Privacy Policy

Two Roles

For information about our customers’ accounts — people who sign up, business owners, staff users and billing contacts — we decide how the information is used and are responsible for it under this policy, as controller.

For information our customers enter into the Service — such as their sales, retail customers, employees, and, for Plus Pharma, patients, doctors and prescriptions — we process it only on behalf of the business that entered it, as its processor or service provider, under our Data Processing Addendum. That business is the controller: it decides why and how the information is used and is responsible for giving notice and having a lawful basis for it. If you are a customer, employee or patient of a business that uses Retaiva, contact that business about your information; we will assist it in responding.

Information We Collect for Our Own Purposes

• Account information: name, email address and sign-in details. Passwords are handled by our authentication provider; we do not see or store them.
• Security information: two-step verification status, session records, IP address and browser details at sign-in and when legal terms are accepted, and records of failed sign-in attempts used to prevent abuse.
• Business information: business name, store addresses, phone number and registration details entered during setup.
• Billing information: plan, subscription status and identifiers received from our payment provider. Card details are entered with Freemius and are not received by Retaiva.
• Device information: for the Android POS application, device manufacturer and model, Android and app version, and an installation identifier used to register the device to a store.
• Usage and error information: record counts, storage used, and technical error reports. Error reports are designed to exclude the contents of business, customer and patient records.
• Support communications: messages you send to us and our replies.

Information Processed for Pharmacies (Plus Pharma)

Pharmacies using Plus Pharma may record patient names, dates of birth, contact details, addresses, allergy status and pharmacy notes; doctor details; prescriptions, dispensing records and prescription documents. This can include health information, which some laws treat as special category or sensitive data. Access within a pharmacy is limited by staff role, and access to patient records is logged. We use this information only to provide the Service to that pharmacy.

How We Use Information and Our Legal Bases

We use the information we control to:

• create and secure accounts and provide the Service, as needed to perform our contract with the business;
• process subscriptions, prevent fraud and meet accounting and tax obligations, as needed to perform that contract and to comply with law;
• send service messages, such as verification codes, security notices and policy changes, and provide support, in our legitimate interest in operating a secure and reliable service;
• investigate problems and improve the Service, in that same legitimate interest; and
• comply with legal obligations and establish, exercise or defend legal claims.

Where the law requires consent for a use, we ask for it, and it can be withdrawn at any time. We do not sell or share personal information for cross-context behavioural advertising, use it for advertising, or use customer records to train artificial intelligence models. We do not make decisions with legal or similarly significant effects about anyone by automated means alone.

Sharing

We share information with service providers that help us operate the Service, listed on the Subprocessors page, under agreements that limit their use of it. Freemius, Inc. sells subscriptions as merchant of record and receives the billing information it needs for that. We may also disclose information where required by law or to protect rights, safety and security, and as part of a merger, acquisition or sale of our business, subject to this policy.

International Transfers

The Service is hosted by Amazon Web Services in the United States (region us-east-2, Ohio). Information entered into Retaiva, including pharmacy records, is therefore transferred to, stored and processed in the United States, which may not have the same data protection laws as your country. Our payment and email providers may process information in other countries as described in their own policies.

Where personal information is transferred from the European Economic Area, the United Kingdom or Switzerland to a country without an adequacy decision, we rely on the European Commission’s Standard Contractual Clauses, with the UK International Data Transfer Addendum or the Swiss adjustments where applicable, or another transfer mechanism the law recognizes. For other countries we use safeguards that meet local transfer requirements. Contact support@retaivatt.com for a copy of the relevant safeguards.

Security

Information is encrypted in transit and at rest in our database and document storage. Access is limited by role, sensitive actions are recorded in an audit history that ordinary users cannot alter, and two-step verification is available to every user. No method of transmission or storage is completely secure. See Security for more detail.

Retention

We keep account and billing information while the account is active and afterwards for as long as needed to meet legal, accounting and dispute-resolution obligations. Customer records are kept according to the customer’s instructions and any retention periods it records in the Service; regulated pharmacy records are not deleted while a retention period is unconfirmed or a legal hold applies. Backups are kept for a limited period and then deleted.

Your Rights

Depending on where you live, you may have the right to access, correct, delete or receive a copy of your personal information, to restrict or object to how it is used, to withdraw consent, and not to be treated differently for exercising these rights. These include rights under the EU and UK General Data Protection Regulation, the California Consumer Privacy Act as amended by the CPRA, Trinidad and Tobago’s Data Protection Act, Chap. 22:04, and similar laws.

To make a request about information we control, contact support@retaivatt.com. We may need to verify your identity, and an authorized agent may make a request for you with proof of authority. We respond within the time the law that applies to you requires. If you are in the EEA or UK, you may also complain to your data protection supervisory authority.

For records held by a business that uses Retaiva, please contact that business directly. It controls those records and decides how to respond; we assist it as its processor.

California Notice

In the last 12 months we collected, for the purposes described above, the categories of personal information listed in this policy: identifiers, commercial information (plan and subscription), internet or network activity (security and usage records) and professional information (business details). We disclose them for business purposes to the service providers listed on the Subprocessors page. We have not sold or shared personal information, and we use sensitive personal information only as permitted to provide the Service.

Cookies

We use only cookies and browser storage needed to sign in, keep the Service secure and remember basic preferences. We do not use analytics or advertising cookies. See the Cookie Policy.

Children

The Service is intended for businesses and their adult staff and is not directed to children. Pharmacies may record information about patients of any age as part of their professional services; that information is processed on the pharmacy’s behalf, and the pharmacy is responsible for any consent the law requires.

Changes

We will post updates to this policy with a new version date and notify business owners and users of material changes in the Service.

Contact

Privacy enquiries: support@retaivatt.com. Retaiva, Trinidad and Tobago.