Privacy policy

• People who use Marrow for a business. Owners and staff of distributors (and of pharmacies that use Marrow) who sign in to the web app. ENA OINTING LTD decides how this information is used.
• A distributor’s customers. Pharmacies, hospitals and the people who order for them, when they message a distributor’s WhatsApp number that is connected to Marrow or when the distributor saves them as a customer. Here we act on the distributor’s instructions: the distributor decides why the information is used, and its own privacy notice also applies.
• Visitors to our website and anyone who contacts us.

Account and organisation details. Your name, work email address, phone number, job role and password. We store only a one-way hash of your password, never the password itself. For the organisation: its legal and trading names, licence numbers, facility addresses and team members.

Business records a distributor keeps in Marrow. Products, prices and price lists, stock levels, batch numbers and expiry dates, proformas, orders, invoices and deliveries. Customer records: the business name, delivery address, whether it is a pharmacy or a hospital, and the names and WhatsApp numbers of the people who order for it.

WhatsApp messages and account details, when a distributor connects its WhatsApp Business number to Marrow. Section 5 lists exactly what we receive.

Technical information. IP address, browser and device type, and the date and time of sign-ins and actions, kept in logs and audit trails for security and troubleshooting. The web app uses cookies that are strictly necessary to keep you signed in. Our website does not use advertising cookies or third-party analytics.

What you send us. Demo requests, emails and support messages.

• To provide the Service: read orders sent as text, photos, PDFs or spreadsheets; match the products to the distributor’s catalogue; check stock; price them from the customer’s price list or class of trade (pharmacy or hospital); prepare proformas; send replies and documents to the customer on the distributor’s behalf; and track orders, invoices and deliveries.
• To keep the Service secure and accountable: sign people in, apply the permissions of their role, record who did what in audit logs, and detect and stop misuse, fraud and security incidents.
• To support you: answer requests and tell account holders about changes, incidents and their account.
• To keep the Service working well: fix errors and measure performance, such as how quickly proformas are prepared, using aggregated or de-identified data where we can.
• To meet legal obligations, such as tax records and the batch and recall records medicines require.

How the AI is used. AI models read messages and documents, for example a photographed order list. The assistant works within rules the distributor sets: orders above a set value, and anything it is unsure about, are held for a member of the distributor’s team to check before anything is sent.

We use information to perform our contract with distributors, for our legitimate interest in a secure and reliable service, to comply with the law, and with consent where the law requires it. We do not sell personal information, use it for advertising, or allow our AI providers to train their models on it.

A distributor connects its WhatsApp Business number to Marrow through Meta’s signup flow, where it logs in with Facebook and chooses which WhatsApp Business account and number to share with Marrow. On Meta’s platform the integration is our app “Marrow”, which belongs to ENA OINTING LTD’s verified Meta business account. Marrow receives only what that connection allows:

• Account details (WhatsApp Business management permission): the WhatsApp Business account and phone number IDs, the number’s display name and verification status, message templates, quality rating and messaging limits, and the access token Meta issues to Marrow for that account. We use these to set up the number, manage its message templates and show the connection’s status in Marrow.
• Messages (WhatsApp Business messaging permission): messages sent to and from the connected number, including the sender’s phone number and WhatsApp profile name, the text, any photos, documents or spreadsheets, and the date, time, message ID and delivery and read status. We use them to read and answer orders on the distributor’s behalf, as described in section 4, and to show each conversation to the distributor’s team.
• Replies from the WhatsApp Business app. If the distributor keeps using the WhatsApp Business app on the same number, Meta also sends Marrow the messages the distributor sends from the app, so the assistant knows a person has replied and stays quiet in that chat. Marrow does not import the app’s past chat history or the phone’s contact list.

Marrow cannot see personal WhatsApp accounts or any number the distributor has not connected. WhatsApp data is used only to provide the Service to the distributor that connected the number. It is never used for advertising and never shared with other distributors. Use of WhatsApp is also subject to Meta’s terms and policies, including the WhatsApp Business Messaging Policy.

