---

1. Introduction & Commitment to Privacy

PharmaCare Systems (“PharmaCare”, “we”, “our”, or “us”) is committed to protecting your privacy and ensuring the highest standards of data security. This Privacy Policy explains how we collect, use, disclose, and safeguard personal and business data when you visit our website (pharmacyinventery.com) or license and operate the PharmaCare POS software.

We comply with applicable international data protection standards, including the General Data Protection Regulation (GDPR) and industry-standard security frameworks for business software.

2. Patient Health Information (PHI) & Pharmacy Data Isolation

PharmaCare POS operates strictly as a software vendor. We do not provide healthcare services, dispense prescriptions, or act as a medical custodian:

• Zero Proprietary Access: All patient profiles, doctor prescriptions, customer records, medicine transaction logs, and pharmacy financial data entered by your staff into the software are your exclusive property.
• Local Storage Default: In standard and offline deployments, all pharmacy operational data is stored locally on your own computer workstation in an isolated database file. PharmaCare Systems has zero administrative access to view, extract, or browse your local database.
• No Data Monetization: We never sell, rent, monetize, or trade patient health records, pharmacy customer information, or sales histories to pharmaceutical manufacturers, advertisers, or any third parties.

3. Information We Collect

We collect only the minimum necessary information required to operate, license, and support our software:

• Account & Registration Information: When you purchase a license or register an administrator account, we collect your business/pharmacy name, administrator contact name, email address, and phone number.
• Hardware & License Verification Identifiers: To enforce single-seat licensing and prevent software piracy, our client application generates an anonymized cryptographic hardware hash (derived from CPU and motherboard hardware identifiers). This hash is used strictly to validate active license entitlement.
• Payment Information (Processed by Paddle): All payments are processed through our authorized Merchant of Record, Paddle. PharmaCare Systems does not collect, view, or store credit/debit card numbers, CVVs, or bank credentials. All card data is handled exclusively by Paddle under Level 1 PCI-DSS compliance.
• Technical & Log Data: When accessing our cloud services, web servers automatically log standard diagnostic data, including your IP address, browser user-agent, operating system, and timestamp.

4. Legal Basis for Processing

We process your data under the following lawful grounds:

• Contractual Necessity: To fulfill our obligation to provide software licenses, updates, and customer support.
• Legitimate Interests: To protect our intellectual property against piracy, secure our servers against unauthorized access, and ensure reliable software operations.
• Legal Compliance: To satisfy tax, accounting, and regulatory obligations as required by law.

5. Third-Party Subprocessors & Service Providers

We engage trusted third-party service providers who assist us in delivering our services:

• Paddle.com Market Ltd (Merchant of Record): Manages international payment processing, order fulfillment, anti-fraud screening, customer billing portal, and global VAT/sales tax compliance. Privacy Policy: paddle.com/legal/privacy.
• Cloud Infrastructure Hosting (Oracle Cloud / VPS): Provides encrypted server infrastructure for the public landing website and cloud database snapshot mirrors.

6. Cookies & Tracking Technologies

Our website uses strictly necessary functional session cookies required for user authentication, security CSRF tokens, and user theme preferences. We do NOT utilize third-party tracking pixels, behavioral advertising cookies, or invasive cross-site analytics.

7. Data Retention & Your Legal Rights

We retain account registration records and transaction metadata for as long as your license remains active, or as required by applicable tax and commercial laws.

Under applicable data protection laws (including GDPR and CCPA), you have the right to:

• Access & Portability: Request a copy of the personal information we hold about you.
• Rectification: Request correction of inaccurate or incomplete information.
• Erasure (“Right to be Forgotten”): Request deletion of your personal account data, subject to statutory retention requirements.
• Objection & Restriction: Object to or restrict the processing of your information.

To exercise any of these rights, please contact our Privacy Officer at pharmacyinventery@gmail.com.

8. Data Security Safeguards

We implement rigorous technical and organizational security controls to protect your data, including:

• End-to-end TLS 1.3 cryptographic transport encryption for all web and sync traffic.
• Bcrypt password hashing with unique salts for all user authentication credentials.
• Time-based One-Time Password (TOTP) two-factor authentication for administrative accounts.
• Hardware fingerprint binding to prevent unauthorized remote access to licensed workstations.

9. Contact the Privacy Officer

For privacy-related inquiries, data subject requests, or security reports, please contact: