Privacy Policy

PharmaVault · effective 12 October 2026

This policy explains what personal data PharmaVault collects when you use pharmavault.site, why we collect it, who we share it with, how we keep it safe, how long we keep it, and the rights you have over it. It is written to meet Kenya's Data Protection Act, 2019 and the Data Protection (General) Regulations, 2021.

The short version

We collect only what we need to give you an account, keep your place in the library and keep the service secure.
We never sell your data, show you adverts or let advertisers track you.
You can see and change your details, and delete your whole account yourself, from your Account page at any time.
If you have a question or a request about your data, email pharmavault.contact@gmail.com.

Who we are

PharmaVault is a study service run from Nairobi, Kenya, by medical students. For the personal data described here, PharmaVault is the data controller: we decide why and how it is used. You can reach us about anything in this policy at pharmavault.contact@gmail.com.

PharmaVault is independent. We are not part of, and do not act for, the University of Nairobi, and we do not receive your data from it.

What we collect

What you give us

Your name and email address, when you create an account. Your email address is how you sign in and how we contact you about your account.
Your password. It is stored only in a scrambled, one-way form by our sign-in provider. Nobody at PharmaVault can see it.
If you choose to sign in with Google, Google tells us your name and email address and that it has confirmed the address, and sends a link to your Google profile picture, which our sign-in provider keeps with your account and we do not use. We never see your Google password.
Your year of study, if you choose one, so we can show you the right material first.
A profile photo, only if you upload one.
Your preferences: light or dark mode, and whether you want an email when new material is published.
Messages you send us through the contact form: your name, the email address to reply to, the topic and your message.
Questions you ask Ask Vaulty. We use your question to find and write an answer, then discard it. We do not keep your questions or Vaulty's answers.

What is created as you use the site

Your study progress: where you are in each document and the answers you have given inside quizzes and flashcards, so you can pick up where you left off on any device.
Your bookmarks and which announcements you have read.
If you join the test group: which documents you read for at least two minutes, with the day and time, and your answers to the daily quiz and to Check yourself. See The test group below.
How many Ask Vaulty questions you have used today, to apply the daily limit.
That you accepted our Terms and this policy: which version, and when, so we know you agreed to the terms that apply to you.
Your ratings: now and then we ask how useful a document was. The stars you give (and, for a low rating, what was wrong) are kept with your account so we never ask about the same document twice. We see only the totals for each document, never who gave which rating. To decide when to ask, the reader counts how long you have been actively reading a document; that count stays on your device and is not stored, unless you join the test group (below).
The devices you sign in on: the type of device, browser and operating system, an approximate location (city and country) worked out from your internet address when you sign in, and when each device was first and last used. This lets you see and sign out your devices on your Account page and helps us spot an account being shared or misused. We do not store your internet (IP) address for this.

What we collect automatically to keep the service working and secure

Failed sign-in attempts, recorded only in a scrambled form that cannot be turned back into your email or internet address, to slow down anyone trying to guess passwords.
A security log of sign-in events, such as signing in, signing out and changing a password, kept by our sign-in provider. It includes the internet address used.
Error reports when something on the site breaks: the page, your browser and operating system and what went wrong. They are cleaned of passwords and other sensitive values before they are sent.
Server logs kept briefly by our hosting providers, which include internet addresses, as every website's do.
How often each document is opened, counted per day without recording who opened it, so we know which material is useful.
The first and the latest day you opened a document: two dates kept with your account, not a list of what you opened or when, so we can count how many students use PharmaVault each day and week and how many come back. We see only those totals, never which student.

We do not collect identity or student numbers, phone numbers, financial details or your precise location, and we do not use advertising or tracking tools.

