data Deletion

You may request deletion of your account data at any time. Deletion becomes effective:

• Active data: Within 10 business days;
• Backups: Overwritten within 14 days (standard backup cycle);
• Legal records: Retained for 7 years per law.

7. DATA SHARING AND THIRD PARTIES

7.1 Service Providers (Data Processors)

We may share your data with third-party service providers strictly necessary to provide the Service:

All third-party processors sign data processing agreements ensuring compliance with this Policy.

Subscription payments are arranged directly with us (bank transfer or cash); no payment processor receives your data.

7.2 Aggregated/Anonymized Data

We may use properly anonymized and aggregated data for:

• Industry benchmarking;
• Market research;
• Product development;
• Statistical analysis.

This data cannot identify your pharmacy. No separate consent is required for anonymized data use.

7.3 Legal Requests

We will disclose personal data if required by law, court order, or valid government request. We will:

• Notify you of the request (unless legally prohibited);
• Provide only the minimum data requested;
• Cooperate with investigations.

7.4 Business Transfers

If Pharmacy BI is sold, merged, or transferred:

• Your data may be transferred to the acquirer;
• You will be notified in advance;
• Privacy protections continue.

7.5 What We Do NOT Do

We do NOT:

• Sell customer data to third parties;
• Share data with advertisers or marketers;
• Use your data for purposes outside the Service;
• Disclose data to competitors;
• Transfer data to Libyan government agencies without legal process.

8. AI AND AUTOMATED DECISION-MAKING

8.1 AI Processing

Pharmacy BI may use AI to:

• Generate KPI explanations;
• Provide inventory and sales recommendations;
• Detect anomalies and trends;
• Create forecasts.

8.2 Data Processing

• Local processing: Your business data is analysed on our own infrastructure. The medicine-information lookup sends only a product's name and catalogue code to an external AI provider (Google Gemini), never sales data, personal data or anything that identifies your pharmacy;
• No training: Your data is not used to train AI models;
• No automated decisions: AI provides advisory insights only; pharmacists make final decisions.

8.3 Your Rights

You have the right to:

• Request explanation of AI-generated insights;
• Request that decisions NOT be based solely on AI recommendations;
• Request human review of AI analysis.

9. INTERNATIONAL DATA TRANSFERS

9.1 Data Location

Pharmacy BI may store data:

• In Libya (using LibyanSpider or Almadar Cloud);
• In the EU (EU-West region);
• Backups are held on the same hosting as the live data.

9.2 Libya-Specific Considerations

• Libyan personal data law is still developing; no comprehensive data protection legislation exists;
• Transfers outside Libya are permitted and do not violate current Libyan law;
• You retain the right to keep all data within Libya by requesting Libya-based hosting.

9.3 Your Choice

If you require data to remain exclusively in Libya:

• Request Libya-based hosting (LibyanSpider or Almadar Cloud);
• Request that backups NOT be stored outside Libya;
• We will accommodate where technically feasible.

10. SECURITY

10.1 Technical Security Measures

We implement:

• Encryption: TLS/HTTPS for data in transit; stored connection credentials are encrypted at rest;
• Database security: Read-only access credentials; no write permissions;
• Network isolation: VPN/Tailscale private network segregation;
• Access control: Role-based permissions; admin activity logging;
• Monitoring: Automated checks of system health, and limits on repeated failed sign-ins;
• Backups: Backups with restricted access;
• Audit logging: Sign-ins, pages opened and changes made are logged.

10.2 Data Subject to Risk

Despite these measures, internet-based systems carry inherent risks:

• No guarantee: We cannot guarantee absolute security;
• Third-party risks: Hosting provider, internet connectivity, and third-party service failures are outside our control;
• Pharmacy risks: Pharmacy computer outages or network issues are your responsibility.

10.3 Your Security Responsibilities

You must:

• Maintain login credential confidentiality;
• Not share credentials with unauthorized parties;
• Maintain secure internet connectivity;
• Monitor your account for unauthorized access.

11. SECURITY INCIDENTS

11.1 Incident Detection and Response

If we detect unauthorized access or a security breach:

1. We immediately investigate and contain the incident;
2. We notify you within 48 hours by email to your registered address;
3. We provide details of:
   • What data was affected;
   • What happened;
   • What steps we took to remediate;
   • What you should do.

11.2 Your Notification Obligations

You must notify us immediately if you suspect:

• Unauthorized access to your account;
• Leaked credentials;
• Suspicious activity on dashboards;
• Potential data breaches.

11.3 Cooperation

You agree to cooperate with our incident investigation, including:

• Preserving evidence and logs;
• Granting forensic access to your systems (if needed);
• Notifying affected parties as required by law.

12. YOUR PRIVACY RIGHTS

12.1 Right of Access

You have the right to request a copy of personal data we hold about you. Requests will be fulfilled within 10 business days in a commonly used format.

12.2 Right of Correction

You have the right to request correction of inaccurate data. We will correct verified inaccuracies within 10 business days.

