OSOTCAM

1. About OSOTCAM

OSOTCAM is a open medicines delivery marketplace based in Phnom Penh, Kingdom of Cambodia. We connect consumers with licensed, Ministry of Health (MoH)-verified independent pharmacies to enable safe, convenient access to medicines and health products.

2. Scope of this policy

This policy applies to all personal data collected through:

• The OSOTCAM website and web application (osotcam.com)
• Enquiry and contact forms on our website
• Messaging via Telegram (@osotcam_support)
• Analytics and advertising tools embedded in our website
• Interactions with our social media pages (Facebook, TikTok)

This policy does not apply to third-party websites linked from our platform. We encourage you to review the privacy policies of any external services you visit.

3. Legal basis for processing

Cambodia's primary legal frameworks governing personal data and consumer protection that inform this policy include:

• The Law on E-Commerce (2019), which governs electronic transactions and consumer rights online
• The Law on Telecommunications (2015), covering communications data and network security
• The Civil Code of Cambodia, providing general principles of obligation and consent
• Ministry of Health regulations governing health information and pharmaceutical data
• The draft Law on Personal Data Protection (under development as of 2025), which we proactively observe

We process your personal data on the following lawful grounds:

• Your consent, where you have given clear, informed agreement
• Contractual necessity, to deliver the services you have requested
• Our legitimate interests, in operating and improving our platform — balanced against your rights
• Compliance with applicable Cambodian law and regulatory obligations

6. How we use your personal data

We use your personal data solely for the purposes described below. We will not use your data for any new purpose without notifying you and, where required, obtaining your consent.

• Processing and fulfilling your medicine orders
• Communicating with you about your orders, account, and support requests
• Responding to enquiries submitted through our web form or Telegram
• Sending order updates, delivery notifications, and important service announcements
• Sending marketing communications where you have consented — you may opt out at any time
• Analysing website traffic and user behaviour to improve our platform (using anonymised or aggregated data where possible)
• Measuring the performance of our advertising campaigns on Facebook and TikTok
• Detecting and preventing fraud, misuse, and security threats
• Complying with legal and regulatory obligations under Cambodian law

8. Website enquiry form

Our website includes a contact / enquiry form that allows you to send us a message without creating an account. When you submit this form, we collect:

• Your full name
• Your email address and/or phone number
• The subject and content of your message
• The date and time of submission
• Your IP address (for spam prevention)

We use this information solely to respond to your enquiry. Enquiry data is retained for two years from the date of submission. We do not add you to marketing lists based on enquiry form submissions without your separate, specific consent.

9. Telegram communications

OSOTCAM uses Telegram as a primary support and customer communication channel. When you message us on Telegram:

• Your Telegram username, display name, and message content are visible to our support team
• We may retain conversation records for up to two years for quality assurance and dispute resolution
• Telegram's own privacy policy applies to the Telegram platform and its servers

Telegram messages are not encrypted end-to-end by default in our business channels. Please do not share sensitive financial details, prescriptions, or government-issued identity numbers via Telegram unless explicitly directed to do so by our team.

11. Data security

We implement appropriate technical and organisational measures to protect your personal data against unauthorised access, accidental loss, alteration, or disclosure. Our security practices include:

• Encrypted connections (HTTPS/TLS) for all data transmitted between your device and our servers
• Encrypted storage of sensitive data including prescription images and payment-related information
• Role-based access controls ensuring staff access only the data necessary for their role
• Regular security assessments and vulnerability testing
• Incident response procedures to detect, investigate, and notify affected users in the event of a data breach

No system is completely secure. While we take every reasonable precaution, we cannot guarantee absolute security of data transmitted over the internet. If you suspect your account has been compromised, please contact us immediately at privacy@osotcam.com.

12. Your rights and choices

As a user of OSOTCAM, you have the following rights in relation to your personal data. To exercise any of these rights, please contact us using the details in Section 15.

• Right to access — request a copy of the personal data we hold about you
• Right to rectification — ask us to correct inaccurate or incomplete data
• Right to erasure — request deletion of your data where we no longer have a lawful basis to retain it (subject to legal retention obligations)
• Right to withdraw consent — where processing is based on consent, you may withdraw it at any time without affecting the lawfulness of prior processing
• Right to object to marketing — opt out of marketing communications at any time by replying STOP to any message, or by emailing privacy@osotcam.com
• Right to data portability — request your data in a commonly used electronic format
• Right to lodge a complaint — if you believe we have mishandled your data, you may raise a concern with us directly or with the relevant Cambodian regulatory authority

We will respond to all verified requests within 30 days. We may need to verify your identity before processing certain requests.

13. Children's privacy

Our platform is not directed at persons under the age of 18. We do not knowingly collect personal data from minors. If a parent or guardian believes their child has provided us with personal data, please contact us at privacy@osotcam.com and we will delete such data promptly.

For household orders of medicines, an adult member of the household must create the account and place the order on behalf of any minor family member.

14. Data retention

We retain your personal data for as long as necessary to fulfil the purposes described in this policy, or as required by applicable law. The following minimum retention periods apply:

• Active account data: retained for the duration of your account and three years after last activity
• Order and transaction records: five years from the date of transaction (commercial records obligation)
• Prescription images: one year from upload, or as required by MoH pharmaceutical regulations
• Enquiry form submissions: two years from date of submission
• Telegram support conversations: two years from the last message
• Marketing consent records: retained for three years after consent is withdrawn (for compliance evidence)
• Analytics data: up to 26 months (governed by Google Analytics retention settings)

When retention periods expire, data is securely deleted or anonymised so that it can no longer be linked to an individual.

16. Changes to this policy

We may update this Privacy Policy from time to time to reflect changes in our services, technology, or applicable law. When we make material changes, we will:

• Post the updated policy on our website with a revised "Last updated" date
• Notify registered users via email or in-app notification at least 14 days before the changes take effect
• Where required by law, seek your renewed consent for any new processing activities

Your continued use of OSOTCAM after the effective date of any updated policy constitutes your acceptance of the revised terms. We encourage you to review this page periodically.