Privacy Policy

MedOrange Pharmacies

Privacy Notice

Introduction

MedOrange Pharmacies ("MedOrange," "we," "us," or "our") is committed to protecting your privacy and ensuring the security of your personal and health information. This Privacy Notice outlines how we collect, use, disclose, and safeguard your personal data in accordance with the Cyber and Data Protection Act [Chapter 12:07] (CDPA) and relevant healthcare regulations in Zimbabwe.

What Personal Information we collect from you?

We collect the following personal information from you including:

• Demographic data.
• Health & Medical Data: Diagnostic details, prescription history, medical notes, and treatment records.
• Insurance and billing information.
• Biometric information for member verification.
• Employee personal information.
• Contractors, customer and supplier personal information.
• Walk-in visitor’s personal information.
• Patient or employee next of kin personal details.
• Employee family details spouse and children.

Where do we get personal information from?

We  get  information  directly  from  you.  Under  special  circumstances information may be obtained from third parties especially in cases where data subject has no capacity to provide required personal, medical and treatment information.

How do we use your personal information?

We use your personal information to:

Patients

• Record  your  personal  information  as  required  by  law,  dispense medications,  manage  your  pharmaceutical  care,  and  communicate treatment plans.o Communicate with your next of kin where authorised in cases where we seek their assistance, require their input, or need to advise them on important matters regarding your care.
• Bill and collect payment for service - We may use and disclose your health information to obtain payment for the services we provide to you. This may include sharing information with your insurance company.
• Biometric data for verifying insurance member status and registering new entrants on behalf of insurance companies.
• Conduct quality improvement and risk management activities.
• Internal data analytics to inform and enhance our product and service offerings.
• Participate in Government initiated public health activities.
• Comply with relevant laws and regulations.
• For research (With your explicit consent).

Employees

• Administrative  and  HR  purposes  -  To  manage  employee  records, payroll, benefits, and performance evaluations.
• Compliance with laws and regulations - To fulfil obligations under employment laws, tax laws, and other regulatory requirements.
• Employee  relations  and  communication  -  To  maintain  contact information,  manage  employee  engagement,  and  facilitate  internal communication.
• Health, safety, and well-being - To provide a safe working environment, and support employee well-being initiatives.
• Security and access control - To manage access to company facilities, systems, and data.
• Performance management and development - To evaluate employee performance, identify training needs, and support career development.
• Business operations and management - To analyse workforce trends, plan for future staffing needs, and make informed business decisions.
• Use children details to better manage and control related benefits.

Contractors, Customers and Suppliers

• Contract  administration   -   To  manage   contracts,  invoices,  and payments.
• Procurement and supply chain management - To manage supplier relationships, track orders, and ensure timely delivery.

Who do we share your personal information with?

Depending on personal information collected from you, we may share your information with the following:

• Medical Insurance companies.
• Healthcare providers and professionals involved in your care. This includes sharing information with doctors, nurses, technicians, and other healthcare professionals who are involved in your care.o   Regulatory bodies, and the Government.
• Legal  representatives  or  law  enforcement  agencies  if  necessary  to pursue or defend a legal claim.
• Family members involved in your care. (With your explicit consent).
• Employee personality and character information shared with other Employers. (With your explicit consent).
• Data Processors: Vetted ICT infrastructure, pharmacy management system, and cloud service vendors acting under formal Data Processing Agreements.

How long do we keep information?

The Company shall comply with the prescribed timelines and periods as stipulated in the applicable laws and regulations pertaining to the type of personal information.

Sharing of your information outside Zimbabwe?

Patient Data

We do not share any of your information with anyone outside Zimbabwe. In the event that it becomes necessary to share any of your information outside Zimbabwe, such transfers will be conducted in strict accordance with the prevailing laws and regulations.

Employee, Contractors and Suppliers Data

We do keep employee data outside Zimbabwe on the cloud to facilitate communication, collaboration and sharing of company data.

How do we protect your personal information?

We  take  reasonable  steps  to  protect  your  personal  information  from unauthorized access, use, or disclosure. These steps include:

• Implementing physical, technical, and administrative safeguards.
• Limiting access to authorized personnel.
• Conducting regular security risk assessments and audits.

Your Rights

You have the right to:

• Request access to your personal information.
• Request restrictions on the use and disclosure of your personal information.
• Receive an account of disclosures of your personal information. o   Request a copy of your personal information.
• Request correction to your personal information.
• File a complaint with us or with the relevant regulatory authority.

To exercise any of the rights mentioned above, we may require proof of your identity. Kindly also take note that some limitations may apply to these rights. For example, we may decline your request if it would inadvertently disclose the personal information of another individual.

If we are legally or contractually obligated to retain your information, or if we have a legitimate interest in doing so, we may not be able to delete it even upon your request.

All requests must be submitted in writing. We aim to respond to your request within 30 days of receipt. In some cases, we may require an extension, in which case we will inform you of the reason for the delay.

Complaints

If you have concerns regarding how your data is handled, we encourage you to contact our Data Protection Officer first. If you remain unsatisfied with our resolution, you have the right to lodge a formal complaint with the Data Protection Authority of Zimbabwe (POTRAZ).

Changes to This Notice

We reserve the right to change this notice at any time. If we make any changes, we will post the new notice on our website and notice boards and provide you with a copy upon request.

Contact Us

If you have any questions or queries about this privacy notice, handling of your personal information, or require a soft copy of this notice, please contact our Data Protection Officer at:

The Data Protection Officer
Med Orange Pharmacies
3 Anchor House, 54 J. Moyo Av
Harare
dpo@medorange.com

By using our services or providing us with your personal information, you acknowledge that you have read, understood, and agree to be bound by this privacy notice.

Effective Date

This notice is effective as of 28/08/2026.