PharmMatch
Open the app
Privacy Policy
PharmMatch
| Version | 1.0 |
| Effective date | 5 September 2026 |
| Last updated | 5 September 2026 |
| Controller | Abdallah Nedal Yousef Zidan (sole proprietor) |
| Established in | Ontario, Canada |
1. Who we are
Abdallah Nedal Yousef Zidan, an individual operating as a sole proprietor, of 311-265 North Service Rd, Mississauga, Ontario, L5A 1A6, Canada, is the data controller (and, in Canadian terms, the organization) responsible for the personal information described in this policy. We decide why and how it is processed.
Contact for privacy matters: zidanabdullah640@gmail.com Telephone: +1 942 992 1970
| Role | Details |
|---|---|
| Controller / organization | Abdallah Nedal Yousef Zidan, 311-265 North Service Rd, Mississauga, Ontario, L5A 1A6, Canada |
| Privacy contact | zidanabdullah640@gmail.com |
| Accountable individual (PIPEDA Principle 1) | Abdallah Nedal Yousef Zidan |
| EU representative (Art. 27) | Not appointed — the app is not offered in the EU |
| UK representative | Not appointed — the app is not offered in the UK |
PIPEDA requires an organization to designate someone accountable for its compliance. As a sole proprietor that is you, named above; it is not a formality you can leave blank.
2. Scope
This policy covers personal information we process when you use PharmMatch (bundle identifier com.pharmmatch.app) on the web, iOS, or Android, or when you contact us.
It does not cover the practices of third parties whose services you reach through the App — such as Apple, Google, or a payment provider — each of which acts as its own controller for its own purposes and has its own policy.
3. Summary
The detail follows, but in short:
- We collect the account details you give us, and a record of how you perform in the training exercises.
- We never see your card number. Payment details go directly to Stripe, Apple, or Google.
- We never store your password. We store a salted cryptographic hash from which the password cannot practically be recovered.
- We do not sell your personal information, and we do not share it for cross-context behavioural advertising.
- We do not use your data to train artificial-intelligence models.
- Your training performance is data about *your studying*, not about your health.
- You can ask for a copy of your data, correct it, or have it deleted.
4. What we collect
4.1 Information you give us
| Data | Purpose | Required? |
|---|---|---|
| First name, last name | Identifying your account; displaying your name in the App and on leaderboards | Yes |
| Email address | Account identity, authentication, service messages, support | Yes |
Telephone number (stored in E.164 format, e.g. +962790000000) | Account identity and uniqueness; account recovery | Yes |
| Country | Validating your telephone number against that country's numbering plan; displaying your flag; regional content | Yes |
| Password | Authenticating you. Stored only as a PBKDF2-HMAC-SHA256 hash with a per-account random salt — never in readable form | Yes |
| Profile photograph | Displaying your avatar. Optional; taken from your camera or photo library only if you choose | No |
| Correspondence with us | Answering your query | Only if you write to us |
4.2 Information created as you use the App
| Data | Purpose |
|---|---|
| Answers you give to training scenarios (accepted / rejected, and whether correct) | Running the exercise; scoring |
| Rating, rank, totals answered and correct, accuracy | Your progress display and leaderboard position |
| Error log — the scenarios you answered incorrectly, with the explanation | Letting you review your weak areas. This is a record of your study, not of any patient |
| Achievements unlocked | Progress features |
| Categories trained and session history | Progress features; deciding which content you have already seen |
| App settings: language, sound effects, background music, haptics | Remembering your preferences |
4.3 Information about your purchases Not yet in use
| Data | Purpose |
|---|---|
| Subscription status, plan, current period end, whether it renews | Deciding what you have access to |
| Which store or provider the purchase was made through | Directing you to the right place to manage or cancel it |
| Provider transaction and customer identifiers | Reconciling payments; support; preventing a single payment granting access twice |
| Which one-off category unlocks you have bought | Unlocking that content |
4.4 Technical information
| Data | Purpose |
|---|---|
| IP address | Security, fraud prevention, and — unavoidably — delivering network responses to you |
| Device type, operating system, app version | Compatibility, diagnosing faults |
| Approximate country inferred from IP Not yet in use | Tax determination, regional compliance |
| Crash and error diagnostics Not yet in use | Fixing faults |
5. What we do not collect
We want to be specific here, because these are the things people most often worry about.
- We never receive your full card number, expiry date, or security code. Payment card details are entered directly into systems operated by Stripe, Apple, or Google. Our servers are never in the path. This is a deliberate architectural choice — it is what keeps us inside the narrowest PCI DSS scope (SAQ-A) and means a compromise of our systems cannot expose card data.
