PRIVACY POLICY — HALA PHARMA LTD.
Effective Date: 24 May 2026
Last Updated: 24 May 2026
Version: 1.1
================================================================
This Privacy Policy explains how Hala Pharma Ltd. ("Hala Pharma," "we," "us," or "our") collects, uses, stores, and protects personal information when you visit halapharmaltd.com, use the Med Rep Pro application, or interact with our WhatsApp Business automated assistant. We are committed to handling your information transparently and in line with internationally recognised data protection principles.
1. SCOPE & WHO WE ARE
Hala Pharma Ltd. is a pharmaceutical company that markets and distributes medicinal and healthcare products. We act as the data controller for personal information processed through our website, the Med Rep Pro application, and our WhatsApp Business assistant.
This Policy applies to:
- Visitors to halapharmaltd.com and its subpages.
- Users of the Med Rep Pro web and mobile application (medical representatives, supervisors, administrators, and authorised pharmacy or healthcare contacts).
- Individuals who message our WhatsApp Business number or interact with the automated assistant operating on it.
2. DEFINITIONS
- Personal Information / Personal Data — any information relating to an identified or identifiable individual.
- Processing — any operation performed on personal data, such as collection, storage, use, disclosure, or deletion.
- Med Rep Pro — our internal field-force management platform used by medical representatives and authorised personnel.
- WhatsApp Assistant — our automated WhatsApp Business reply system, used for FAQs, order/sample requests, lead capture, and customer support.
3. INFORMATION WE COLLECT
We collect personal information directly from you when you provide it, automatically through your interactions with our services, and occasionally from authorised third parties (for example, your employer if you are issued a Med Rep Pro account).
Identity & Contact:
Name, job title, employer, phone number, email address, WhatsApp number, pharmacy or clinic affiliation.
Account Credentials:
Username, hashed password, role assignment, authentication tokens (Med Rep Pro only).
Operational Data:
Visit logs, geolocation at visit check-in, order and sample requests, receipts, signatures, photographs of supporting documents.
Communications:
WhatsApp messages exchanged with our assistant, support tickets, complaints, feedback.
Technical Data:
Device identifiers, OS version, IP address, app version, crash logs, push notification tokens.
Usage Data:
Pages or screens viewed, features used, timestamps, approximate frequency of use.
Note: We do not knowingly collect special-category data (such as health records of identifiable patients) through these channels. Please do not send patient-identifying medical information via WhatsApp or Med Rep Pro free-text fields.
4. MED REP PRO APPLICATION
Med Rep Pro is provided to authorised users (typically employees, contractors, and approved partner contacts) for the management of field activities, pharmacy visits, sample distribution, and goods receipt workflows.
What we process:
- Account & profile data — name, role, assigned territory, contact details, profile photo (optional).
- Visit and activity data — pharmacies and doctors visited, check-in time, geolocation captured at the moment of check-in, notes, and follow-up tasks.
- Transactional records — sample distributions, collection tasks, Goods Receipt Notes (GRNs), digital signatures, and shared receipts.
- Messaging & calls — in-app chat and video session metadata (and content of messages exchanged through the in-app messaging feature), processed through our messaging provider.
- Device & diagnostic data — OS version, app version, crash reports, and push notification tokens used to deliver alerts.
Geolocation:
Med Rep Pro captures location at the moment of a visit check-in to verify field activity. It does not continuously track users in the background. Where required by the operating system, you will be prompted to grant location permission.
Push notifications:
We use push notifications (via Firebase Cloud Messaging) to deliver task assignments, messages, and operational alerts. You may disable notifications in your device settings, though this may limit the usefulness of the app.
Role-based access:
Access to data within Med Rep Pro is restricted by role. Representatives can view their own activity; supervisors and administrators have broader visibility limited to their assigned scope.
