Effective Date 31/03/2026 Last Updated 21/05/2026 Review Cycle Annual / On Regulatory Change
Afyask Telepharmacy Limited (“Afyask”, “we”, “us”, or “our”) is a technology company incorporated in the United Republic of Tanzania with Registration Number 187879191. We operate prescription routing platform that connects patients to licensed pharmacies for the fulfilment and doorstep delivery of pharmaceutical prescriptions. Our platform serves three principal user groups: patients who use our mobile application or WhatsApp interface to submit or receive prescriptions; prescribers (doctors and other licensed medical practitioners) who issue digital prescriptions through our telehealth partner integrations; and pharmacy partners who fulfil and dispense prescriptions through our network. Afyask acts as a Data Controller in respect of data it collects directly from users of its platform, and as a Data Processor in respect of patient prescription data transmitted to us by telehealth partner platforms. Where relevant, this distinction is identified throughout this Policy.
This Privacy Policy applies to all personal data collected, processed, stored, or transmitted by Afyask in connection with the use of:
• The Afyask mobile application (iOS and Android);
• The Afyask WhatsApp prescription submission interface;
• The Afyask web portal (afyask.com);
• The Afyask prescription routing API and any integrations with telehealth partner platforms;
• Any communications between users and Afyask, including email, SMS, and in-app messaging.
This Policy does not apply to the privacy practices of third-party telehealth platforms, pharmacy partners, or logistics providers that operate their own independent platforms. Where you access Afyask services through a third-party telehealth platform, that platform’s own privacy policy will also apply to your use of that platform.
We collect different categories of personal data depending on whether you are a patient, a prescriber, or a pharmacy partner. The following tables identify each category, the data elements collected, and the basis for collection.
Identity Data
Full name, date of birth, national ID number (optional), photograph (if provided). Legal basis: Contract performance; legal compliance.
Contact Data
Mobile phone number, email address, delivery address. Legal basis: Contract performance.
Health & Medical Data
Prescription details, medication names, dosage, prescribing practitioner, diagnosis (if included on prescription), medical history (if provided voluntarily). Legal basis: Contract performance; vital interests; legal obligation.
Prescription Images
Photographs of paper prescriptions uploaded by the patient via self-upload path. Legal basis: Contract performance; fraud prevention.
Transaction Data
Order history, prescription fulfilment status, delivery records, payment method (where applicable). Legal basis: Contract performance; legal compliance.
Device & Usage Data
IP address, device type, operating system, app version, session logs. Legal basis: Legitimate interests (security, fraud prevention).
Location Data
Delivery address; approximate location for pharmacy routing (not continuous tracking). Legal basis: Contract performance.
Communications Data
Messages sent to Afyask support, WhatsApp message content relating to prescriptions. Legal basis: Contract performance; legal obligation.
Identity Data
Full name, Medical Council registration number, specialisation. Legal basis: Contract performance; legal obligation.
Contact Data
Email address, telephone number, practice address. Legal basis: Contract performance.
Professional Data
Prescribing licence, scope of practice, digital signature (where used). Legal basis: Legal obligation; fraud prevention.
Prescription Data
Prescriptions issued via Afyask-integrated platforms. Legal basis: Legal obligation; contract performance.
Business Identity Data
Pharmacy name, Tanzania Pharmacy Council licence number, business registration. Legal basis: Contract; legal compliance.
Contact Data
Designated contact name, email, telephone, physical address. Legal basis: Contract performance.
Operational Data
Stock availability data shared with Afyask routing engine, fulfilment records. Legal basis: Contract performance.
Financial Data
Bank account details for routing fee settlement. Legal basis: Contract performance; legal obligation.
Every use of your personal information must have a lawful basis under the PDPA. We rely on the following bases, depending on the purpose for which we are processing your information.
The primary basis on which we process your personal information is to fulfil our service obligations to you. When you submit a prescription, processing your prescription information, routing it to a pharmacy, verifying it, and arranging delivery are all necessary steps to perform that service. We could not provide the Afyask service without processing this information.
Because prescription and medication information is health data, a special category of sensitive personal data under the PDPA, we obtain your explicit consent before processing it. You give this consent when you first submit a prescription. You can withdraw your consent at any time by contacting info@afyask.com, though doing so will mean we can no longer process your prescriptions, as health data processing is integral to our service. Withdrawal does not affect the lawfulness of processing that took place before withdrawal.
