PharmKulen — Privacy Policy
Effective Date: 1 June 2026 · Last Updated: 25 May 2026
PharmKulen Technologies Co., Ltd. (Cambodia Reg. No. 1000605077), with registered office at #306BCD, 4th Floor, Room 6, Preah Monivong Boulevard (93), Sangkat Chaktomuk, Khan Daun Penh, Phnom Penh, Cambodia, and, where applicable, PharmKulen Pte. Ltd. (Singapore UEN: 202615545H).
Contact for privacy matters: privacy@pharmkulen.com
This Privacy Policy explains how PharmKulen ("we", "us", "our") collects, uses, shares, retains, and protects personal data of users of the PharmKulen platform (the "Platform", as defined in our Terms of Service). It is incorporated into our Terms of Service.
1.1 This Policy applies when you use the PharmKulen website, Telegram Bot (@PharmKulenBot), Telegram Mini-App, mobile application(s), or any other PharmKulen interface.
1.2 It applies to consumers/patients. Data handling for Partner Pharmacies is governed separately by the Pharmacy Partner Agreement.
1.3 We process personal data in accordance with applicable Cambodian law, including the Law on E-Commerce (2019), the Law on Consumer Protection (2019), the Sub-Decree on E-Commerce (2020), the Law on the Management of Pharmaceuticals, and (for Singapore data flows) the Singapore Personal Data Protection Act 2012 ("PDPA") where applicable.
2.1 Data you provide directly
- Account data: full name, date of birth, gender, phone number, email address, Telegram username/ID, profile photo (optional).
- Identification data: where required by law (e.g., for prescription medicine collection), national ID number, passport number, or other government-issued ID.
- Order data: items ordered, prescriptions uploaded, delivery address, billing address, payment method (card token or KHQR reference — full card numbers are not stored by PharmKulen).
- Health-related data: where you upload a prescription, allergy information, or chronic-condition data — this is sensitive personal data treated with elevated safeguards (see Section 4).
- Communications: support tickets, chat messages, reviews, complaint records.
2.2 Data we collect automatically
- Device data: device model, operating system, app version, IP address, language, time zone.
- Usage data: pages viewed, features used, click paths, session duration, search queries, in-app errors.
- Location data: approximate location (city level) by default; precise GPS only when you grant permission for delivery/nearby-pharmacy features.
- Cookies and similar technologies on the web platform (see Section 9).
2.3 Data from third parties
- ABA PayWay and other payment processors — transaction status, payment confirmation, partial card metadata (last 4 digits, brand, expiry).
- Telegram — your Telegram ID, public username, name, profile photo if you use the Bot or Mini-App.
- Delivery Partner (e.g., Grab Cambodia) — delivery status, estimated time, driver name.
- Partner Pharmacies — Order acknowledgement, fulfilment status, refund processing.
We process personal data for the following purposes:
| Purpose | Lawful basis |
|---|---|
| To register and maintain your account | Performance of contract (these Terms) |
| To process and fulfil Orders | Performance of contract |
| To collect payments and issue refunds | Performance of contract; legal obligation |
| To verify prescriptions and confirm eligibility for prescription medicines | Legal obligation under Cambodian pharmaceutical law |
| To deliver Orders or coordinate pickup | Performance of contract |
| To comply with tax and accounting law (GDT) | Legal obligation |
| To prevent fraud, abuse, and unauthorised access | Legitimate interest |
| To improve the Platform and personalise listings | Legitimate interest; consent where required |
| To send transactional notifications (Order updates, OTPs) | Performance of contract |
| To send marketing communications | Consent (which you can withdraw at any time) |
| To respond to your support requests | Performance of contract; legitimate interest |
| To comply with lawful requests from regulators or law enforcement | Legal obligation |
4.1 Where you upload a prescription, share allergy information, or otherwise disclose health-related information, we treat this as sensitive personal data.
4.2 Sensitive personal data is:
- processed only for the purpose for which it was provided (typically fulfilment of a prescription-required Order);
- access-controlled, with access limited to PharmKulen staff and Partner Pharmacy staff who have a legitimate need;
- encrypted in transit and at rest where feasible;
- not used for marketing or profiling without your explicit, separate consent;
- retained no longer than required by Cambodian law (typically five years for prescription records, per Ministry of Health requirements) and then securely deleted or anonymised.
4.3 You may request deletion of non-statutorily-required sensitive data at any time by writing to privacy@pharmkulen.com.
We do not sell personal data. We share personal data only as follows:
5.1 Partner Pharmacies. When you place an Order, the relevant Partner Pharmacy receives the data needed to fulfil it: your name, contact, delivery address, Order contents, and where applicable your uploaded prescription. The Partner Pharmacy becomes a separate data controller for fulfilment purposes and is contractually bound by the Pharmacy Partner Agreement to handle your data lawfully.
