Privacy Policy

Welcome to Medon Pharmacy L.L.C(“Medon,” “we,” “us,” or “our”). We are a licensed pharmacy headquartered in Sharjah, United Arab Emirates, operating the online platform at medononline.com and the Medon mobile applications.

This Privacy Policy explains how we collect, use, disclose, and safeguard your personal information when you use our services. By accessing or using our platform, you agree to the practices described in this policy.

2.1 Information You Provide Directly

• Account details: Full name, email address, phone number, date of birth, and login credentials
• Delivery information: Home and work addresses for order fulfilment
• Medical data: Prescription images uploaded for medication orders
• Payment data: Card details (processed securely by our payment partners — we do not store full card numbers)
• Profile preferences: Language, notification settings, and favourite products

2.2 Information Collected Automatically

• Device identifiers: Device ID, operating system, browser type, and app version
• Analytics data: Usage patterns, session duration, and app interactions via Firebase Analytics
• Crash reports: Error logs collected via Firebase Crashlytics to improve stability
• Location data: GPS coordinates (only when you explicitly grant location permission) for branch finder and delivery ETA
• Purchase history: Order records, items purchased, and repeat-order patterns

2.3 Information from Third Parties

• Social sign-in: If you choose to log in via Google or Facebook, we receive your name, email address, and profile photo from those providers
• Referral data: If a partner or affiliate referred you, we may receive basic referral metadata

We use the personal information we collect for the following purposes:

• Processing and delivering your orders, including prescription verification by our licensed pharmacists
• Managing your account and providing customer support
• Sending transactional notifications — order confirmations, delivery updates, and payment receipts
• Personalising your shopping experience and recommending relevant products
• Sending promotional communications and offers (only where you have opted in or where permitted by law)
• Complying with UAE regulatory and legal obligations, including pharmacovigilance requirements
• Detecting and preventing fraud, abuse, and security incidents
• Improving our platform, services, and mobile applications through analytics and user feedback
• Conducting internal research and business planning

We process your personal data in accordance with the UAE Personal Data Protection Law (PDPL — Federal Decree Law No. 45 of 2021). Our legal bases for processing are:

We do not sell your personal data. We share your information only in the following circumstances:

• Delivery partners: We share your name, address, and phone number with our last-mile delivery providers to fulfil your orders.
• Payment processors: Card data is processed by PCI-DSS-certified payment gateways. We share only the minimum data required to complete transactions.
• Firebase (Google LLC): We use Firebase for analytics, push notifications, and crash reporting. Data is processed in accordance with Google's Data Processing Agreement.
• SMS and notification providers: We share your phone number with authorised messaging services to deliver OTPs and order alerts.
• Regulatory authorities: We may disclose data to UAE government bodies or law enforcement when legally required to do so.
• Business successors: In the event of a merger, acquisition, or asset sale, your data may be transferred to the acquiring entity, subject to the same privacy protections.

We retain your personal data only for as long as necessary to fulfil the purposes outlined in this policy or as required by applicable law:

We implement industry-standard technical and organisational measures to protect your personal data against unauthorised access, loss, or disclosure:

• Encryption in transit: All data transmitted between your device and our servers is encrypted using HTTPS/TLS.
• Password hashing: Account passwords are hashed using bcrypt — we never store plaintext passwords.
• Secure infrastructure: Our platform is hosted on DigitalOcean with firewall rules, access controls, and regular security audits.
• Least-privilege access: Internal access to personal data is restricted to authorised personnel on a need-to-know basis.
• Regular security reviews: We conduct periodic vulnerability assessments and penetration tests.

Our services are not directed to individuals under the age of 18 years. We do not knowingly collect personal data from minors. If a parent or guardian becomes aware that their child has provided us with personal data without consent, they should contact us immediately at [email protected].

Upon verification, we will promptly delete any personal data collected from a minor.

Under the UAE PDPL, you have the following rights with respect to your personal data:

We use cookies and similar tracking technologies on our website and mobile app to enhance your experience and analyse usage patterns.

Our platform may contain links to third-party websites, applications, or services. These links are provided for your convenience and informational purposes only.

We are not responsible for the privacy practices or content of those third-party sites. We encourage you to review the privacy policy of any external site you visit.

Some of our third-party service providers (such as Google Firebase and payment processors) may process your data outside the UAE. When we transfer your data internationally, we ensure appropriate safeguards are in place in accordance with UAE PDPL requirements.

These safeguards include contractual data protection clauses with service providers, use of providers whose countries have been assessed as offering adequate protection, and compliance with applicable cross-border data transfer regulations.

We may update this Privacy Policy from time to time to reflect changes in our practices, technology, or applicable law. When we make material changes, we will:

• Update the “Effective Date” at the top of this page
• Send you an in-app notification or email if the changes materially affect your rights
• Post a prominent notice on our website for at least 30 days

Your continued use of our services after any changes take effect constitutes your acceptance of the updated policy.