We are required by Tanzanian law, including the Tanzania Pharmacy Act and related regulations, to retain certain records relating to prescription dispensing. We retain such records to comply with these obligations even if you request deletion of your account, and we will explain this clearly if you make such a request.
We process certain information on the basis of our legitimate interests as a business, where those interests are not overridden by your rights. This includes operating our fraud detection and verification systems, maintaining the security and integrity of our Platform, conducting internal analysis using aggregated and de-identified data to improve our service, and keeping records of our compliance activities. In each case, we are satisfied that our legitimate interests do not override your right to privacy.
• Receiving and processing digital or paper-based prescriptions submitted through our platform;
• Verifying prescription authenticity and completeness through our AI-assisted and human pharmacist review process;
• Routing verified prescriptions to the nearest in-stock licensed pharmacy within your service area;
• Coordinating last-mile delivery of dispensed medication to your specified delivery address;
• Providing real-time prescription status updates via in-app notifications, SMS, or WhatsApp;
• Managing your order history and prescription records within your Afyask account.
• Cross-referencing prescriber credentials against the Medical Council of Tanzania’s register to prevent fraudulent prescriptions;
• Conducting risk-tiered verification: prescriptions assessed as high-risk are subject to prescriber call-back before fulfilment;
• Detecting and preventing the submission of forged, altered, or duplicate prescriptions;
• Maintaining audit logs of all prescription transactions for compliance and dispute resolution purposes.
• Analyzing aggregated, anonymized prescription routing data to improve pharmacy matching accuracy and reduce fulfilment time;
• Monitoring system performance, identifying technical errors, and improving the security of our platform;
• Conducting internal research using de-identified data to enhance our verification algorithms.
We will NOT use your personal data for: unsolicited marketing without your consent; profiling for commercial advertising; sales or license to third-party advertisers; any purpose incompatible with the purposes set out in this Policy.
Afyask shares personal data only where necessary for the fulfilment of your prescription or where required by law. We do not sell personal data. We do not share health data with insurers, employers, or advertisers.
Prescription details, patient delivery address, and medication required are shared for prescription fulfilment and dispensing.
Prescription status updates and fulfilment confirmation are shared to close the loop for the originating consultation.
Patient name, delivery address, and order reference number are shared for last-mile delivery of dispensed medication.
Encrypted platform data (patient data at rest and in transit) is processed for hosting and infrastructure services under a Data Processing Agreement.
Transaction amount and payment method reference (no full card numbers stored by Afyask) are shared for processing delivery fee payments where applicable.
Prescription records, pharmacist verification logs, and data subject information may be shared in response to lawful requests from the PDPC, Pharmacy Council, TMDA, or courts.
Limited data necessary to defend or prosecute legal claims or obtain professional advice, under legal obligation or legitimate interests.
Complaint and rights request records for PDPA compliance obligations.
Afyask processes and stores all patient prescription data within the United Republic of Tanzania, consistent with the PDPA’s requirements for data localization. We do not transfer patient health data outside Tanzania to foreign jurisdictions without compliance with Part 5 of the PDPA.
Where we use cloud infrastructure or software services hosted outside Tanzania (for example, server infrastructure or analytics tools), we implement the following safeguards before any transfer occurs:
• Confirming that the recipient country provides an adequate level of data protection recognized by the PDPC;
• Entering into standard data transfer clauses approved by the PDPC;
• Ensuring that data is encrypted in transit using TLS 1.3 or equivalent protocols;
• Ensuring that health and prescription data specifically is not processed outside Tanzania without explicit legal justification.
If you have questions about specific data transfers or the safeguards we have in place, please contact our Data Protection Officer at info@afyask.com
We retain personal data only for as long as necessary to fulfil the purposes for which it was collected, to comply with our legal obligations, and to resolve disputes or enforce our agreements. The following sets out our principal retention periods.
Retained for 5 years from fulfilment. Basis: Pharmacy Act (Cap. 152); TMDA requirements; legal disputes.
Retained for the duration of active account plus 2 years after deletion request. Basis: Contract; legal obligation.
