1. Who is responsible?

Valorigo SARL operates the Phati platform and is the controller for the processing described here. For any question about your data, use the support contacts below.

2. Data we collect

We collect only what the service needs:

• Anonymous session: a technical identifier stored in a secure cookie (no account, no password).
• Search: products searched, chosen city/area and, if you allow it, your approximate GPS position to sort by distance.
• Reservation: products, pharmacy, phone number, pickup code and PIN (hashed server-side).
• Rating: thumbs up/down and chosen reasons after pickup (no free text).
• Technical logs: IP address and user agent, used only for security (abuse limiting) and debugging.

3. Purposes

• Find and reserve products from partner pharmacies.
• Let the pharmacy prepare the order and recognise your reservation at the counter (code and masked number).
• Keep you informed of your reservation (offer received, confirmation, pickup reminder) by SMS where that channel is active in your city.
• Compute the commission owed by the pharmacy (based on the pickup, never on your contact details).
• Prevent fraud and abuse (rate limiting, price anomaly detection).
• Produce aggregated, anonymous statistics (volumes per city, delays).

4. Sharing with pharmacies

The pharmacy you book sees: the products, the reservation code and your masked number (e.g. +243 81 *** ** 23). It never sees your full number. If you win a wheel gift, the telecom operator only receives the number and the bundle to credit. A “Bonus spin” is tied to a fingerprint (hash) of your number so it can be recognised at a later pickup without storing the number in clear.

5. Technical providers

Phati is hosted on a distributed cloud infrastructure (Cloudflare). When enabled, information SMS go through professional messaging operators acting on our behalf. None of these providers may use your data for their own purposes. We never sell data.

6. Retention

• Reservations without outcome (expired, cancelled, declined): deleted after 60 days.
• Collected reservations: operational data (phone, position, PIN) erased after 60 days; only a minimal accounting trace (code, amount, pharmacy, masked number) is kept to invoice pharmacies.
• Notifications and technical logs: 60 days.
• Data tied to a won gift: kept until the gift is handed over, then minimised.

7. Your choices and rights

• Erase this device: from “My reservations”, the button “Erase my reservations from this device” breaks the link between your browser and your reservations and deletes stored PINs, phone and basket.
• Location: you can refuse geolocation and simply enter your commune.
• Phone: required to reserve (it identifies your reservation); it is never shown in clear to the pharmacy.
• Access, rectification, deletion: write to support (contacts at the bottom of the Help page) quoting your reservation code; we answer within a reasonable time, at most 30 days.

8. Security

Encrypted connections (HTTPS), secure cookies, hashed PINs, attempt limiting, audit log of internal access and separation of duties for the Phati team. No payment data is processed: you pay at the pharmacy.

9. Minors

Phati is intended for adults. A parent or guardian may reserve for a minor; the pharmacy applies the dispensing rules in force.

10. Changes

This page may evolve with the service. The update date is shown at the top. Significant changes will be announced in the app.

11. Symptom search

The words you type for a symptom are matched against a small dictionary loaded in your browser: matching happens on your device and the query is not sent to Phati until you open a guidance page. Phati builds no health profile: no symptom is stored with your session, phone number or reservations.