Privacy Policy
This policy explains how GEM Group & Co. Ltd handles personal information when providing M360 to pharmacies, retail businesses, managers, workers, customers and other authorised users.
1. Who we are
M360 is a business management software product owned and operated by GEM Group & Co. Ltd ("GEM Group", "M360", "we", "us" or "our"). This policy applies to the M360 website, dashboards, applications, support channels and related services.
2. Our data-protection roles
The institution using M360 generally acts as the data controller for information it enters about its business, employees, customers, prescriptions and transactions. GEM Group generally acts as its data processor by hosting and processing that information according to the institution's authorised instructions.
GEM Group acts as a controller for information required to create and administer M360 accounts, manage subscriptions, secure the platform, communicate with account owners and comply with law. Each institution remains responsible for providing any notices and obtaining any permissions required for the information it collects.
3. Information we collect
Depending on how M360 is used, we may process:
- Account information such as names, usernames, worker identifiers, roles, phone numbers and email addresses.
- Institution information such as business names, branches, locations, logos, suppliers and subscription details.
- Operational records including inventory, batches, expiry dates, purchases, sales, expenses, invoices, stock transfers and adjustments.
- Customer or patient-related details entered by authorised users, including customer names, prescription references, doctor names and prescription attachments.
- Communications and support requests sent to GEM Group.
- Security and technical information such as login sessions, timestamps, device or browser information, IP addresses, audit events and error logs where generated by the service or hosting infrastructure.
Please do not enter personal information that is unnecessary for the relevant business or legal purpose.
4. How we use information
- Provide sales, stock, reporting, branch, worker, invoice and subscription functionality.
- Authenticate users, enforce permissions and protect accounts.
- Send requested operational, security and subscription messages.
- Provide support, diagnose faults, prevent misuse and improve reliability.
- Maintain audit records and meet lawful regulatory, tax, accounting or legal obligations.
- Investigate security incidents and enforce our Terms and Conditions.
We do not use institution data to advertise unrelated third-party products and we do not sell personal information.
5. Lawful processing
We process information where necessary to perform our service agreement, comply with legal obligations, protect legitimate interests such as platform security and fraud prevention, or act on valid consent where consent is required. Health and prescription information must only be entered where the institution has a lawful basis and appropriate safeguards.
7. Hosting and international transfers
We aim to choose service providers and hosting arrangements that provide appropriate protection. Where personal data is transferred outside Tanzania, GEM Group will apply required contractual, organisational and technical safeguards and obtain regulatory permission where required by Tanzanian law.
8. Data retention and deletion
We retain information while an account is active and for the period reasonably required to provide the service, resolve disputes, maintain security records and satisfy legal, tax, accounting or regulatory duties. When information is no longer required, it will be deleted, anonymised or securely isolated according to applicable retention requirements.
Account owners may contact us about export, correction or deletion before service closure. Some records cannot be deleted immediately where retention is legally required or necessary to protect legitimate legal claims.
9. Security
We use role-based access, authentication controls, session management, audit records, secure configuration, backups and other reasonable technical and organisational safeguards. No online service can guarantee absolute security. Institutions must protect credentials, remove former workers promptly, assign appropriate roles and notify us immediately of suspected unauthorised access.
10. Your privacy rights
Subject to Tanzanian law, individuals may request information about processing and seek access, correction, restriction, objection, portability or deletion where applicable. Requests concerning institution-entered data should normally be submitted first to that institution. GEM Group will assist the institution where required.
You may also complain to the Personal Data Protection Commission of Tanzania.
12. Children
M360 business accounts are intended for authorised adult business users. If an institution lawfully records information relating to a child in a prescription or customer record, that institution is responsible for the lawful basis, notices, permissions and access restrictions applicable to that information.
13. Changes to this policy
We may update this policy to reflect legal, operational or service changes. The current version and effective date will remain available on this page. Material changes may also be communicated to account owners through M360 or registered contact details.
14. Contact us
For privacy questions, rights requests or security concerns, contact GEM Group & Co. Ltd at info@m360.co.tz, Mbezi, Dar es Salaam, Tanzania. Please do not email passwords, prescription files or other sensitive records unless our support team provides a secure method.