PharmKulen — Privacy Policy

PharmKulen Technologies Co., Ltd. (Cambodia Reg. No. 1000605077), with registered office at #306BCD, 4th Floor, Room 6, Preah Monivong Boulevard (93), Sangkat Chaktomuk, Khan Daun Penh, Phnom Penh, Cambodia, and, where applicable, PharmKulen Pte. Ltd. (Singapore UEN: 202615545H).

Contact for privacy matters: privacy@pharmkulen.com

This Privacy Policy explains how PharmKulen ("we", "us", "our") collects, uses, shares, retains, and protects personal data of users of the PharmKulen platform (the "Platform", as defined in our Terms of Service). It is incorporated into our Terms of Service.

1.1 This Policy applies when you use the PharmKulen website, Telegram Bot (@PharmKulenBot), Telegram Mini-App, mobile application(s), or any other PharmKulen interface.

1.2 It applies to consumers/patients. Data handling for Partner Pharmacies is governed separately by the Pharmacy Partner Agreement.

1.3 We process personal data in accordance with applicable Cambodian law, including the Law on E-Commerce (2019), the Law on Consumer Protection (2019), the Sub-Decree on E-Commerce (2020), the Law on the Management of Pharmaceuticals, and (for Singapore data flows) the Singapore Personal Data Protection Act 2012 ("PDPA") where applicable.

We process personal data for the following purposes:

4.1 Where you upload a prescription, share allergy information, or otherwise disclose health-related information, we treat this as sensitive personal data.

4.2 Sensitive personal data is:

• processed only for the purpose for which it was provided (typically fulfilment of a prescription-required Order);
• access-controlled, with access limited to PharmKulen staff and Partner Pharmacy staff who have a legitimate need;
• encrypted in transit and at rest where feasible;
• not used for marketing or profiling without your explicit, separate consent;
• retained no longer than required by Cambodian law (typically five years for prescription records, per Ministry of Health requirements) and then securely deleted or anonymised.

4.3 You may request deletion of non-statutorily-required sensitive data at any time by writing to privacy@pharmkulen.com.

We do not sell personal data. We share personal data only as follows:

5.1 Partner Pharmacies. When you place an Order, the relevant Partner Pharmacy receives the data needed to fulfil it: your name, contact, delivery address, Order contents, and where applicable your uploaded prescription. The Partner Pharmacy becomes a separate data controller for fulfilment purposes and is contractually bound by the Pharmacy Partner Agreement to handle your data lawfully.

5.2 Payment processors. ABA PayWay and any future payment provider receive the data required to process your payment, including amount, merchant reference, and tokenised payment instrument.

5.3 Delivery Partner. Where you choose delivery, the Delivery Partner (currently planned: Grab Cambodia) receives your name, contact, and delivery address.

5.4 Service providers. Cloud hosting (currently Render, located outside Cambodia), email delivery, SMS gateway, analytics, customer-support tooling, and security providers — each contractually bound to confidentiality and security obligations and permitted to use data only on our instructions.

5.5 Tax and accounting. Our external accountant (currently Moores Rowland Cambodia) receives transaction-level data for tax compliance.

5.6 Regulators and law enforcement. Where compelled by Cambodian law, court order, or a regulator with lawful jurisdiction (including the General Department of Taxation, Ministry of Health, Anti-Corruption Unit, and police).

5.7 Business transfers. If PharmKulen merges, acquires, or sells assets, personal data may transfer to the successor entity, subject to this Policy.

5.8 With your consent. Any other sharing with your explicit prior consent.

6.1 Some of our service providers (e.g., cloud hosting, email delivery) are located outside Cambodia, including Singapore, the European Union, and the United States.

6.2 Where personal data is transferred internationally, we take reasonable steps to ensure equivalent protection, including contractual safeguards with the receiving party.

6.3 You consent to such international transfer where required by Cambodian law.

7.1 We retain personal data for as long as needed for the purpose for which it was collected, and for any longer period required by Cambodian law.

7.2 At the end of retention, data is securely deleted or anonymised.

Subject to Cambodian law, you have the right to:

• access the personal data we hold about you;
• correct inaccurate or incomplete data;
• request deletion of data we are not required by law to retain;
• object to processing based on legitimate interests;
• withdraw consent for marketing communications at any time (this does not affect lawful processing already completed);
• request a copy of your data in a portable, machine-readable format;
• lodge a complaint with the Ministry of Commerce or any other competent Cambodian authority.

To exercise any of these rights, write to privacy@pharmkulen.com with sufficient information to identify your account. We will respond within 30 calendar days.

9.1 The PharmKulen website uses cookies and similar technologies to: (a) keep you logged in; (b) remember your preferences; (c) measure performance; and (d) detect fraud.

9.2 You can control cookies via your browser settings. Disabling necessary cookies may prevent the Platform from functioning correctly.

9.3 The Telegram Bot, Mini-App, and mobile app(s) do not use browser cookies but may use equivalent local-storage and SDK-based mechanisms for the same purposes.

10.1 We use reasonable technical and organisational measures appropriate to the risk, including:

• HTTPS/TLS encryption for data in transit;
• access controls and authentication for staff;
• logging of access to sensitive data;
• regular security review and patching;
• segregation of production and development environments;
• secure payment-processor integration (no card numbers stored by us).

10.2 No system is perfectly secure. If a personal-data breach occurs that is likely to result in significant harm, we will notify affected users and relevant authorities as required by Cambodian law.

11.1 The Platform is intended for users aged 18 and over.

11.2 If you are between 13 and 18, you may use the Platform only with the consent and supervision of a parent or legal guardian who accepts these Terms and this Policy on your behalf.

11.3 We do not knowingly collect personal data from anyone under 13. If we discover that we have, we will delete it promptly.

12.1 We may update this Policy from time to time. The "Last Updated" date will reflect the most recent revision.

12.2 Material changes — for example, new categories of data collected, new processing purposes, or expanded sharing — will be notified at least 14 days before they take effect, via the Platform, by email, or by in-app notification.

12.3 Continued use of the Platform after the effective date constitutes acceptance of the updated Policy.

This Policy is issued in English. An official Khmer-language translation is made available on the Platform. In the event of any inconsistency between the English and Khmer versions, the English version prevails, except to the extent the laws of the Kingdom of Cambodia require otherwise.

For privacy questions, data-subject requests, or complaints:

• Email: privacy@pharmkulen.com
• Postal address: PharmKulen Technologies Co., Ltd., #306BCD, 4th Floor, Room 6, Preah Monivong Boulevard (93), Sangkat Chaktomuk, Khan Daun Penh, Phnom Penh, Cambodia.