Privacy

None of your pharmacy's records. Your sales, stock, batches, prescriptions, customers, staff records, expenses and audit history are written to a database file on your own computer and stay there. We have no way to read them, because there is no channel by which they could reach us. There is no crash reporting service and there are no advertising identifiers.

The app does contact us about updates. Shortly after it starts, and roughly every six hours after that, it asks whether a newer version exists. When one is offered, downloaded, or fails to install, it tells us which of those happened. That is the only thing it ever sends, and it is how a pharmacy gets security fixes without somebody carrying a USB stick to the counter.

Each of those messages carries exactly four things:

• Two scrambled identifiers, one for the pharmacy and one for the computer. They are one-way hashes: they let us tell one till from another without telling us whose it is.
• The version of Optima that is running.
• One word for what happened - running, offered, downloaded or failed.

It is not a record of what you do in the app. Nothing about a sale, a patient, a product or a member of staff is in it, and there is no way for one to be. If the computer is offline the check simply fails and the till carries on, because an update check must never stand between a pharmacist and a customer.

There is currently no switch to turn that check off. If you would rather it did not run at all, tell us and we will say so plainly here when that changes.

The application does write a local log file to help diagnose problems. It stays on your computer, and it never records a PIN, a password or a pairing token. It can name the employee who took an action. You can create a diagnostics file from it and read it first. You can also press a button to send that file to us, or accept an offer to do so after Optima closes unexpectedly; nothing is ever sent unless you choose to. A report contains the log files, printer settings and update status, never sales, customers, stock or credentials, and we delete it after 60 days.

Where a pharmacy runs several tills, they talk to each other directly over your own local network. That traffic never leaves your premises and does not pass through us or through any cloud service.

This section applies only if you use Optima Online, the version that runs in your browser. Everything above about Optima Desktop stays true for Optima Desktop.

What we hold. Everything your pharmacy enters: products, batches and stock, sales and payments, customers, prescriptions and prescribers, purchasing, suppliers, shifts, expenses, staff records and the audit history. Staff PINs and passwords are stored only as one-way hashes. We also hold the owner’s account details (see the website section below) and the list of browsers the owner has approved.

Where. Your pharmacy’s records are kept on a server in the United States, each pharmacy in its own database file. The same data is copied once a day to separate storage with Cloudflare, keeping the last seven daily copies. Because the server is outside Kenya, using Optima Online means your pharmacy’s records are transferred to the United States. We use it for hosting and backup only. If that is a problem for your pharmacy, use Optima Desktop instead, or tell us.

Who can see it. Your own staff, according to the roles you give them, in browsers you have approved. We do not browse pharmacy records, and if we ever need to look at yours to fix a problem we will ask you first. We do not sell it or share it with advertisers.

Your role and ours. Your pharmacy is the data controller for its customers’ and patients’ information. We process it on your behalf and only to provide Optima Online.

Security. Everything travels over an encrypted connection. A browser must be approved by the owner before it can reach the pharmacy, staff sessions end after a period of inactivity, and one pharmacy cannot reach another’s records.

Taking your data. The owner can download the whole pharmacy at any time, in any state of the plan. We do not delete a pharmacy’s records automatically. If we ever introduce a deletion schedule we will tell the owner in writing first.

If you join the waitlist, we store your email address and which part of the page you signed up from.

If you buy a licence, we store:

• Your phone number, and your name and pharmacy name if you give them.
• Your order, what it cost, and its status.
• The M-Pesa confirmation Safaricom sends us, including the receipt number.
• Your licence, and a record of each computer it has been activated on. That record is a machine code and a set of one-way hashes, which cannot be turned back into anything about your hardware or about you.

Downloading Optima requires a free Optima account. When an installer is downloaded we record which account downloaded it, the version, the country the request came from and, if a salt is configured, a truncated one-way hash of the IP address. That is your download history: it lets us see which version you installed when you ask for help.

When you connect a computer to your account so it can receive updates, we record the computer's Windows name, its machine code, the Optima version and when it last checked for updates. You can disconnect it from your account at any time.

