1. Who we are
PIMS (Pharmacy Information Management System) is operated for pharmacy operations under the authority of CMDA-SL (cmda-sl.org) (“we”, “us”, “our”). Technology delivery and platform engineering are provided by Lion Code Innovation Ltd (lioncodeinnovation.com), acting as a processor / technical service provider on CMDA-SL’s platform.
This Policy applies to authorised users of PIMS (pharmacy staff, branch administrators, CMDA-SL operators, and Lion Code platform engineers) and to personal data processed in the course of pharmacy retail operations in Sierra Leone.
2. Legal and policy context (Sierra Leone)
We design PIMS with regard to:
- The Constitution of Sierra Leone (privacy and dignity interests relevant to personal information);
- The Cyber Security and Crime Act, 2021 (cybersecurity, unauthorised access, integrity of computer systems, electronic evidence, and related privacy safeguards);
- The Right to Access Information Act, 2013 and associated regulations, where CMDA-SL acts as or supports a public body obliged to handle information requests lawfully;
- Emerging national data-protection policy directions (including work toward a comprehensive Data Protection / Right to Access Information framework). We commit to update this Policy when a dedicated data-protection statute or regulator mandate takes effect.
Pharmacy operational records may also be subject to professional, medicines-control, tax, and audit obligations applicable in Sierra Leone. Where those duties require retention, we retain only what is necessary.
3. What data PIMS processes
3.1 Account and access data
- Name, email, authentication credentials (stored as secure hashes by the identity provider);
- Assigned pharmacy roles and permissions;
- Branch assignments and active branch context;
- Login session metadata and security-relevant events.
3.2 Pharmacy operational data
- Product catalogue, batches, expiry, stock movements, and valuations;
- Point-of-sale transactions, receipts, payments, voids, and returns;
- Supplier and customer master data, credit balances, and ledgers;
- Purchase orders, receiving records, and supplier returns;
- Approvals, audit logs, stock counts, month-end closures, and exception reports;
- Multi-branch transfer records and enterprise analytics (Premium Pro).
3.3 Sensitive / higher-risk categories
PIMS is a business operations system. It may store customer contact and credit information and, depending on how a pharmacy configures catalogue and dispensing workflows, medicine-related transaction history. We treat such data as confidential business and customer information requiring role-based access, auditability, and least-privilege controls.
3.4 Technical and device data
- Browser or installed PWA technical logs needed for security and reliability;
- Offline device caches (for example POS catalogue snapshots and queued sales) stored on the user’s device;
- Optional diagnostics / backup job metadata requested by administrators.
4. Roles, access, and purpose limitation
Access is granted strictly according to assigned roles. Typical pharmacy roles include:
- Owner / Manager / Branch Admin — administration, approvals, reporting, and governance;
- Pharmacist — dispensing-related operational access within granted permissions;
- Cashier — POS, receipts, and limited sales views;
- Storekeeper — receiving, stock, batches, and inventory reports;
- CMDA-SL Ops — tenant/client operations across pharmacies (platform plane);
- Lion Code — engineering control plane (health, security, platform settings), not day-to-day pharmacy POS browsing by default.
We process data only to:
- Provide and secure the PIMS service;
- Support lawful pharmacy operations, inventory integrity, and financial reconciliation;
- Enforce subscriptions, seat limits, and multi-tenant isolation;
- Detect abuse, investigate incidents, and meet audit / regulatory requests;
- Improve reliability (including offline sync and PWA updates).
We do not sell personal data.
5. Multi-tenant isolation and security measures
- Pharmacy tenants are logically isolated; users of one tenant must not access another tenant’s records;
- Row-level security and server-side RPCs enforce authorisation for sensitive writes;
- Immutable stock movement and audit trails support accountability;
- Approvals gate high-impact changes (price, adjustments, write-offs);
- Transport encryption (HTTPS) in production; credentials never stored in plain text;
- Administrative actions by CMDA-SL / Lion Code are limited to their platform roles and logged where applicable.
6. Sharing and disclosure
We may share information only:
- With Lion Code Innovation Ltd as technical processor under contractual confidentiality;
- With infrastructure providers strictly necessary to host PIMS (for example database hosting), under appropriate safeguards;
- With competent Sierra Leone authorities when required by law, court order, or lawful investigation under applicable cybercrime / information legislation;
- With the pharmacy’s own authorised users according to their roles.
We do not permit unrestricted third-party marketing use of PIMS customer or staff data.
7. Cross-border processing
PIMS may be hosted on cloud infrastructure that stores or backs up data outside Sierra Leone (including regional European or other data centres used by the hosting provider). Where that occurs, CMDA-SL remains responsible for choosing processors and requiring contractual security obligations consistent with this Policy and applicable Sierra Leone law.
8. Retention
- Account data — for the life of the user account plus a short wind-down period after deactivation;
- Transactional, inventory, and audit records — retained to support pharmacy operations, dispute resolution, and legal retention duties;
- Offline device caches — retained on the device until cleared by the user, app reinstall, or successful sync policies;
- Backup / diagnostic artefacts — retained only as long as needed for the stated restore or incident purpose.
9. Your rights and requests
Subject to Sierra Leone law and legitimate pharmacy retention duties, authorised individuals may request:
- Access to personal data held about them in PIMS;
- Correction of inaccurate account or profile information;
- Deactivation of user accounts when employment / access ends;
- Information about processing relevant to a lawful access-to-information request (where that regime applies).
Pharmacy owners/administrators should raise operational data requests inside their tenant. Platform-level or cross-tenant requests should be directed to CMDA-SL. Security incidents involving unauthorised access should be reported immediately to CMDA-SL and, where relevant, Lion Code engineering.
10. Children
PIMS is a professional pharmacy operations platform. It is not directed at children. Staff accounts are issued to adults authorised by the pharmacy or CMDA-SL.
11. Changes
We may update this Policy as PIMS features, hosting arrangements, or Sierra Leone legal requirements evolve. Material changes will be reflected by updating the effective date on this page and, where appropriate, notifying tenant administrators.
12. Contact
Controller / operator: CMDA-SL — PIMS programme — cmda-sl.org
Technology provider: Lion Code Innovation Ltd — lioncodeinnovation.com
For privacy questions related to a specific pharmacy tenant, contact that pharmacy’s PIMS owner/administrator first.