Deleting your account and personal data from within the app:
Med Rep Pro allows you to delete your account and associated personal data directly from the application, without contacting support. To do so:
1. Open the Med Rep Pro app and sign in to your account.
2. Navigate to the Profile page from the main menu.
3. Tap "Delete My Account" (located in the account settings section of the profile).
4. Confirm your identity by re-entering your password when prompted.
5. Review the on-screen summary of what will be deleted and what will be retained, then tap "Confirm Deletion."
What is deleted immediately:
Once you confirm, the following personal data is deleted from active systems without delay:
- Your account profile (name, contact details, profile photo, job title, assigned territory).
- Authentication credentials and session tokens.
- Device identifiers and push notification tokens associated with your account.
- In-app chat content authored by you, to the extent it is not required as part of an operational record.
- Personal preferences and settings.
What is retained, and why:
Certain records cannot be deleted on request because they form part of regulated business and operational documentation that Hala Pharma is required to keep under pharmaceutical, tax, and corporate record-keeping laws. These include:
- Visit logs, check-in records, and field activity history.
- Sample distribution records, collection tasks, and Goods Receipt Notes (GRNs), including associated digital signatures.
- Order and transactional records.
- Audit logs and security event logs.
Where feasible, retained operational records are anonymised or pseudonymised so that your identity is no longer directly associated with them. Where full anonymisation is not possible (for example, where a regulator requires the original signatory's name on a GRN), the record is retained in its original form for the legally required retention period and then securely deleted.
Effect of deletion:
Deletion is immediate and irreversible. After confirming, you will be signed out, your account will no longer be accessible, and you will not be able to recover the deleted data. If you are issued an account through your employer, you may also wish to inform your employer, as they may have separate records under their own systems.
If you cannot access the app — for example, because your account has already been disabled — you may submit a deletion request to privacy@halapharmaltd.com, and we will process it in accordance with this Policy.
5. WHATSAPP BUSINESS ASSISTANT
Our WhatsApp Business assistant provides automated and human-supported responses on our official WhatsApp number. By messaging us on WhatsApp, you understand that your messages are processed by both an automated system and, where needed, by our authorised staff.
What the assistant is used for:
- Keyword-based auto-replies to frequently asked questions about our products, services, and operating hours.
- Order and sample requests from medical representatives, pharmacies, and authorised partners.
- Lead capture — collection of basic contact information (name, phone number, email) to follow up on enquiries.
- Customer support and complaint handling, including escalation to a human representative where appropriate.
What we process:
- Your WhatsApp display name and phone number (provided by WhatsApp).
- The content of messages you send us, including any text, images, or documents you choose to share.
- Conversation timestamps and message delivery metadata.
- Any contact details you provide in response to assistant prompts.
Important notes:
WhatsApp messaging between you and us is governed by WhatsApp's own end-to-end encryption and by Meta's WhatsApp Privacy Policy (https://www.whatsapp.com/legal/privacy-policy). Once messages are delivered to our systems, they are subject to this Privacy Policy.
Please do not share sensitive health information, payment card details, government ID numbers, or third-party patient data via WhatsApp. Use secure channels for such information.
6. HOW WE USE INFORMATION
We use personal information for the following purposes:
- To operate and maintain Med Rep Pro, the WhatsApp assistant, and our website.
- To authenticate users and secure accounts.
- To process and fulfil orders, sample requests, and field operations.
- To respond to enquiries, support requests, and complaints.
- To send transactional notifications (e.g., task assignments, order confirmations).
- To improve our services through analytics, diagnostics, and crash reporting.
- To detect, prevent, and investigate fraud, misuse, and security incidents.
- To comply with applicable laws, regulations, and lawful requests from authorities.
We do not use your personal information for automated decision-making that produces legal or similarly significant effects.
7. LEGAL BASIS FOR PROCESSING
Where required by applicable law, we rely on one or more of the following bases:
- Consent — for example, when you initiate a WhatsApp conversation or opt into marketing communications.
- Contract — to provide Med Rep Pro under our agreement with your employer, or to fulfil an order you have placed.
- Legitimate interests — to secure our services, prevent abuse, improve features, and conduct day-to-day business operations, balanced against your rights.
- Legal obligation — to comply with tax, regulatory, pharmaceutical, and other applicable laws.