12.3 Right of Deletion ("Right to Be Forgotten")

You have the right to request deletion of your data, subject to:

• Active subscriptions: Your data is retained while your subscription is active;
• Post-termination: Data is deleted 14 days after account termination;
• Legal holds: Financial records are retained for 7 years;
• Backups: Backup copies may remain for up to 14 days.

12.4 Right of Restriction

You may request that we restrict processing of your data for specific purposes (e.g., while a dispute is resolved). During restriction, we will:

• Store the data;
• Not use it beyond storage;
• Resume processing upon request or dispute resolution.

12.5 Right to Opt-Out of Optional Processing

For optional features (aggregated analytics, product improvement), you may opt out at any time. Opting out does not affect the core Service.

12.6 Right to Data Portability

You have the right to request your data in a portable format (CSV, JSON) suitable for transfer to another service. Requests will be fulfilled within 10 business days.

12.7 Right to Objection

You have the right to object to specific processing activities. We will honor objections unless we have a compelling legal reason to continue processing.

12.8 Right to Lodge a Complaint

If you believe your privacy rights have been violated, you may:

• Contact us at info@optima.com.ly;
• File a complaint with Libyan authorities (if applicable);
• Seek legal remedy under Libyan law.

13. HOW TO EXERCISE YOUR RIGHTS

13.1 Privacy Requests

To exercise any of the above rights, send a written request to:

Privacy Contact:
Optima Solution
Tripoli - Ain Zara
Email: info@optima.com.ly
Phone: +218912151224

Your request must include:

• Your name and account email;
• Description of the request (access, deletion, portability, etc.);
• Reason for the request (optional);
• Signature or electronic consent.

13.2 Response Timeline

• Acknowledgment: Within 3 business days;
• Fulfillment: Within 10 business days (or longer for complex requests);
• Appeal: If denied, you may appeal within 30 days.

13.3 No Discrimination

We will not discriminate against you for exercising privacy rights. Access to the Service will not be denied or degraded based on your requests.

14. CHILDREN AND MINORS

Pharmacy BI is not intended for individuals under 18 years of age. We do not knowingly collect data from minors. If we discover that we have inadvertently collected data from a minor, we will delete it immediately.

15. COOKIES AND TRACKING

15.1 Cookies Used

Pharmacy BI uses server-side sessions only, not browser cookies.

15.2 No Third-Party Tracking

We do NOT use:

• Google Analytics or other third-party analytics;
• Advertising cookies;
• Behavioral tracking technologies;
• Social media pixels.

15.3 Log Files

We collect standard web server logs:

• IP addresses;
• URLs accessed;
• Timestamps;
• Browser information.

These logs are used for security and performance analysis only.

16. CHANGES TO THIS PRIVACY POLICY

16.1 Right to Modify

We may update this Privacy Policy at any time. Material changes will be:

• Announced in advance (at least 30 days before effective date);
• Clearly marked as "NEW" or "REVISED";
• Require your affirmative acceptance if major.

16.2 Version Control

• Current Version: 1.0;
• Effective Date: 2026-10-04;
• Last Updated: 2026-10-04.

Your acceptance of this Policy is recorded electronically.

17. DATA PROTECTION OFFICER / PRIVACY CONTACT

For all privacy-related inquiries, contact:

Optima Solution Privacy Team
Tripoli - Ain Zara
Email: info@optima.com.ly
Phone: +218912151224
Response Time: Within 3 business days

18. LIBYAN LAW AND JURISDICTION

This Privacy Policy is governed by the laws of Libya. For privacy disputes:

• Governing Law: Libya;
• Forum: Tripoli courts;
• Applicable Rules: Current Libyan law and general principles of confidentiality.

19. ADDITIONAL DISCLOSURES

19.1 Data Aggregation

Our Service aggregates and summarizes your data. The aggregated datasets we create:

• Cannot identify individual pharmacies;
• May be used for benchmarking and research;
• Are not shared with individual competitors;
• Help improve our algorithms and product.

19.2 Business Intelligence Use

The Company may use aggregated data to:

• Publish industry reports (anonymized);
• Develop new analytics features;
• Train AI models (on anonymized data only);
• Conduct academic research (with proper safeguards).

This use does not involve your identifiable data.

19.3 Transparency

We are committed to transparency. If you have questions about how your data is processed, please contact us. We will provide honest, clear answers.

20. CONTACT US

For Privacy Questions:
Optima Solution
Tripoli - Ain Zara
Email: info@optima.com.ly
Phone: +218912151224

For Legal Notices:
Optima Solution
Tripoli - Ain Zara
Email: info@optima.com.ly

For Support Issues:
support@pharmacybi.com
Hours: Saturday - Thursday, 09:00 - 18:00 (Libya time)

ACKNOWLEDGEMENT

By using Pharmacy BI, you acknowledge that you have read, understood, and agree to this Privacy Policy.

If you do not agree, please discontinue use of the Service and request account deletion.

Privacy Policy Version: 1.0
Effective Date: 2026-10-04
Language: English
Arabic Version: Available by switching this page to Arabic.

Last Updated: 2026-10-04

This Privacy Policy is effective immediately upon publication.