• With the distributor’s team. Conversations and records about a customer are visible to the authorised members of that distributor’s team, according to their roles.
• Between trading partners. When a pharmacy and a distributor both use Marrow and trade with each other, the orders, proformas, invoices, deliveries and batch details of their trades are shared between the two of them.
• With our service providers, who process information for us under contract and only on our instructions:
  • Meta Platforms, through the WhatsApp Business Platform, to send and receive WhatsApp messages.
  • Anthropic, which provides the AI models that read messages and documents. It processes the content to return a result and does not use it to train its models.
  • Railway, which hosts our servers, databases and file storage.
• With systems a distributor connects. If a distributor links its accounting or inventory software (for example QuickBooks, Odoo or SAP Business One), Marrow exchanges product, stock, order and invoice data with it as the distributor directs.
• For legal and safety reasons: when the law, a court or a competent authority requires it, to protect people’s safety (for example during a medicine recall), or to defend our legal rights.
• If ownership changes. If ENA OINTING LTD merges with or is acquired by another company, or sells Marrow, information may pass to the new owner, who must keep to this policy. We will tell account holders first.

We do not sell or rent personal information to anyone.

Our service providers may process information outside Ghana, including in the United States. When information leaves Ghana, we rely on contracts and safeguards that require it to be protected as this policy describes.

• Account and organisation details are kept while the account is open and deleted within 30 days after it is closed.
• Business records, including WhatsApp conversations and their attachments, are kept while the distributor’s account is open, so orders, proformas and deliveries can be traced. They are deleted within 30 days after the account is closed, or sooner if the distributor asks.
• When a WhatsApp number is disconnected, Marrow stops receiving its messages and deletes the access token Meta issued for it. The conversations and orders that came through it stay in the distributor’s account until the distributor asks for them to be deleted.
• Records the law requires us to keep, such as tax invoices and medicine batch and recall records, are kept for as long as the law requires and then deleted.
• Logs are kept only as long as needed for security and troubleshooting. Deleted information leaves our backups as they expire.

Information travels over encrypted (TLS) connections. Passwords are stored as one-way hashes, and WhatsApp access tokens and integration credentials are encrypted. Each organisation’s data is kept separate in our database, team members see only what their role allows, and actions are recorded in audit logs. No system is perfectly secure: if a breach affects your information, we will tell you and the authorities as the law requires.

Under Ghana’s Data Protection Act, 2012 (Act 843) and similar laws elsewhere, you can ask us to show you the information we hold about you, correct it, delete it, stop or limit how we use it, or withdraw consent you gave. Email hello@usemarrowos.com and we will reply within 30 days.

If we hold your information for a distributor, we will pass your request to that distributor and help it respond. You can also complain to the Data Protection Commission of Ghana.

You can ask us to delete your information at any time. The data deletion page has step-by-step instructions for each case. In short:

• Distributors and other businesses: the account owner emails hello@usemarrowos.com from the owner’s address, with the organisation’s name. We delete the account and its data, including WhatsApp conversations, within 30 days of confirming the request.
• To disconnect WhatsApp: in Marrow, open Integrations, select your WhatsApp connection and choose Disconnect WhatsApp. Marrow stops receiving messages for the number straight away; past conversations and orders stay until you ask us to delete them.
• People who messaged a distributor: email us with the phone number you used and the distributor’s name, or ask the distributor. We will ask you to confirm from the same number, then delete your messages, files and contact details within 30 days.

We confirm when deletion is complete and tell you about anything the law requires us to keep, and why.

The Service is for businesses and is not meant for anyone under 18. We do not knowingly collect information about children.

We will post any changes on this page and update the date at the top. If a change is significant, we will tell account owners by email or in the app before it takes effect.

ENA OINTING LTD handles all questions, requests and complaints about privacy in Marrow. Email hello@usemarrowos.com.