- We never store your password in readable form. Only a salted PBKDF2 hash. We cannot tell you what your password is, because we do not know it.
- We do not collect patient data. The App must never be used with real patient information, and there is nowhere in it to enter any. See the Terms, section 2.
- We do not collect precise location. No GPS, no location permission.
- We do not collect your contacts, calendar, messages, or call history.
- We do not use advertising identifiers or tracking SDKs, and we do not build advertising profiles.
- We do not use your content or performance data to train AI models.
6. Why we process it, and our legal basis
For users in the EU, EEA, and UK, GDPR requires a lawful basis for each purpose.
| Purpose | Data | Lawful basis (GDPR Art. 6) |
|---|---|---|
| Creating and running your account | Identity, contact, credentials | Contract — Art. 6(1)(b) |
| Delivering the training features and saving your progress | Usage, performance | Contract — Art. 6(1)(b) |
| Ensuring one account per email and per phone number | Email, phone | Contract — Art. 6(1)(b), and legitimate interests — Art. 6(1)(f) in preventing duplicate and fraudulent accounts |
| Taking payment and granting access to what you bought Not yet in use | Purchase records | Contract — Art. 6(1)(b) |
| Displaying your profile photograph | Photograph | Consent — Art. 6(1)(a); you choose to add it and may remove it at any time |
| Service and security messages | Contract, and legitimate interests — Art. 6(1)(f) | |
| Keeping the App secure, preventing abuse and fraud | Technical, usage | Legitimate interests — Art. 6(1)(f) in protecting our service and our users |
| Diagnosing faults and improving the App | Technical, aggregated usage | Legitimate interests — Art. 6(1)(f) |
| Marketing email, if we ever send it | Consent — Art. 6(1)(a), with an unsubscribe link in every message | |
| Meeting tax, accounting, and legal obligations | Transaction records | Legal obligation — Art. 6(1)(c) |
| Establishing, exercising, or defending legal claims | As relevant | Legitimate interests — Art. 6(1)(f) |
Where we rely on legitimate interests, we have considered whether our interest is overridden by your rights, and you may object at any time (see section 12).
Where we rely on consent, you may withdraw it at any time, without affecting the lawfulness of processing before withdrawal.
6.1 Special category data — expressly not collected
We do not process special category data under GDPR Article 9.
This deserves saying plainly, because the App is about clinical pharmacy and that invites the wrong assumption. Your training performance is information about how you are studying, not information about your health. It says nothing about your medical condition, and we do not ask for any health information about you. The clinical scenarios concern fictional patients.
If you volunteer health information to us — for example in a support email — we will process it only to answer you, and will delete it when the matter is closed.
7. Where your information is stored
7.1 Current architecture
In the present version of the App, your account details and all of your training data are stored locally on your own device, in the operating system's standard application storage. We do not operate a server that holds them, and they are not transmitted to us.
The only network request the App makes is to download the shared library of training scenarios, which is public content and contains nothing about you. The provider hosting that content will see your device's IP address as a consequence of the request, as with any web request.
Because the data is local, it is subject to the security of your own device, and it is removed if you delete the App. We cannot recover it for you.
7.2 Planned architecture Not yet in use
When accounts move to our hosted service, information will be stored in managed database and storage services and will be replicated across facilities for resilience.
Where that happens, personal information will be held in the Canadian region (ca-central-1) of our database provider. We will update this policy, and the processor table in section 8.1, before any such service is switched on.
8. Who we share it with
We do not sell your personal information. We share it only as set out here.
8.1 Service providers (processors)
| Provider | What it handles | Where | Status |
|---|---|---|---|
| GitHub, Inc. | Hosts the public training-content file the App downloads. Receives your IP address as a consequence of the request. No account data | US | Current |
| Supabase, Inc. | Database, authentication, and server functions | Canada (ca-central-1), intended | Not yet in use |
| Stripe, Inc. | Web payments. Acts as an independent controller for payment data | US / global | Not yet in use |
| RevenueCat, Inc. | Mobile subscription state | US | Not yet in use |
| Apple Inc. | App Store distribution and in-app purchases. Independent controller | Global | Not yet in use |
| Google LLC | Google Play distribution and in-app purchases. Independent controller | Global | Not yet in use |
Each processor is engaged under a written data processing agreement requiring them to act only on our instructions and to apply appropriate security.
8.2 Others
We may also disclose personal information:
- To professional advisers — lawyers, accountants, auditors — under duties of confidentiality.
