Pharbaco SuperApp Privacy Policy

Last updated: 25 October 2026 · Version 1.2 · The Vietnamese version above prevails if the two differ.

This policy applies to the Pharbaco SuperApp app on Android (application ID vn.pharbaco.superapp) and iOS, and the SuperApp server system behind it. SuperApp is a work tool for members of Pharbaco Trading's distribution network (managing customers, creating and tracking orders, viewing income statements and the management tree) and for Pharbaco Trading's medicines-line staff (medical representatives, province/area/region directors, business-development and customer-care staff): organisation, pharmacy customers, visits (check-in) and medical-representative cards.

1. Data controller

Pharbaco Trading is the controller of personal data in the SuperApp system and the publisher of the app on Google Play. The Pharbaco brand is used under an agreement with the parent company, Công ty Cổ phần Dược phẩm Trung ương I – Pharbaco.

2. What the app (Android, iOS) sends

The app draws the referral QR code on the phone from a link issued by the server. The only personal-data permission the app requests is location while the app is in use (precise and approximate), solely for medicines-line staff check-in as described above; distribution-network (TPCN) member accounts are never asked for it. The app does not request camera, photo, contacts or microphone permissions, does not use push notifications, contains no third-party advertising, analytics or crash-reporting SDK, and has no payment or withdrawal function.

3. Data the SuperApp system holds about you

Besides what the app sends, the SuperApp system stores the following member data (most of it created when you join, by your manager or an administrator, or through the SuperApp website):

• Account and identity: full name, phone number (sign-in name), email, date of birth (if provided), password as a one-way hash, account status, failed sign-in count and temporary lock time.
• Position in the network: member ID, title, direct manager, referrer, management tree.
• Business data: customers you look after, orders, sales, affiliate income entries, balances and statements per period.
• Notifications sent to you in the system and their read status.
• Medicines-line staff: name, phone number, job position in the organisation tree (region, area, province, the seat held, acting holders), pharmacy customers assigned and customer-claim requests, visits (time, pharmacy, note, location and location status: captured / denied / not consented / unavailable), the location-sharing choice (version, time of consent and of withdrawal), the medical-representative card under Circular 31/2025/TT-BYT (card number, issue date, expiry date, status, medicines covered) and the filings to the provincial Department of Health on card issue and revocation.
• Payout information (only if you use income withdrawal on the SuperApp website; the Android app has no such function): national ID (CCCD) number, identity verification status, account holder name, account number and bank, withdrawal requests and one-time passwords (OTP). The system does not store images of your ID card.
• Join requests: full name, phone number, email, hashed password and status. Requests that are not approved expire after 7 days but remain stored until deleted on request.
• Audit log: important data changes (for example editing customer details) are recorded with the values before and after, who made the change and when.
• Technical logs: for each request the server records the IP address, the app/device information sent with it (user-agent), time, method, full path and status code. The path may contain a customer's phone number when you look up a customer. Passwords, OTPs and session tokens are masked in logs.

4. Data about your customers

The system stores information about customers (pharmacies and individual buyers) managed by members: name, phone number, province, delivery addresses, order history, activities and tasks, and notes that members enter on the website (which may include allergy notes and a marketing-consent choice). When you enter customer information, you must make sure the customer is aware and agrees. Customers can contact Pharbaco Trading by email (section 11) to exercise their rights.

5. Purposes and legal basis

• Performing our distribution cooperation agreement with you: managing members and the management tree, customers, orders, stock and prices; calculating, reconciling and paying affiliate income; sending work notifications.
• Performing the employment contract with medicines-line staff: organising staff, assigning customers, recording pharmacy visits and managing work.
• Location at check-in: based on each staff member's separate consent, used only to confirm the pharmacy visit. Declining or withdrawing consent does not affect check-in.
• Legal obligations: keeping accounting and tax records; managing medical-representative cards and reporting them to the Department of Health under Circular 31/2025/TT-BYT; providing information to authorities when required by law.
• Security and fraud prevention: sign-in authentication, temporary lock after repeated wrong passwords, role-based access, audit and technical logs.
• Your consent: for processing that requires consent under Personal Data Protection Law No. 91/2025/QH15 and Decree 356/2025/ND-CP.

We do not sell data, do not use it for advertising and do not track you across other apps or websites.

6. Who receives data

• Your managers and upline in the network can see some of your information (name, phone number, title, orders, customers and business figures) within the permissions granted to them. Managers can see join requests (name, phone number) from people referred into their branch.
• Managers in the medicines line (province, area and region directors, deputy general directors) can see their subordinates' visits, including the check-in location when present; HR can see staff records and medical-representative cards.
• Pharbaco Trading staff (sales, accounting, administration) as needed for their work.
• Vipex Technology Co., Ltd, the technical service provider (development, operation and maintenance of the system) under contract with Pharbaco Trading, which accesses data only when needed and on Pharbaco Trading's instructions.
• Banks executing transfers when Pharbaco Trading pays out your income.
• Competent authorities (for example tax authorities; the Department of Health receives the list of medical-representative cards issued and revoked) when required by law. Check-in locations are not sent to any authority or third party.
• If you enable notifications in your web browser on the SuperApp website, the browser's push service (Google, Apple or Mozilla) receives the notification content in order to deliver it. The Android app does not use push notifications.

7. Where and how long data is kept

The SuperApp servers and database run on Pharbaco's server infrastructure in Vietnam.

8. Your rights

• Access: your account information, customers, orders, income and notifications are shown in the app.
• Rectification: customer details can be edited in the app (if you have permission). To correct your own personal details, contact your direct manager or email us.
• Turning location sharing at check-in on or off (medicines-line staff): in the app, open Nhánh thuốc (Medicines) → Vị trí khi check-in (Location at check-in); you can also turn off the app's location permission in your phone settings.
• Erasure: in the app, go to Tài khoản (Account) → Yêu cầu xóa tài khoản (Request account deletion) to open the account deletion page, or open that page directly in a browser, and submit a request as described there.
• Withdrawing consent, objecting, restricting processing, obtaining a copy, complaints: email minh.vu@pharbaco.com.vn from your registered email address, or state your full name and registered phone number. You may also complain to the competent Vietnamese personal data protection authority.

We respond within the time limits set by law.

9. Security

• The app connects to the server only over HTTPS; release builds refuse unencrypted connections.
• Session tokens are encrypted with a key held in Android Keystore (on iOS: stored in the Keychain); Android backup is disabled for the app.
• Passwords are stored only as one-way hashes; accounts are temporarily locked after repeated wrong passwords.
• Access to data is limited by role and management scope; sensitive operations are recorded in the audit log.

No system is perfectly secure. If a data breach occurs, we will notify the competent authority and you as required by law.

10. Age

SuperApp is only for people aged 18 and over who take part in Pharbaco Trading's distribution network or work for Pharbaco Trading, and is not directed at children.

11. Changes and contact

When we change this policy we update the date at the top and announce material changes in the system. Contact: Pharbaco Trading – No. 160 Ton Duc Thang Street, O Cho Dua Ward, Hanoi, Vietnam · Email: minh.vu@pharbaco.com.vn.

See also: Terms of Use · Account deletion.