Marketing messages are optional. The sign-up checkbox starts unticked. We record the choice, the communication channels, where it was made and the policy version that was shown. You can withdraw that choice from your account at any time. Payment, security, activation and support messages needed to provide Optima are service messages and do not depend on marketing consent.

A planned future version may register the start of a trial when the computer happens to be online. That trial check-in will be best-effort: it will use the computer identity and first trial date only to prevent repeated trial resets. It will not contain pharmacy records, and being offline will never stop the trial or normal local operation. We will update this notice when that feature is actually released.

We count visits to this site ourselves. There is no Google Analytics, no Meta pixel, no advertising network and no third-party script of any kind: nobody outside this company is told that you were here.

Two cookies do the counting, and neither can be read by any code on the page:

• One that lasts a year, so a returning reader is not counted as a new one. It is a random number and nothing else.
• One that lasts thirty minutes of inactivity, so we can tell one visit from the next.

Against those we record which pages were opened, which buttons were pressed, roughly how far down a page somebody read and for how long, the site that linked here, the country Cloudflare reports, and whether the device is a phone, a tablet or a computer.

Your IP address is never stored. Where a salt is configured we keep a truncated one-way hash of it, the same as for downloads, which distinguishes visitors without identifying them. The address a page was reached at is reduced to its path, so anything a link happened to carry in a query string is discarded before it is written down. A referring site is reduced to its address, so a search you typed to find us is not kept.

None of it is joined to your account, sold, shared, or used to advertise to you, and it is deleted after six months.

Opening a referral link sets one more cookie, which lasts for the attribution period in the referral terms. It holds a random secret and nothing else; we store only a one-way hash of it, plus the code, the time and the page it was opened on. No IP address is kept.

When you later create an account, that record is attached to it so the person who introduced you can be credited if you buy. They see a masked pharmacy name, a date and a status, never your email, phone number or payment details. If you join the program yourself, we keep your code, the terms version you accepted, your earnings and payout requests, and pay to the M-Pesa number on your account. We also count whether a referral link was opened, led to an account, led to an installer download, or led to a qualifying purchase. The referrer sees only totals and the sharing method they chose (for example WhatsApp or QR), never a person's page-by-page activity, contact details, device, location or payment details.

To fulfil the contract you entered when you bought a licence: issuing it, reactivating it when you change computers, and proving it is yours if there is ever a question.

The activation history additionally protects against a single licence being shared between businesses, which is the one thing that would make a one-time price unsustainable.

A small number of service providers, each doing one job:

• Safaricom processes M-Pesa payments and tells us the result. They are the payment provider; we never see or store your M-Pesa PIN.
• Neon hosts the database this site uses, in the European Union.
• Cloudflare serves this website and the installer downloads, and, for Optima Online, stores the daily backups.
• Clerk handles sign-in for owners’ accounts, and Resend delivers the emails we send you.
• Northflank hosts the Optima Online server, in the United States.

We do not sell your data, we do not share it with advertisers, and there is no advertising or third-party tracking on this site.

Order, payment and licence records are kept for as long as the licence is valid, which for a perpetual licence means indefinitely, plus seven years afterwards for tax and accounting purposes.

Optima Online pharmacy records are kept for as long as the pharmacy has an account with us, and are not deleted automatically when a plan lapses or ends. Backup copies are replaced on a seven-day rolling basis.

Waitlist emails are kept until you ask to be removed, or until we have been in touch and you have said no.

Download records are kept for two years. Those made before downloads required an account hold nothing that identifies a person.

Under Kenya’s Data Protection Act you may ask us for a copy of what we hold about you, ask us to correct it, or ask us to delete it. Write to us and we will answer within 30 days.

One honest limit: we cannot delete an order or a payment record while we are legally required to keep it for tax purposes, and we cannot delete a licence record without invalidating the licence you paid for. We will explain rather than refuse silently.

Nothing in this section applies to your pharmacy’s own records - your patients, your staff, your sales. With Optima Desktop those are on your computer and we never receive them. With Optima Online they are on our server, we hold them on your behalf, and either way you are the data controller for them.

Questions about privacy, or a request about your data, go to the email address at the bottom of this page. A person reads it.