- To authorities, where required by law, court order, or binding request. We will assess each request, will not disclose more than is necessary, and will notify you unless legally prohibited.
- To an acquirer, in connection with a merger, acquisition, or sale of assets, subject to this policy continuing to apply. We will notify you.
- To protect rights — where necessary to enforce our Terms, or to prevent fraud, harm, or illegal activity.
8.3 Other users
Your display name, country flag, rating, and rank may be visible to other users on leaderboards. Your email address, telephone number, and error log are never shown to other users.
9. International transfers
Your information may be transferred to, and processed in, countries other than your own, including the United States, whose data protection laws may differ from those of your country.
Where we transfer personal information out of the EEA or the UK, we rely on one of the following safeguards:
- an adequacy decision by the European Commission or the UK government;
- Standard Contractual Clauses adopted by the European Commission (Implementing Decision (EU) 2021/914), together with the UK International Data Transfer Addendum where the transfer is from the UK; or
- another lawful transfer mechanism.
Where we rely on Standard Contractual Clauses, we carry out a transfer impact assessment. You may request a copy of the relevant safeguards by writing to zidanabdullah640@gmail.com.
10. How long we keep it
| Data | Retention |
|---|---|
| Account details | For as long as your account is open |
| Training data, error log, achievements | For as long as your account is open |
| Profile photograph | Until you remove it, or the account closes |
| After account closure | Deleted or irreversibly anonymised within [30] days, except as below |
| Payment and transaction records Not yet in use | [7] years, or as required by tax and accounting law in Ontario, Canada — Art. 6(1)(c) |
| Records of suspension for abuse or fraud | [2] years, to prevent re-registration — Art. 6(1)(f) |
| Backups | Overwritten on a rolling [30] day cycle. Data deleted from live systems persists in backups until that cycle completes |
| Support correspondence | [2] years from resolution |
When retention ends, we delete the information or anonymise it irreversibly so that it can no longer be linked to you.
11. Security
We take appropriate technical and organisational measures, including:
- Passwords are never stored. We keep a PBKDF2-HMAC-SHA256 derivation with 20,000 iterations and a per-account random salt, compared in constant time.
- Card data never reaches us — see section 5.
- Encryption in transit (TLS) for all network communication.
- Encryption at rest for stored data. Not yet in use
- Access controls limiting staff access to what their role requires, with database-level row security so one account cannot read another's data. Not yet in use
- Regular dependency updates and security review.
No system is perfectly secure. We cannot guarantee absolute security, and you are responsible for keeping your password confidential and your device secure.
Breach notification. Where a personal data breach is likely to result in a risk to your rights and freedoms, we will notify the competent supervisory authority within 72 hours of becoming aware of it, and will notify you without undue delay where the risk is high, as required by GDPR Articles 33 and 34 and by applicable state breach-notification laws.
12. Your rights — EU, EEA, and UK
You have the right to:
| Right | What it means |
|---|---|
| Access | Obtain confirmation of whether we process your data, and a copy of it |
| Rectification | Have inaccurate data corrected and incomplete data completed |
| Erasure | Have your data deleted where one of the Art. 17 grounds applies |
| Restriction | Have processing limited in the circumstances in Art. 18 |
| Portability | Receive data you gave us in a structured, machine-readable format, and have it sent to another controller where technically feasible |
| Object | Object to processing based on legitimate interests, on grounds relating to your situation — and to direct marketing at any time, absolutely |
| Withdraw consent | Withdraw consent at any time, without affecting prior lawfulness |
| Not be subject to automated decisions | Not be subject to a decision based solely on automated processing producing legal or similarly significant effects — see section 14 |
How to exercise them: write to zidanabdullah640@gmail.com. We will respond within one month, extendable by two further months for complex requests, and will tell you if we extend. There is no charge unless a request is manifestly unfounded or excessive.
We may need to verify your identity before acting, to avoid disclosing your data to someone else.
Complaints. You may complain to your local supervisory authority. Ours is the supervisory authority of your country of residence. In the UK that is the Information Commissioner's Office (ico.org.uk). We would appreciate the chance to address your concern first. Our own regulator is the Office of the Privacy Commissioner of Canada (priv.gc.ca).
13. Your rights — Canada, California and other jurisdictions
13.1 California (CCPA / CPRA)
If you are a California resident, you have the right to:
- know what personal information we collect, use, disclose, and the purposes;
- access a copy, covering the preceding 12 months and, on request, beyond;
- correct inaccurate personal information;
- delete personal information, subject to statutory exceptions;
- opt out of sale or sharing for cross-context behavioural advertising;
- limit the use of sensitive personal information; and
- not be discriminated against for exercising any of these rights — we will not deny you service, charge a different price, or provide a different quality of service.