8. SHARING & DISCLOSURE
We do not sell personal information. We share it only with:
- Service providers who process data on our behalf under written agreements — including hosting providers, messaging and video platform providers (e.g., the in-app messaging SDK), push notification services, WhatsApp Business Solution Providers, and analytics tools.
- Your employer (where Med Rep Pro accounts are issued through a corporate engagement) for operational reporting limited to their authorised scope.
- Professional advisors such as auditors, lawyers, and accountants under duties of confidentiality.
- Authorities and regulators where disclosure is required by law, court order, or to protect our rights and the safety of others.
- Successors in the event of a merger, acquisition, or reorganisation, subject to the protections of this Policy.
9. DATA RETENTION
We retain personal information for as long as is necessary to fulfil the purposes set out in this Policy, including to comply with legal, accounting, and reporting requirements. Typical retention periods:
- Med Rep Pro account data — for the duration of your engagement, plus a reasonable archival period thereafter, or until you delete your account from the Profile page (see Section 4).
- Operational records (visits, GRNs, orders) — as required by pharmaceutical, tax, and corporate record-keeping rules, even where the associated user account has been deleted.
- WhatsApp conversations — retained for service quality, audit, and dispute resolution purposes; routinely reviewed for deletion.
- Diagnostic logs — short retention windows, typically not exceeding what is needed to resolve incidents.
When data is no longer required, we securely delete or anonymise it.
10. SECURITY MEASURES
We apply technical and organisational measures appropriate to the risk, including:
- Encryption in transit (HTTPS/TLS) for web and API traffic.
- Hashed and salted storage of authentication credentials.
- Role-based access controls within Med Rep Pro.
- Integrity protections (e.g., HMAC signatures) on sensitive records such as Goods Receipt Notes.
- Restricted administrative access, audit logging, and least-privilege principles.
- Regular software updates and security review of dependencies.
No system is perfectly secure. If we become aware of a security incident materially affecting your data, we will notify affected users and authorities as required by law.
11. INTERNATIONAL DATA TRANSFERS
Our infrastructure and service providers may be located outside your country of residence. Where personal information is transferred internationally, we take reasonable steps to ensure that an adequate level of protection is maintained, including through contractual safeguards with our service providers.
12. YOUR RIGHTS
Subject to applicable law, you may have the right to:
- Access the personal information we hold about you.
- Request correction of inaccurate or incomplete information.
- Request deletion of your information, subject to legal retention requirements. Med Rep Pro users may exercise this right directly from the Profile page in the app (see Section 4).
- Object to or restrict certain processing activities.
- Withdraw consent where processing is based on consent.
- Request a portable copy of information you provided to us.
- Lodge a complaint with a competent data protection authority.
To exercise these rights, contact us using the details in Section 16. We may need to verify your identity before responding.
13. CHILDREN'S PRIVACY
Our services are intended for use by professional and business users and are not directed to children under the age of 16. We do not knowingly collect personal information from children. If you believe a child has provided us with personal information, please contact us so we can take appropriate action.
14. COOKIES & TRACKING
Our website uses a limited set of cookies and similar technologies to operate essential functions, remember preferences, and understand usage. Where required, we will request your consent before placing non-essential cookies. You can manage cookies through your browser settings; disabling certain cookies may affect site functionality.
15. CHANGES TO THIS POLICY
We may update this Policy from time to time to reflect changes in our practices, technology, legal requirements, or other factors. When we do, we will revise the "Last Updated" date above and, where the changes are material, provide a more prominent notice. Continued use of our services after an update constitutes acceptance of the revised Policy.
16. CONTACT US
For any questions, requests, or concerns about this Privacy Policy or our handling of your personal information, please contact:
Hala Pharma Ltd.
Privacy & Data Protection
Website: halapharmaltd.com
Email: privacy@halapharmaltd.com
We aim to respond to verified requests within a reasonable timeframe and in accordance with applicable law.
================================================================
© 2026 Hala Pharma Ltd. All rights reserved.