1. Who we are
BMIS (Business Management Information System) is operated for pharmacy operations under the authority of CMDA-SL (“we”, “us”, “our”). Technology delivery and platform engineering are provided by Lion Code Innovation Ltd (lioncodeinnovation.com), acting as a processor / technical service provider on CMDA-SL’s platform.
This Policy applies to authorised users of BMIS (pharmacy staff, branch administrators, CMDA-SL operators, and Lion Code platform engineers) and to personal data processed in the course of pharmacy retail operations in Sierra Leone.
2. Legal and policy context (Sierra Leone)
We design BMIS with regard to:
- The Constitution of Sierra Leone (privacy and dignity interests relevant to personal information);
- The Cyber Security and Crime Act, 2021 (cybersecurity, unauthorised access, integrity of computer systems, electronic evidence, and related privacy safeguards);
- The Right to Access Information Act, 2013 and associated regulations, where CMDA-SL acts as or supports a public body obliged to handle information requests lawfully;
- Emerging national data-protection policy directions (including work toward a comprehensive Data Protection / Right to Access Information framework). We commit to update this Policy when a dedicated data-protection statute or regulator mandate takes effect.
Pharmacy operational records may also be subject to professional, medicines-control, tax, and audit obligations applicable in Sierra Leone. Where those duties require retention, we retain only what is necessary.
3. What data BMIS processes
3.1 Account and access data
- Name, email, authentication credentials (stored as secure hashes by the identity provider);
- Assigned pharmacy roles and permissions;
- Branch assignments and active branch context;
- Login session metadata and security-relevant events.
3.2 Pharmacy operational data
- Product catalogue, batches, expiry, stock movements, and valuations;
- Point-of-sale transactions, receipts, payments, voids, and returns;
- Supplier and customer master data, credit balances, and ledgers;
- Purchase orders, receiving records, and supplier returns;
- Approvals, audit logs, stock counts, month-end closures, and exception reports;
- Multi-branch transfer records and enterprise analytics (Premium Pro).
3.3 Sensitive / higher-risk categories
BMIS is a business operations system. It may store customer contact and credit information and, depending on how a pharmacy configures catalogue and dispensing workflows, medicine-related transaction history. We treat such data as confidential business and customer information requiring role-based access, auditability, and least-privilege controls.
3.4 Technical and device data
- Browser or installed PWA technical logs needed for security and reliability;
- Offline device caches (for example POS catalogue snapshots and queued sales) stored on the user’s device;
- Optional diagnostics / backup job metadata requested by administrators.
4. Roles, access, and purpose limitation
Access is granted strictly according to assigned roles. Typical pharmacy roles include:
- Owner / Manager / Branch Admin — administration, approvals, reporting, and governance;
- Pharmacist — dispensing-related operational access within granted permissions;
- Cashier — POS, receipts, and limited sales views;
- Storekeeper — receiving, stock, batches, and inventory reports;
- CMDA-SL Ops — tenant/client operations across pharmacies (platform plane);
- Lion Code — engineering control plane (health, security, platform settings), not day-to-day pharmacy POS browsing by default.
We process data only to:
- Provide and secure the BMIS service;
- Support lawful pharmacy operations, inventory integrity, and financial reconciliation;
- Enforce subscriptions, seat limits, and multi-tenant isolation;
- Detect abuse, investigate incidents, and meet audit / regulatory requests;
- Improve reliability (including offline sync and PWA updates).
We do not sell personal data.
5. Multi-tenant isolation and security measures
- Pharmacy tenants are logically isolated; users of one tenant must not access another tenant’s records;
- Row-level security and server-side RPCs enforce authorisation for sensitive writes;
- Immutable stock movement and audit trails support accountability;
- Approvals gate high-impact changes (price, adjustments, write-offs);
- Transport encryption (HTTPS) in production; credentials never stored in plain text;
- Administrative actions by CMDA-SL / Lion Code are limited to their platform roles and logged where applicable.
6. Sharing and disclosure
We may share information only:
- With Lion Code Innovation Ltd as technical processor under contractual confidentiality;
- With infrastructure providers strictly necessary to host BMIS (for example database hosting), under appropriate safeguards;
- With competent Sierra Leone authorities when required by law, court order, or lawful investigation under applicable cybercrime / information legislation;
- With the pharmacy’s own authorised users according to their roles.
We do not permit unrestricted third-party marketing use of BMIS customer or staff data.
7. Cross-border processing
BMIS may be hosted on cloud infrastructure that stores or backs up data outside Sierra Leone (including regional European or other data centres used by the hosting provider). Where that occurs, CMDA-SL remains responsible for choosing processors and requiring contractual security obligations consistent with this Policy and applicable Sierra Leone law.
8. Retention
- Account data — for the life of the user account plus a short wind-down period after deactivation;
- Transactional, inventory, and audit records — retained to support pharmacy operations, dispute resolution, and legal retention duties;
- Offline device caches — retained on the device until cleared by the user, app reinstall, or successful sync policies;
- Backup / diagnostic artefacts — retained only as long as needed for the stated restore or incident purpose.
9. Your rights and requests
Subject to Sierra Leone law and legitimate pharmacy retention duties, authorised individuals may request:
- Access to personal data held about them in BMIS;
- Correction of inaccurate account or profile information;
- Deactivation of user accounts when employment / access ends;
- Information about processing relevant to a lawful access-to-information request (where that regime applies).
Pharmacy owners/administrators should raise operational data requests inside their tenant. Platform-level or cross-tenant requests should be directed to CMDA-SL. Security incidents involving unauthorised access should be reported immediately to CMDA-SL and, where relevant, Lion Code engineering.
10. Children
BMIS is a professional pharmacy operations platform. It is not directed at children. Staff accounts are issued to adults authorised by the pharmacy or CMDA-SL.
11. Changes
We may update this Policy as BMIS features, hosting arrangements, or Sierra Leone legal requirements evolve. Material changes will be reflected by updating the effective date on this page and, where appropriate, notifying tenant administrators.
12. Contact
Controller / operator: CMDA-SL — BMIS programme
Technology provider: Lion Code Innovation Ltd — lioncodeinnovation.com
For privacy questions related to a specific pharmacy tenant, contact that pharmacy’s BMIS owner/administrator first.