Privacy

None of your pharmacy's records. Your sales, stock, batches, prescriptions, customers, staff records, expenses and audit history are written to a database file on your own computer and stay there. We have no way to read them, because there is no channel by which they could reach us. There is no crash reporting service and there are no advertising identifiers.

The app does contact us about updates. Shortly after it starts, and roughly every six hours after that, it asks whether a newer version exists. When one is offered, downloaded, or fails to install, it tells us which of those happened. That is the only thing it ever sends, and it is how a pharmacy gets security fixes without somebody carrying a USB stick to the counter.

Each of those messages carries exactly four things:

• Two scrambled identifiers, one for the pharmacy and one for the computer. They are one-way hashes: they let us tell one till from another without telling us whose it is.
• The version of Optima that is running.
• One word for what happened - running, offered, downloaded or failed.

It is not a record of what you do in the app. Nothing about a sale, a patient, a product or a member of staff is in it, and there is no way for one to be. If the computer is offline the check simply fails and the till carries on, because an update check must never stand between a pharmacist and a customer.

There is currently no switch to turn that check off. If you would rather it did not run at all, tell us and we will say so plainly here when that changes.

The application does write a local log file to help diagnose problems. It stays on your computer, and it never records a PIN, a password or a pairing token. If you send it to us during a support conversation, you are choosing to, and you can read it first.

Where a pharmacy runs several tills, they talk to each other directly over your own local network. That traffic never leaves your premises and does not pass through us or through any cloud service.

If you join the waitlist, we store your email address and which part of the page you signed up from.

If you buy a licence, we store:

• Your phone number, and your name and pharmacy name if you give them.
• Your order, what it cost, and its status.
• The M-Pesa confirmation Safaricom sends us, including the receipt number.
• Your licence, and a record of each computer it has been activated on. That record is a machine code and a set of one-way hashes, which cannot be turned back into anything about your hardware or about you.

Downloading Optima requires a free Optima account. When an installer is downloaded we record which account downloaded it, the version, the country the request came from and, if a salt is configured, a truncated one-way hash of the IP address. That is your download history: it lets us see which version you installed when you ask for help.

When you connect a computer to your account so it can receive updates, we record the computer's Windows name, its machine code, the Optima version and when it last checked for updates. You can disconnect it from your account at any time.

Marketing messages are optional. The sign-up checkbox starts unticked. We record the choice, the communication channels, where it was made and the policy version that was shown. You can withdraw that choice from your account at any time. Payment, security, activation and support messages needed to provide Optima are service messages and do not depend on marketing consent.

A planned future version may register the start of a trial when the computer happens to be online. That trial check-in will be best-effort: it will use the computer identity and first trial date only to prevent repeated trial resets. It will not contain pharmacy records, and being offline will never stop the trial or normal local operation. We will update this notice when that feature is actually released.

We count visits to this site ourselves. There is no Google Analytics, no Meta pixel, no advertising network and no third-party script of any kind: nobody outside this company is told that you were here.

Two cookies do the counting, and neither can be read by any code on the page:

• One that lasts a year, so a returning reader is not counted as a new one. It is a random number and nothing else.
• One that lasts thirty minutes of inactivity, so we can tell one visit from the next.

Against those we record which pages were opened, which buttons were pressed, roughly how far down a page somebody read and for how long, the site that linked here, the country Cloudflare reports, and whether the device is a phone, a tablet or a computer.

Your IP address is never stored. Where a salt is configured we keep a truncated one-way hash of it, the same as for downloads, which distinguishes visitors without identifying them. The address a page was reached at is reduced to its path, so anything a link happened to carry in a query string is discarded before it is written down. A referring site is reduced to its address, so a search you typed to find us is not kept.

None of it is joined to your account, sold, shared, or used to advertise to you, and it is deleted after six months.

To fulfil the contract you entered when you bought a licence: issuing it, reactivating it when you change computers, and proving it is yours if there is ever a question.

The activation history additionally protects against a single licence being shared between businesses, which is the one thing that would make a one-time price unsustainable.

A small number of service providers, each doing one job:

• Safaricom processes M-Pesa payments and tells us the result. They are the payment provider; we never see or store your M-Pesa PIN.
• Neon hosts the database this site uses, in the European Union.
• Cloudflare serves this website and the installer downloads.

We do not sell your data, we do not share it with advertisers, and there is no advertising or third-party tracking on this site.

Order, payment and licence records are kept for as long as the licence is valid, which for a perpetual licence means indefinitely, plus seven years afterwards for tax and accounting purposes.

Waitlist emails are kept until you ask to be removed, or until we have been in touch and you have said no.

Download records are kept for two years. Those made before downloads required an account hold nothing that identifies a person.

Under Kenya’s Data Protection Act you may ask us for a copy of what we hold about you, ask us to correct it, or ask us to delete it. Write to us and we will answer within 30 days.

One honest limit: we cannot delete an order or a payment record while we are legally required to keep it for tax purposes, and we cannot delete a licence record without invalidating the licence you paid for. We will explain rather than refuse silently.

Nothing here applies to your pharmacy’s own records - your patients, your staff, your sales. Those are on your computer, we never receive them, and you are the data controller for them.

Questions about privacy, or a request about your data, go to the email address at the bottom of this page. A person reads it.