Privacy Policy

We collect the following categories of information when you create an account and use Rosheta:

Account & contact information: your phone number (used to sign in via SMS/one-time-passcode verification) and, if you choose to provide it, your name.

Delivery addresses & location: saved delivery addresses (label, area, building details, landmark) and precise GPS coordinates, used to find nearby pharmacies, confirm you are within our delivery coverage, and route your order for delivery. While an order is out for delivery, we also process the assigned driver's live location so it can be shown to you on a tracking map.

Health-related information: this is the most sensitive data we handle. It includes photos of your prescriptions, the medicines and dosages listed on them or entered manually, whether substitutions are allowed, and, if you use medication reminders, the medicine name, dosage, frequency, and schedule you set up. We collect this only to fulfil your order or provide the reminder feature you activated — see Section 2.

Order & delivery information: the pharmacy offers you receive, the order you accept, itemized pricing (medicine cost, delivery fee, service fee), order status and timeline, your chosen payment method, and cancellation details.

Communications: messages you send in the in-app chat with a pharmacy about your order, and messages you send to our customer support team (including the category, subject, and content of support tickets).

Ratings & feedback: any rating, tags, or comments you leave about an order or pharmacy.

Device, push & diagnostic information: a push-notification token used to deliver order and reminder notifications, your app language and platform, and crash/error diagnostics. Diagnostic reports are linked only to an internal user ID — never to your name or phone number.

We do not collect payment card numbers or bank details. Rosheta currently operates on a cash-on-delivery basis, so no card data passes through our systems.

We use the information above to: verify your identity and keep your account secure; match your prescription or medicine list with nearby, available pharmacies; let pharmacies prepare accurate offers; process, deliver, and let you track your order; enable chat between you and a pharmacy about an active order; provide customer support and resolve support tickets; send order, offer, delivery, and (if enabled) medication-reminder notifications; maintain and improve the safety, reliability, and performance of our app; and comply with applicable legal and regulatory obligations, including pharmaceutical recordkeeping requirements in Egypt.

We do not use your information for advertising, and we do not build advertising profiles.

Because prescription images, medicine names, dosages, and medication reminders reveal information about your health, we treat this data with additional care. It is transmitted over encrypted connections, stored in access-controlled infrastructure, shared only with the pharmacy fulfilling your specific order (and, where applicable, the driver assigned to deliver it), and is not used for any purpose beyond fulfilling your order or the reminder feature you activated. Prescription submissions expire automatically a short time after upload (currently within 24 hours) if not acted on, and are not kept available for browsing afterward.

Pharmacies & drivers: to prepare an offer and fulfil your order, the pharmacy you order from receives your prescription, delivery address, and order details. A courier assigned to your delivery receives your address and, if location tracking is active, your live location; you may likewise see the assigned driver's live location for that delivery.

Service providers acting on our behalf (processors): we use trusted third-party providers to operate the platform, and they only process data as needed to provide their service to us — they do not use your data for their own purposes:

• Firebase Authentication (Google) — verifies your phone number via SMS one-time passcode.

• Amazon Web Services (AWS S3, hosted in the EU) — stores prescription images and related files securely.

• Mapping services (e.g., Google Maps/Places or OpenStreetMap) — power address search, map display, and delivery routing.

• Sentry — receives crash and error diagnostics linked only to an internal user ID, never your name or phone number.

• Expo push notification service — delivers push notifications to your device using your push token.

• WhatsApp Business messaging (Meta) — used to notify partner pharmacies of new prescription requests.

We do not sell your personal information, and we do not share it with third parties for their own marketing or advertising purposes.

We may also disclose information where required by law, to comply with a valid legal process, to protect the rights, property, or safety of Rosheta, our users, or the public, or in connection with a merger, acquisition, or sale of assets, subject to this Policy continuing to apply to your data.

We retain personal data only as long as needed for the purposes described in this Policy: account and profile data for as long as your account is active; order, prescription, and payment-method records for as long as required to support your order history, dispute resolution, and applicable legal/pharmaceutical recordkeeping obligations; chat and support-ticket messages for as long as needed to resolve your issue and for quality/audit purposes; and medication reminders for as long as the reminder is active or until you delete it. Prescription image submissions that are not converted into an order expire automatically shortly after upload (currently within 24 hours). When data is no longer needed, we delete or anonymize it.

All traffic between the Rosheta app and our servers is encrypted in transit (HTTPS and secure WebSocket connections). Access to personal data, including prescription images, is restricted to systems and personnel that need it to operate the service. No method of transmission or storage is 100% secure, but we work to protect your information using industry-standard safeguards and to promptly investigate and address any security incident.

Rosheta does not use advertising SDKs, third-party analytics/tracking SDKs, or advertising identifiers, and we do not track you across other companies' apps or websites.

Depending on your location, you may have rights to access, correct, or delete your personal data, object to or restrict certain processing, and withdraw consent where processing is based on consent. You can review and update your profile information, saved addresses, notification preferences, and language directly in the app. To access a copy of your data or to request deletion of your account and associated personal data, contact us at support@rosheta.io; we will verify your identity and respond within a reasonable time, subject to any records we are legally required to retain (for example, for pharmaceutical or tax recordkeeping). You can also decline non-essential notifications at any time from your notification settings.

Rosheta is not directed to children, and we do not knowingly collect personal data from children under 18. If you believe a child has provided us with personal data, please contact us so we can remove it.

Some of our service providers (for example, our cloud storage and authentication providers) process data outside Egypt, including within the European Union. Where data is transferred internationally, we require our providers to protect it consistently with this Policy and applicable law.

We may update this Privacy Policy from time to time to reflect changes to our service or legal requirements. We will post the updated policy on this page with a revised “Last updated” date, and where changes are material, we will provide additional notice (such as an in-app notification) before they take effect.

This Policy is governed by the laws of the Arab Republic of Egypt, including Personal Data Protection Law No. 151 of 2020 and its executive regulations.

If you have questions about this Privacy Policy or how we handle your data, contact us at support@rosheta.io or write to [Company legal name], [registered company address], Egypt.