Privacy Policy
Tabarak Pharmacy Mobile App Last updated: October 2026
1. Introduction
Tabarak Pharmacy W.L.L., Commercial Registration No. 12750601, Kingdom of Bahrain (“Tabarak Pharmacy”, “we”, “us”, “our”), operates the Tabarak Pharmacy mobile application (the “App”).
This Privacy Policy explains what personal data we collect, why we use it, who we share it with, how we protect it and what rights you have. We act as the “data manager” (data controller) of your personal data under Bahrain’s Personal Data Protection Law (Law No. 30 of 2018, the “PDPL”). By creating an account or using the App you confirm that you have read this Policy. Where the law requires your consent (for example, for health data), we ask for it separately.
2. Data We Collect
Account and identity data: full name, mobile number, email address, date of birth, gender, password (stored in encrypted form), and where required, CPR (national ID) number.
Order and delivery data: delivery addresses, order history, payment status, delivery instructions, and contact details for the person receiving the order.
Health data (sensitive personal data): prescriptions you upload or request us to fill, medicine names and quantities, allergies, chronic conditions, pharmacist consultation notes, and any health information you choose to enter. Photos or scans of prescriptions are included.
Payment data: we do not store full card numbers. Payments are processed by secure payment providers (including BenefitPay, card gateways, T-wallet, and other payment gateways), which give us a transaction reference, the last four digits of the card and the payment status.
Device and usage data: device model, operating system, app version, IP address, language, crash logs, and in-app activity. Approximate or precise location if you allow it, to find the nearest branch or deliver your order.
Communications: messages with our support team or pharmacists, and your notification preferences.
Data from the App’s permissions: camera (to scan prescriptions or barcodes), photo library, location, notifications and, if offered, biometric login. The App works with these permissions off, though some features will be limited. Biometric data stays on your device and is not sent to us.
3. How We Use Your Data and Our Legal Basis
| Purpose | Data used | Basis |
|---|---|---|
| Create and manage your account | Account data | Contract / your consent |
| Process and deliver orders | Order, delivery, payment data | Contract |
| Verify and dispense prescriptions; pharmacist review of interactions and allergies | Health data | Your explicit consent and legal duties of a licensed pharmacy |
| Refill reminders and medicine alerts | Order and health data | Your consent |
| Customer support | Communications, order data | Contract / legitimate interest |
| Fraud prevention and security | Device, usage, payment data | Legitimate interest / legal duty |
| Improve the App and services | Usage and device data (anonymised where possible) | Legitimate interest |
| Offers and marketing | Contact details, purchase history | Your consent (you can opt out any time) |
| Comply with law, NHRA requirements and requests from authorities | As required | Legal obligation |
We do not sell your personal data. We do not use health data for marketing without your separate, explicit consent.
4. Sharing Your Data
We share data only where needed and only with:
- Our pharmacists and authorised staff, who are bound by professional and contractual confidentiality.
- Delivery partners (limited to name, phone number and address).
- Payment providers and banks to process payments.
- Technology service providers such as cloud hosting, SMS and email, analytics and crash reporting, under written agreements requiring them to protect your data and use it only on our instructions.
- Doctors, hospitals or insurers where you ask us to or where you have consented (for example, to verify a prescription or process an insurance claim).
- Regulators, courts and law enforcement, including the NHRA, the Ministry of Health and the Personal Data Protection Authority, where required by Bahraini law or a valid legal order.
- A successor business, if Tabarak Pharmacy is sold or merged, subject to this Policy continuing to apply.
5. Transfers Outside Bahrain
Some of our service providers may store or process data outside Bahrain. Where that happens, we transfer data only to countries or recipients that provide an adequate level of protection as recognised under the PDPL, or where we have obtained the required authorisation, contractual safeguards or your consent.
6. How Long We Keep Data
We keep data only as long as needed for the purposes above and as required by law:
- Account data: while your account is active and for 12 months after closure.
- Prescription and dispensing records: for the period required by Bahraini pharmacy regulations and NHRA rules.
- Transaction and tax records: for the period required by commercial and tax law.
- Support communications: 12 months.
- Marketing preferences: until you withdraw consent.
After that, we delete or anonymise the data securely.
7. Your Rights
Under the PDPL you have the right to:
- be informed about how your data is processed;
- access your data and obtain a copy;
- request correction of inaccurate or incomplete data;
- request deletion or blocking of data where we no longer have a lawful reason to keep it;
- withdraw your consent at any time (this does not affect processing done before withdrawal);
- object to processing for direct marketing;
- object to decisions made solely by automated means that significantly affect you;
- complain to the Personal Data Protection Authority if you believe your rights have been infringed.
To use these rights, email Tabarakph.info@gmail.com or use Settings > Privacy in the App. We may ask you to verify your identity first, and we will respond within the time required by law (commonly 30 days). Some data we must keep by law, and we will explain this if we cannot delete it.
8. Security
We use measures such as encryption in transit and at rest, access controls limited by role, secure authentication, logging and monitoring, regular security testing and staff confidentiality training. No system is completely secure. If a breach is likely to harm you, we will notify you and the competent authority as required by law. Please keep your password and device safe and tell us immediately if you suspect unauthorised access.
9. Children
The App is intended for adults aged 18 and over. Parents or guardians may order medicines for a child using their own account and are responsible for the child’s data they enter. We do not knowingly collect data directly from children without a guardian’s involvement. If you believe a child has created an account, contact us and we will delete it.
10. Cookies, Analytics and Notifications
The App may use device identifiers and analytics tools to understand usage and fix problems. Push notifications (order status, refill reminders, offers) can be turned off in your device settings or in the App. Marketing notifications require your consent and can be switched off separately.
11. Third-Party Links
The App may link to third-party sites or services. We are not responsible for their privacy practices, so please read their policies.
12. Changes to This Policy
We may update this Policy. We will notify you in the App or by message of material changes and, where required, ask for your consent again. The “Last updated” date above shows the current version.
13. Contact Us
Data Protection Contact: Tabarak Pharmacy Compliance Team Email: Tabarakph.info@gmail.com Phone: +973 33866650 Address: Kingdom of Bahrain