We do not sell personal information, and we do not share it for cross-context behavioural advertising. We have not done so in the preceding 12 months, including with respect to any consumer we know to be under 16. We therefore do not offer a "Do Not Sell or Share" link; if that changes, this policy will be updated and the link provided.
Sensitive personal information. Account credentials are sensitive personal information under the CPRA. We use them only to authenticate you — a purpose for which the right to limit does not apply — and never to infer characteristics about you.
Categories collected, in CCPA terms: identifiers (name, email, telephone, account id); customer records information; commercial information (purchase history); internet or network activity (app usage); geolocation *only* at the coarse country level and only where stated; and account credentials.
Sources: you; your device; our service providers. Purposes: as set out in section 6. Disclosed for a business purpose to: the categories of service provider in section 8.1.
Authorised agents may submit requests with proof of authorisation. Write to zidanabdullah640@gmail.com. We will respond within 45 days, extendable once by a further 45 days.
13.2 Other US states
Residents of Virginia, Colorado, Connecticut, Utah, Texas, Oregon, Montana, and other states with comprehensive privacy laws have broadly similar rights of access, correction, deletion, portability, and opt-out, and in most of those states a right to appeal a refusal. Write to zidanabdullah640@gmail.com; we will tell you how to appeal if we decline, as those laws require.
13.3 Canada — PIPEDA and provincial law
If you are in Canada, the Personal Information Protection and Electronic Documents Act (PIPEDA) applies, and you have the right to:
- know why we collect, use or disclose your personal information, and to give or withhold meaningful consent;
- access the personal information we hold about you and be told to whom it has been disclosed;
- challenge the accuracy of it and have it corrected;
- withdraw consent at any time, subject to legal or contractual restrictions and reasonable notice; and
- challenge our compliance — first with us, and then with the regulator.
We will respond to an access request within 30 days, as PIPEDA requires, or tell you why we need an extension.
Complaints. Raise it with us first at zidanabdullah640@gmail.com. If you are not satisfied you may complain to the Office of the Privacy Commissioner of Canada (priv.gc.ca). Residents of Quebec may complain to the *Commission d'accès à l'information*, and residents of Alberta or British Columbia to their provincial Information and Privacy Commissioner, whose private-sector Acts apply in place of PIPEDA there.
13.4 Elsewhere
We aim to extend the substance of these rights to all users wherever they live. Residents of Canada (PIPEDA), Brazil (LGPD), and other jurisdictions with comparable laws may exercise equivalent rights through the same contact point.
14. Automated decision-making
The App calculates a rating and rank from your answers, and decides which scenarios to show you, automatically.
This is not automated decision-making producing legal or similarly significant effects within GDPR Article 22. The rating affects only your position within a training exercise. It is not an assessment of competence, does not affect your employment, education, credit, or access to any service, and is never disclosed by us to any employer, university, or regulator. See Terms, section 2.5.
We do not carry out profiling for advertising purposes.
15. Children
The App is intended for users aged 18 and over and is not directed at children. We do not knowingly collect personal information from a child under 13, or under 16 where local law sets a higher age for the processing of children's personal data.
If you believe a child has provided us with personal information, contact zidanabdullah640@gmail.com and we will delete it.
16. Cookies and similar technologies
The mobile applications do not use cookies and contain no advertising or analytics SDKs.
The web application uses browser local storage for strictly necessary purposes only: keeping you signed in, and remembering your language and sound preferences. These are essential to the service you requested and, under the EU ePrivacy Directive and the UK PECR, do not require consent.
We do not use analytics, advertising, or third-party tracking cookies.
17. Changes to this policy
We may update this policy. Where a change is material — a new purpose, a new category of data, a new recipient, or a change to your rights — we will give notice by in-app notification or email at least [30] days before it takes effect, and where the law requires it we will seek your consent.
The current version and its effective date are always shown at the top. We keep previous versions and will provide one on request.
18. Contact
| Controller | Abdallah Nedal Yousef Zidan (sole proprietor) |
| Established in | Ontario, Canada |
| Address | 311-265 North Service Rd, Mississauga, Ontario, L5A 1A6, Canada |
| Privacy contact | zidanabdullah640@gmail.com |
| Accountable individual | Abdallah Nedal Yousef Zidan |
| Telephone | +1 942 992 1970 |
| EU representative | Not appointed — see section 1 |
| UK representative | Not appointed — see section 1 |
| Canadian regulator | Office of the Privacy Commissioner of Canada — priv.gc.ca |