Why we use it, and on what legal basis

To run your account and the service: signing you in, showing you the library, saving your progress and bookmarks, answering Ask Vaulty questions and sending account emails such as confirming your address or resetting your password. We need this data to provide the service you signed up for under our Terms of Service.
To keep the service and your account secure: limiting sign-in attempts, the device limit, error reports, and suspending accounts that break our terms. This is in our legitimate interest, and yours, in a safe service.
To email you about new material, only while that preference is switched on. This is based on your consent, which you can withdraw at any time under Account → Preferences.
For the test group, only if you join it: to choose your quiz questions, suggest what to read next and set your daily reading goal, from what you read, when, and how you answered; and, unless you turn it off, to email you a reminder on days you have not opened the daily quiz. This is based on your consent, which you withdraw by leaving the test group.
To improve the library, using only counts that do not identify anyone. This is in our legitimate interest.
To meet our legal obligations, for example answering a lawful request from an authority.

We do not make decisions about you by automated means that have legal or similarly significant effects, and we do not build profiles of you for advertising.

What you must give us, and what is optional

To create an account you must give your name, a working email address and a password, or sign in with a Google account that gives us your name and email address; without them we cannot give you an account. Your year of study, a profile photo and the new-material emails are optional. You can browse the list of material without an account.

The test group

The test group tries new study features, such as the daily quiz, before everyone else. You join only through an invitation link and by agreeing on its page; if you have not joined, none of this applies to you.

What is recorded: which documents you read for at least two minutes, and the day and time; and your answers to the daily quiz and to Check yourself (the short quiz offered after reading): which option you chose, whether it was right, and whether you were sure. Only while you are in the test group.
Why: to help you study, and nothing else: to choose your quiz questions (what you read lately, what you got wrong and what you are starting to forget); to suggest what to read next for your coming exam; and to set a daily reading goal that fits how much you usually read, on which days and at what time of day, raising it when you manage it and your answers stay good, and easing it when you do not.
Who sees it: you, and the quiz and the suggestions, which are worked out for you alone (the suggestions and the goal on your own device). We see only totals, never what one student read or answered, and it is not shared with anyone.
If you report a problem with a question (from 23 October 2026): the reason you pick and any note you write are kept with your account, so we do not ask you twice and so leaving deletes them. We read the reason and the note without your name, to fix the question; please keep names and anything personal out of the note.
Quiz reminders (from 25 October 2026): on a day you have not opened the daily quiz, we email you one reminder at about 7 pm, sent through Resend. It says only that the quiz is waiting. Turn it off from the link in any reminder or on the test group page. We keep the days we sent one, with your account, so you never get two in a day.
How long: until you leave the test group or delete your account. Either deletes all of it at once.
Leaving: at any time, on the test group page.

We share personal data only with the service providers we need to run PharmaVault, each receiving only what its job requires and bound to protect it:

Supabase: our database, sign-in and file storage.
Vercel: hosts the website and delivers its pages.
Resend: sends our emails, so it receives your email address and the email we send you.
Sentry: receives the error reports described above.
GitHub: runs our nightly database backup, so a copy of the database passes through it for a few minutes each night before it is encrypted.
Cloudflare: stores those backups, encrypted, and cannot read them.
Hugging Face, and the AI provider it passes the request to: receive the text of an Ask Vaulty question with the passages from our notes that answer it. We never send your name, email address or account details with it.

If you choose to sign in with Google, Google confirms who you are to us and so learns that you are signing in to PharmaVault. What Google does with your Google account is governed by Google's own privacy policy, not this one.

We may also disclose personal data where the law requires it, for example to comply with a court order. We do not sell, rent or trade personal data, and we do not share it with advertisers.

Data processed outside Kenya

Some of these providers store or process data outside Kenya, including in the European Union and the United States. We use them only where they provide appropriate safeguards for personal data, as the Data Protection Act requires, and we send them only what they need.

How we keep it secure

Everything between your device and PharmaVault travels over an encrypted connection.
Passwords are stored only in a scrambled, one-way form.
Each account can reach only its own personal data. Access to administer the service is limited to the founders and protected by two-step sign-in.
Sign-in attempts are limited, and you can see and sign out every device on your account from your Account page.
Study documents run separately from your account, so they cannot read your sign-in details.
Our providers keep stored data encrypted and their facilities secured.

No system is perfectly secure. If a breach of personal data puts you at risk, we will notify the Office of the Data Protection Commissioner within 72 hours of becoming aware of it and tell you as soon as we reasonably can, as the law requires.