5.2 Payment processors. ABA PayWay and any future payment provider receive the data required to process your payment, including amount, merchant reference, and tokenised payment instrument.
5.3 Delivery Partner. Where you choose delivery, the Delivery Partner (currently planned: Grab Cambodia) receives your name, contact, and delivery address.
5.4 Service providers. Cloud hosting (currently Render, located outside Cambodia), email delivery, SMS gateway, analytics, customer-support tooling, and security providers — each contractually bound to confidentiality and security obligations and permitted to use data only on our instructions.
5.5 Tax and accounting. Our external accountant (currently Moores Rowland Cambodia) receives transaction-level data for tax compliance.
5.6 Regulators and law enforcement. Where compelled by Cambodian law, court order, or a regulator with lawful jurisdiction (including the General Department of Taxation, Ministry of Health, Anti-Corruption Unit, and police).
5.7 Business transfers. If PharmKulen merges, acquires, or sells assets, personal data may transfer to the successor entity, subject to this Policy.
5.8 With your consent. Any other sharing with your explicit prior consent.
6.1 Some of our service providers (e.g., cloud hosting, email delivery) are located outside Cambodia, including Singapore, the European Union, and the United States.
6.2 Where personal data is transferred internationally, we take reasonable steps to ensure equivalent protection, including contractual safeguards with the receiving party.
6.3 You consent to such international transfer where required by Cambodian law.
7.1 We retain personal data for as long as needed for the purpose for which it was collected, and for any longer period required by Cambodian law.
| Data category | Retention period |
|---|---|
| Account profile | Active account + 2 years after closure |
| Order records | 5 years from the Order date (tax law / accounting) |
| Prescription records | 5 years from the Order date (MoH requirement) |
| Payment confirmation records | 5 years (banking / tax) |
| Support and complaint records | 3 years from resolution |
| Marketing-consent logs | Until consent withdrawn + 1 year |
| Server logs and security telemetry | 6–12 months |
7.2 At the end of retention, data is securely deleted or anonymised.
Subject to Cambodian law, you have the right to:
- access the personal data we hold about you;
- correct inaccurate or incomplete data;
- request deletion of data we are not required by law to retain;
- object to processing based on legitimate interests;
- withdraw consent for marketing communications at any time (this does not affect lawful processing already completed);
- request a copy of your data in a portable, machine-readable format;
- lodge a complaint with the Ministry of Commerce or any other competent Cambodian authority.
To exercise any of these rights, write to privacy@pharmkulen.com with sufficient information to identify your account. We will respond within 30 calendar days.
9.1 The PharmKulen website uses cookies and similar technologies to: (a) keep you logged in; (b) remember your preferences; (c) measure performance; and (d) detect fraud.
9.2 You can control cookies via your browser settings. Disabling necessary cookies may prevent the Platform from functioning correctly.
9.3 The Telegram Bot, Mini-App, and mobile app(s) do not use browser cookies but may use equivalent local-storage and SDK-based mechanisms for the same purposes.
10.1 We use reasonable technical and organisational measures appropriate to the risk, including:
- HTTPS/TLS encryption for data in transit;
- access controls and authentication for staff;
- logging of access to sensitive data;
- regular security review and patching;
- segregation of production and development environments;
- secure payment-processor integration (no card numbers stored by us).
10.2 No system is perfectly secure. If a personal-data breach occurs that is likely to result in significant harm, we will notify affected users and relevant authorities as required by Cambodian law.
11.1 The Platform is intended for users aged 18 and over.
11.2 If you are between 13 and 18, you may use the Platform only with the consent and supervision of a parent or legal guardian who accepts these Terms and this Policy on your behalf.
11.3 We do not knowingly collect personal data from anyone under 13. If we discover that we have, we will delete it promptly.
12.1 We may update this Policy from time to time. The "Last Updated" date will reflect the most recent revision.
12.2 Material changes — for example, new categories of data collected, new processing purposes, or expanded sharing — will be notified at least 14 days before they take effect, via the Platform, by email, or by in-app notification.
12.3 Continued use of the Platform after the effective date constitutes acceptance of the updated Policy.
This Policy is issued in English. An official Khmer-language translation is made available on the Platform. In the event of any inconsistency between the English and Khmer versions, the English version prevails, except to the extent the laws of the Kingdom of Cambodia require otherwise.
For privacy questions, data-subject requests, or complaints:
- Email: privacy@pharmkulen.com
- Postal address: PharmKulen Technologies Co., Ltd., #306BCD, 4th Floor, Room 6, Preah Monivong Boulevard (93), Sangkat Chaktomuk, Khan Daun Penh, Phnom Penh, Cambodia.
By using the Platform you confirm you have read and understood this Privacy Policy.