Back to Home

    Privacy Policy

    Last updated: 20 March 2026

    OpenPharms (Pty) Ltd ("OpenPharms", "we", "us", or "our") is committed to protecting the privacy and personal information of all users of the OpenPharms telemedicine and medical cannabis distribution platform (the "Platform"). This Privacy Policy explains how we collect, use, store, share, and protect your personal information in compliance with applicable data protection laws, including:

    • The Protection of Personal Information Act, 2013 (POPIA) of the Republic of South Africa;
    • The General Data Protection Regulation (GDPR) (EU) 2016/679, where applicable to users within the European Economic Area;
    • The Health Professions Act, 1974 and the National Health Act, 2003 of South Africa, insofar as they relate to telemedicine and patient data.

    1. Responsible Party / Data Controller

    OpenPharms (Pty) Ltd
    Registration No.: [Company Reg. No.]
    Registered Address: Cape Town, South Africa
    Information Officer: admin@openpharms.com
    Contact: 064 556 1022

    2. Information We Collect

    2.1 Personal Information

    • Full name, identity/passport number, date of birth
    • Contact details (email address, phone number, physical address)
    • Professional registration details (for healthcare providers and pharmacists)
    • SAHPRA Section 21 permit references and related regulatory documentation

    2.2 Health Information (Special Personal Information)

    • Medical history and diagnoses relevant to cannabis-based prescription medicine
    • Prescription details and treatment records
    • Telemedicine consultation notes and recordings (where consent is obtained)

    2.3 Technical and Usage Data

    • IP addresses, browser type, device identifiers
    • Platform usage analytics and session data
    • QR code scan history for product verification
    • Cookies and similar tracking technologies

    2.4 Supply Chain Data

    • Cultivation batch information and traceability records
    • GMP compliance certificates and lab testing results
    • Distribution and dispensing records

    3. Lawful Basis for Processing

    We process personal information on the following legal grounds:

    • Consent – Where you have provided explicit, informed, and voluntary consent (POPIA s11(1)(a); GDPR Art. 6(1)(a));
    • Contractual Necessity – To perform our obligations under a service agreement (POPIA s11(1)(b); GDPR Art. 6(1)(b));
    • Legal Obligation – To comply with the Medicines and Related Substances Act, SAHPRA regulations, and other statutory requirements (POPIA s11(1)(c); GDPR Art. 6(1)(c));
    • Legitimate Interest – For fraud prevention, platform security, and product traceability (GDPR Art. 6(1)(f));
    • Vital Interest – Where processing is necessary to protect a patient's health or life (POPIA s11(1)(d); GDPR Art. 6(1)(d)).

    4. How We Use Your Information

    • Facilitating telemedicine consultations between patients and licensed healthcare providers
    • Processing and tracking prescriptions for cannabis-based medicines
    • Enabling seed-to-patient traceability and product verification
    • Verifying professional credentials of doctors, pharmacists, and licensed producers
    • Regulatory reporting to SAHPRA and other relevant authorities
    • Improving platform functionality, security, and user experience
    • Communicating service updates, safety notices, and regulatory changes

    5. Data Sharing and Disclosure

    We may share personal information with:

    • Healthcare Providers – Doctors and pharmacists involved in your care, as necessary for treatment;
    • Licensed Producers & Cultivators – Limited supply chain data for traceability compliance;
    • Regulatory Authorities – SAHPRA, the Department of Health, and law enforcement where legally required;
    • Service Providers – Cloud hosting, payment processors, and analytics providers under strict data processing agreements;
    • Legal Proceedings – Where disclosure is required by court order or statutory obligation.

    We will never sell your personal information to third parties for marketing purposes.

    6. Cross-Border Data Transfers

    Where personal information is transferred outside of South Africa or the EEA, we ensure adequate safeguards are in place, including Standard Contractual Clauses (GDPR Art. 46) and compliance with POPIA s72 requirements for trans-border flows of personal information.

    7. Data Security

    We implement appropriate technical and organisational measures to protect your data, including:

    • End-to-end encryption for telemedicine consultations and data in transit
    • AES-256 encryption for data at rest
    • Role-based access controls and multi-factor authentication
    • Regular security audits and penetration testing
    • Blockchain-anchored supply chain records for tamper-proof traceability

    8. Data Retention

    We retain personal information only for as long as necessary to fulfil the purposes outlined in this policy, or as required by law. Medical records are retained in accordance with the Health Professions Act (minimum 5 years from last consultation, or longer if required). You may request deletion of non-statutory data at any time.

    9. Your Rights

    Under POPIA, you have the right to:

    • Access your personal information held by us
    • Request correction or deletion of inaccurate data
    • Object to the processing of your personal information
    • Withdraw consent at any time (without affecting lawfulness of prior processing)
    • Lodge a complaint with the Information Regulator of South Africa

    Under GDPR (where applicable), you additionally have the right to:

    • Data portability
    • Restriction of processing
    • Object to automated decision-making and profiling
    • Lodge a complaint with your national Data Protection Authority

    10. Cookies and Tracking

    We use strictly necessary cookies to operate the Platform and optional analytics cookies to improve our services. You can manage your cookie preferences through your browser settings. We will not deploy non-essential cookies without your prior consent.

    11. Children's Privacy

    The Platform is not intended for use by persons under 18 years of age. We do not knowingly collect personal information from minors. Where a patient under 18 requires access to medical cannabis, all interactions must be conducted by or through a parent or legal guardian.

    12. Changes to This Policy

    We may update this Privacy Policy from time to time. Material changes will be communicated via the Platform or by email. Continued use of the Platform after such notification constitutes acceptance of the revised policy.

    13. Contact Us

    For privacy-related enquiries, data access requests, or complaints:
    Email: admin@openpharms.com
    Phone / WhatsApp: 064 556 1022
    Information Regulator (South Africa): inforegulator.org.za