How long we keep it

Your account, profile, photo, progress, bookmarks, ratings, devices and read announcements: until you delete your account, or we delete it under our terms. A device unused for 60 days is signed out automatically.
Ask Vaulty: your questions are not kept at all; the count of questions you have used is kept with your account.
The test group's reading record, quiz answers and the days we sent a quiz reminder: while you are in the test group. Leaving it, or deleting your account, deletes them at once.
Messages you send us: up to 12 months, so we can follow up, then deleted.
Records of action we take on an account, such as suspending or deleting it, which include the account's name and email address: up to 3 years, so we can account for how the service is run and deal with any dispute.
The sign-in security log: up to 12 months.
Error reports: deleted automatically within 90 days. Server logs: a few days.
Backups: we keep backup copies of our database so information is not lost. Your data can remain in a backup for up to 90 days after it is deleted from the service, and backups are protected like the service itself.

Your rights

Under the Data Protection Act, 2019 you have the right to:

be told how your personal data is used, which is what this policy does;
see the personal data we hold about you and get a copy of it;
have data that is wrong or misleading corrected;
have your personal data deleted;
object to, or ask us to restrict, how we use your data;
receive your data in a common, machine-readable form, or have it sent to another service;
withdraw consent you have given, without affecting what was done before.

Much of this you can do yourself: your Account page shows and edits your details, signs out your devices, switches emails off, and deletes your account and everything attached to it permanently and at once. For anything else, email pharmavault.contact@gmail.com from the address on your account. We may need to confirm it is you before acting. Requests are free, and we answer within the time limits set by the Data Protection (General) Regulations, 2021.

If you are unhappy with how we have handled your data, please tell us first so we can put it right. You also have the right to complain to the Office of the Data Protection Commissioner (www.odpc.go.ke).

Children

PharmaVault is meant for university students. If you are under 18, you may use it only with the consent of a parent or guardian. If we learn that we hold data about someone under 18 without that consent, we will delete it.

Cookies and similar storage

We use only what the site needs to work:

Sign-in cookies, which keep you signed in — until you close your browser, if you untick Remember me when you log in.
A device cookie, which recognises the device you are using for the device limit and the Devices list.
Storage in your browser for display choices: light or dark mode, how the sidebar is arranged and the last document you opened.

There are no advertising or analytics cookies, so there is nothing to opt out of. Clearing these from your browser signs you out and resets your display choices.

Patient information

Never enter information that could identify a patient anywhere on PharmaVault: in a study tool, in a question to Ask Vaulty or in a message to us. The service is not designed to hold health information about other people.

Changes to this policy

We will update this policy when what we collect or how we use it changes. The date at the top shows when it last changed for everyone, and we will tell you on the site, or by email if the change is significant, before it applies to you. This version replaces the one dated 1 October 2026, adding the ratings we ask for and the record of your acceptance. On 14 October 2026 we added the test group section, which applies only to students who choose to join and agree to it when they do; nothing changed for anyone else, so the date at the top did not move. On 15 October 2026 we started keeping the first and the latest day you opened a document, to count how many students use PharmaVault; it records nothing about what you read, and we see only totals. On 18 October 2026 we added signing in with Google, described above, which applies only to students who choose it; nothing changed for anyone else, so the date at the top did not move. On 25 October 2026 the test group section changed: it now says the record also decides whether we email you a reminder on a day you have not opened the daily quiz, which you can turn off. Before that, on 21 October 2026, it began to say we keep the time of each read as well as the day, and that the record also chooses your reading suggestions and daily reading goal and the questions of Check yourself; and on 23 October 2026 it gained the line about reporting a problem with a question, which members choose to do from the quiz. It applies only to members: new members agree to the new wording when they join, and members who joined before are asked to read it and agree again on the test group page; nothing changed for anyone else. Since 26 October 2026, until a member agrees to the current wording, nothing more is recorded for them and they get no quiz and no reminder. On 26 October 2026 we also named GitHub and Cloudflare, which run and store our nightly database backups; nothing we collect changed, so the date at the top did not move.

Contact

PharmaVault, Nairobi, Kenya. Email pharmavault.contact@gmail.com.