Retained for 5 years from last prescription issued via Afyask. Basis: Regulatory compliance; fraud prevention.
Retained for 90 days post-fulfilment, then securely deleted. Basis: Fulfilment only; minimisation principle.
Retained for 7 years. Basis: Tax and financial regulations.
Retained for 3 years. Basis: Fraud prevention; legal obligation.
Retained for 3 years from resolution. Basis: Dispute resolution; legal obligation.
Retained until consent is withdrawn plus 1 year. Basis: PDPA consent records.
Retained indefinitely (no personal data). Basis: Platform improvement; no retention limit applicable.
Upon expiry of the applicable retention period, personal data is either securely deleted using cryptographic erasure or anonymised in a manner that prevents re-identification. Physical prescription records are destroyed in compliance with secure document disposal standards.
The PDPA 2022 grants you the following rights in respect of your personal data. We are committed to honouring all valid rights requests promptly and without charge, subject to the conditions and limitations set out in the PDPA.
You may request a copy of the personal data we hold about you, including the categories of data, the purposes of processing, recipients, and retention periods. We will respond within 21 days of receiving a valid request.
If any personal data we hold is inaccurate or incomplete, you have the right to have it corrected or completed without undue delay. For prescription data, corrections may be subject to pharmacist review for safety reasons.
You may request deletion of your personal data where (a) the data is no longer necessary for the original purpose; (b) you withdraw consent (where consent is the legal basis); or (c) the processing was unlawful. This right does not apply where retention is required by law (e.g. prescription records under the Pharmacy Act).
You may ask us to suspend processing of your data (without deleting it) where you contest its accuracy, have objected to processing, or where the processing is unlawful but you prefer restriction to erasure.
Where we process your data on the basis of consent or contract, you may request a structured, machine-readable copy of your data for transfer to another provider. This right applies to data you have provided directly to us.
You may object at any time to processing based on our legitimate interests or for direct marketing purposes. We will cease such processing unless we can demonstrate compelling legitimate grounds that override your rights.
Where processing is based on your consent (e.g., marketing communications), you may withdraw consent at any time without affecting the lawfulness of processing carried out before withdrawal.
You have the right to lodge a complaint with the Personal Data Protection Commission (PDPC) of Tanzania if you believe we have processed your data in breach of the PDPA. Contact the PDPC at: pdpc.go.tz.
Afyask implements a layered technical and organizational security framework designed to protect personal data against unauthorized access, accidental loss, destruction, alteration, or disclosure. Given that we handle sensitive health data, our security standards are held to a high standard.
• All data transmitted between your device and Afyask’s servers is encrypted using TLS 1.3; • Patient prescription data is encrypted at rest using AES-256 encryption; • Prescription images are stored in isolated, access-controlled storage with time-limited access tokens; • API communications between Afyask and partner telehealth platforms use authenticated, encrypted REST API calls with rotating API keys; • Role-based access controls ensure that Afyask staff access personal data only where necessary for their job function; • All staff with access to personal data are subject to confidentiality obligations.
• A dedicated Data Protection Officer oversees all data processing activities and PDPA compliance; • All Afyask staff receive data protection training before handling personal data; • Third-party processors are assessed for security compliance before engagement and are bound by Data Processing Agreements; • Afyask conducts regular internal audits of data processing activities; • A documented data breach response plan is in place; significant breaches are reported to the PDPC within 72 hours.
• Paper prescription images are reviewed only by authorized Afyask pharmacist reviewers and are not accessible to other staff; • High-risk prescription processing is logged with a full audit trail including reviewer identity, verification time, and outcome; • Prescriber call-back records are retained as part of the prescription audit log; • Prescription images are automatically deleted 90 days after fulfilment.
Afyask uses cookies and similar tracking technologies on its web portal (afyask.com). We do not use third-party advertising cookies. The following table identifies the cookies we use and their purposes.
Maintain your login session and platform security during use. Cannot be disabled.
Securely identify your account when you access your prescriptions or order history. Cannot be disabled.
Remember your platform preferences (language, notification settings). Deletable.
Measure platform performance and feature usage using anonymised data. No personal identifiers. You can opt out.
You can control cookie preferences through your browser settings or via the cookie preference centre in our web portal. Note that disabling strictly necessary cookies will affect your ability to use the platform. Our mobile application does not use cookies; it uses equivalent session management technologies described in our App Privacy Notice.
