Who we are
Medora Health is an online pharmacy operating in Pakistan. Our registered address is [registered pharmacy address] and our pharmacy licence number is [pharmacy licence / registration number]. Our superintendent pharmacist is [superintendent pharmacist's name and registration number].
Information we collect
We collect only what we need to take an order, sign you in, and run the prescription review service:
- Contact details — the phone number or email you give at checkout, and, when you sign in with Google, the email address and name on your Google account. We ask Google only for your basic profile and email address, and Google tells us that the email address is verified. We never receive a password.
- WhatsApp number — the number you add when you first upload a prescription, or on your profile page. We do not ask for it when you create your account, and we do not verify it. The pharmacist uses it to message or call you by hand about your orders and prescriptions; we send no automatic WhatsApp or SMS messages to it. You can change or remove it on your profile page.
- Delivery details — the name, address and phone number you enter at checkout, and any addresses you save to your account.
- Order history — what you bought, when, and its delivery status.
- Prescription images and notes — photos or PDFs you upload, and any note you add, when you use the prescription review service.
You can browse the catalog and buy any product without an account, giving only a contact and delivery details. No product on this site requires a prescription to purchase.
If you check out with a phone number, we store it in the email field of your order in a form that can’t receive email; we never email that address. An order placed with only a phone number is not added to any account; you can follow it on the Track order page.
If you enter an email address at guest checkout, the order can be added to the account that uses that email address, so please enter your own. When you first sign in with Google and your account is created, earlier guest orders placed with that Google email address are added to it. Cancelled orders are not added.
Health data and prescription images
The prescription review service is a discovery tool, not a purchase gate: it turns a photo of your prescription into a list of medicines you can choose to order. Here is exactly what happens to a prescription you upload:
- You sign in with your Google account, if you aren’t already signed in. If your account has no WhatsApp number yet, you add one before sending.
- You take or choose a photo, or pick a PDF. If it’s a photo, an automated check, run by our AI provider, looks for obvious problems, such as a blurry or cropped image, and asks you to retake it if needed. PDFs skip this check. This check happens after you sign in and before you send the prescription, and the file isn’t stored unless you submit it.
- The image is read by an automated system, which drafts a list of medicines. This draft is never shown to you directly.
- A pharmacist checks the image against the draft, and approves, edits, asks you to clarify, or rejects it. Only the pharmacist’s final list is shown to you.
- We email you a link at your Google email address when the pharmacist has finished reviewing your prescription, including when we need a clearer copy. The email contains only the prescription’s reference number and a link, never the names of your medicines or the pharmacist’s notes; you see those after you open the link and sign in.
What we send to our AI provider
We send only the file itself, with no name, phone number or account details attached. The prescription may show details written on it, such as your name and your doctor’s name, and the AI provider reads those along with the medicines. Before a photo is sent or stored, we remove hidden photo data such as location and device details. From a PDF we remove hidden document data such as the author and the software that made it; every page is kept and sent as uploaded. [name of the AI provider used to read prescription images] processes the file only to return a result to us, under [our AI provider's data-handling terms].
Where prescription files are stored
Prescription files are stored in a private file store, separate from the images used on our product pages. They are never publicly accessible: our systems and staff view them only through links that expire after a few minutes. We delete prescription files [how long prescription images are kept before deletion] after the review is finished. If we asked you for a clearer copy and you don’t send one, the request closes after 30 days and its files are deleted [how long prescription images are kept before deletion] after that.
We keep a text record of each review: what was read from the prescription, your note, the pharmacist’s decision and messages, and the medicine list. We keep it for [how long the text record of a prescription review is kept].
How we use your information
- To take, deliver and track your orders.
- To sign you in with your Google account and keep you signed in.
- To run the prescription review service described above.
- To contact you about an order: we email you when an order is placed, on its way or cancelled, if the order has an email address; our rider or courier usually phones you about the delivery; and the pharmacist may message or call you on your WhatsApp number about an order or a prescription.
- To meet our legal and pharmacy record-keeping obligations.
We do not sell your personal data, and we do not use your prescription images for advertising.
To prevent abuse, we record your IP address for a short time (at most a day) to limit how often order look-ups, photo checks, sign-outs and account deletions can be requested. Our hosting provider also keeps standard server logs, which include IP addresses, for [how long our hosting provider keeps standard server logs].
Only our pharmacists and pharmacy managers can see prescriptions. Customer-service staff can see your contact details and orders so they can help you. Every prescription action is logged with the staff member who took it.
Order emails are sent to the email address on the order. They list the items you ordered, the totals and the delivery address, but not your phone number. An order placed with only a phone number gets no email.
Who we share information with
We share personal data only where it’s needed to run the service:
- Our AI provider, [name of the AI provider used to read prescription images] — the prescription image only, as described above.
- Google, when you sign in with it — Google handles your sign-in and tells us your email address and name. Google’s own privacy policy applies to what it does with your Google account.
- Our email provider, [name of the email provider used to send prescription updates] — your email address and the text of the order and prescription emails we send you.
- Our delivery partner, [name of our delivery partner] — the delivery name, address, phone number and cash amount for an order.
- Our hosting and storage providers, [name(s) of our hosting and storage providers] — they store our database and your prescription files for us and may not use them for anything else. Some of these providers, and our AI provider, may process data outside Pakistan ([which countries our hosting or AI providers may process data in]).
- Regulators or courts, where we’re legally required to.
We do not accept online payments, so we never collect or store card details.
Cookies and staying signed in
Signing in with your Google account keeps you signed in with a secure cookie that JavaScript on the page cannot read, for up to 90 days. We don’t use advertising or tracking cookies.
We also use:
- A cart cookie (30 days) that remembers your cart.
- Short-lived cookies (15 minutes) used only while you sign in with Google, to bring you back to the page you were on and to check that the sign-in finishing is the one your browser started.
- An order-tracking cookie (60 days) that remembers orders you’ve looked up on this device, including the phone number or email you entered.
- A short-lived cookie (1 hour) that lets you see your order confirmation again.
- Your browser’s storage, to remember recently viewed products and, until you close the tab, the checkout details you’ve typed.
Signing out clears the session, cart, order-tracking and confirmation cookies and the saved checkout details. All of these are needed for the site to work; none are used for advertising.
Signing out ends the session on our servers as well as in your browser. You can also sign out of all devices from your profile page. If we suspect misuse of your account, our staff can sign you out on every device.
Your rights
You can ask us what personal data we hold about you, or ask us to correct it. You can change your name and WhatsApp number on your profile page and delete saved addresses yourself from My account. You can also delete your account yourself from your profile page, as described below. We’ll respond to other requests within [how long we take to respond to a data request]. To make a request, contact us at [support phone number and email address].
Deleting your account
When you delete your account from your profile page:
- Your account, your Google sign-in link, your saved addresses, your reviews and your open carts are removed straight away.
- Prescriptions that are still under review are closed.
- Orders you have already placed are still delivered.
- We keep your account’s orders and prescriptions for 60 days. After that, the personal details in them (email address, name, street address, phone number, prescription images, notes and messages) are erased. We keep the order’s items and totals, and the prescription’s status and approved medicines, as the pharmacy’s records. Copies in our backups are overwritten on their normal schedule.
- If you sign in again with the same Google account, you get a new account that does not show the old account’s orders.
Changes to this policy
We may update this policy as the service changes. The date at the top of this page shows when it was last revised.
Contact us
Questions about this policy or your data can be sent to [support phone number and email address].