Afyask’s services are intended for adults aged 18 and over. We do not knowingly collect, process, or store personal data from children under the age of 18. If you are a parent or guardian and believe your child has submitted personal data to our platform, please contact us immediately at info@afyask.com We will promptly delete any personal data relating to a child upon verification of a valid parental request. In exceptional circumstances where a prescription is issued for a minor patient through a healthcare professional, processing occurs under the explicit authorization of a parent, guardian, or attending medical practitioner. In such cases, the adult’s consent and identity are documented in the prescription record.
Where you access Afyask’s prescription fulfilment service through a third-party telehealth platform (such as a telehealth consultation app), the following data sharing arrangement applies:
• The telehealth platform acts as the Data Controller for your patient data and is responsible for obtaining your consent to share your prescription data with Afyask;
• Afyask receives your prescription data from the telehealth platform as a Data Processor, and processes it solely for the purpose of prescription routing and fulfilment;
• Afyask will return prescription status updates (fulfilled, in-transit, delivered) to the telehealth platform for display within their patient interface;
• Afyask does not use prescription data received from telehealth partners for any purpose other than fulfilment, unless you have separately consented to additional uses.
If you have questions about how a specific telehealth platform handles your data, please refer to that platform’s own privacy policy. Afyask is not responsible for the data practices of third-party telehealth platforms.
We may update this Privacy Policy from time to time to reflect changes in our data processing practices, changes in applicable law, or changes to our platform. We will notify you of material changes by:
• Posting a notice within the Afyask app or web portal at least 14 days before the change takes effect;
• Sending an email notification to your registered email address (for material changes affecting your rights);
• Updating the “Last Updated” date at the top of this document.
If we make a material change to the legal basis on which we process your sensitive health data, we will seek your fresh consent before the change takes effect. Your continued use of Afyask’s platform after the effective date of a non-material change constitutes acceptance of the updated Policy.
All previous versions of this Privacy Policy are available from our Data Protection Officer upon request.
If you have any questions about this Privacy Policy, wish to exercise your rights, or have a concern about how we have handled your personal data, please contact our Data Protection Officer:
Email: info@afyask.com
Post: Data Protection Officer, Afyask Limited, Dar es salaam, Tanzania
Response Time: We aim to respond to all valid data subject requests within 21 days of receipt.
If you are not satisfied with our response to a complaint, you have the right to escalate your complaint to the Personal Data Protection Commission (PDPC) of Tanzania:
Regulator: Personal Data Protection Commission (PDPC)
Website: www.pdpc.go.tz
Email: info@pdpc.go.tz
Address: Personal Data Protection Commission, Dar es Salaam, United Republic of Tanzania
In this Privacy Policy, the following terms have the meanings set out below:
Afyask / We / Us / Our: Afyask Telepharmacy Limited, a company incorporated in Tanzania with Registration Number 187879191, operating the Afyask prescription routing platform.
Data Controller: A natural or legal person that determines the purposes and means of processing personal data, as defined in section 4 of the PDPA.
Data Processor: A natural or legal person that processes personal data on behalf of a Data Controller and under its instructions.
Data Protection Officer (DPO): The individual appointed by Afyask to oversee data protection compliance and serve as the point of contact for data subjects and the PDPC.
PDPA: The Personal Data Protection Act, No. 11 of 2022 (United Republic of Tanzania), and all subsidiary regulations and guidance issued thereunder.
PDPC: The Personal Data Protection Commission of Tanzania, established under the PDPA to enforce data protection law.
Personal Data: Any information relating to an identified or identifiable natural person, as defined in section 4 of the PDPA.
Prescription Data: Information contained in or derived from a medical prescription, including medication name, dosage, prescriber details, and patient identity.
Sensitive Personal Data: A special category of personal data requiring enhanced protection, including health and medical data, as defined in section 4 of the PDPA.
Telehealth Partner: A third-party telehealth consultation platform that has integrated Afyask’s prescription routing API to enable digital prescription fulfilment for its patients.
User / You / Your: Any individual accessing Afyask’s platform as a patient, prescriber, pharmacy partner representative, or general visitor to our web portal.
