1. About this Privacy Notice
1.1 In this Privacy Notice, "we", "us" and "our" refer to Medico Store LLC. "You" and "your" refer to you as an individual.
1.2 This Privacy Notice explains what personal information we collect about you in connection with our business, how and why we use it, who we share it with, how we protect it, and what rights you have over it. It covers our website at medicostoreiq.com, our iOS and Android applications, our retail branches in Baghdad, Erbil and Basra, our warehouse operations, and our customer communications by email, telephone, WhatsApp and social media.
1.3 Please read this Notice together with our Terms & Conditions and any other notice we give you at the point we collect information from you. This Notice supplements those documents and is not intended to override them.
2. Our approach to data protection
2.1 Iraq does not currently have a comprehensive personal data protection statute in force. Rather than treat that as a reason to do less, we have chosen to hold ourselves to the standards set out in the EU and UK General Data Protection Regulation (GDPR), which we use as our internal benchmark for how we handle personal information.
2.2 Where Iraqi law, the law of another country in which we operate, and our own internal standards overlap, we apply whichever gives you the greater protection.
2.3 We collect only the personal information we actually need, we tell you what we are doing with it, and we do not sell your personal information to anyone.
3. Who is responsible for your personal information
3.1 The company responsible for your personal information — the data controller — is Medico Store LLC , a company registered in the United States, trading in Iraq as Medico Store (مدكو ستور). Our operations, branches and warehouse are located in Iraq.
3.2 Our retail branches are located at:
- Baghdad — Mansour, 14 Ramadan Street
- Baghdad — Zayona, near Maysalon Square
- Erbil — Park View
- Basra — Al-Tuwaisa, Olympic Committee Street
3.3 If you have a question about how we use your personal information, contact our privacy team using the details in section 18.
4. Changes to this Privacy Notice
4.1 We may update this Notice from time to time to reflect changes in how we operate or in the law. The date at the top shows when it was last revised.
4.2 If we make a significant change — for example, if we start using your information for a materially new purpose — we will tell you directly by email or through a notice on our website or in our app before that change takes effect. We will not rely on your continued use of the site as a substitute for telling you.
5. The information we collect
5.1 Personal information means any information from which you can be identified. It does not include information that has been anonymised so that it can no longer be linked back to you.
5.2 The precise information we hold depends on how you interact with us. Typically it falls into these categories:
Identity information — your first and last name, and any name you give us for an order or an account.
Contact information — your delivery address, billing address, governorate, email address, telephone and WhatsApp number, and your social media handle if you contact us through Instagram or Facebook.
Order and transaction information — the products you have bought or returned, order value, delivery method, delivery status, payment method, and records of exchanges, refunds and warranty claims. Where you pay cash on delivery, this includes the amount collected by the courier.
Sizing and preference information — the sizes, colours and product categories you select, and any fit or garment preferences you tell us about so we can advise you or process an exchange.
Professional information — where you choose to tell us, your profession or clinical specialty (for example, so we can recommend the right lab coat length or a specialty pin). We ask for this only to serve you better. It describes your occupation, not your health, and providing it is always optional.
Account information — your username, password (stored in encrypted form, never in plain text), saved addresses, order history, wishlist and saved payment preferences.
Technical information — your IP address, browser type and version, device type, device identifiers, operating system, time zone and language settings, and app version.
Usage information — how you move through our website and app: pages and products viewed, searches run, items added to cart, referring page, and how you arrived at our site.
Marketing and communications information — your preferences for receiving marketing from us, the channels you have agreed to, your engagement with our emails and messages, and a record of when and how you gave or withdrew consent.
Customer service information — the content of messages, emails, chats and calls between you and our team, including complaints and their resolution.
CCTV footage — images captured in and immediately around our retail branches and warehouse. See section 15.
Recruitment information — where you apply to work with us: your CV, cover letter, employment and education history, references, and right-to-work documentation.
5.3 We also produce aggregated information — statistical or demographic data such as the percentage of visitors who use a particular feature. Aggregated information is not personal information because it cannot identify you. If we ever combine aggregated information with information that does identify you, we treat the combined set as personal information under this Notice.
6. Information we do not collect
6.1 We do not seek special category information. We do not ask for, and do not want, information about your health, race or ethnicity, religious or philosophical beliefs, political opinions, trade union membership, sex life or sexual orientation, genetic or biometric data, or criminal convictions. Please do not send us this kind of information. If you do send it to us unprompted — for example in a customer service message — we will delete it unless we are legally required to retain it.
6.2 We do not collect or store payment card details. Orders are paid by cash on delivery, so no card information is collected at any point — not on our website, not in our apps, and not in our branches. If we introduce an online payment method in future, payment will be handled entirely by a payment provider on their own systems, we will never receive or store your full card number, and we will update this Notice before that change takes effect.
7. How we collect your information
7.1 Directly from you , when you:
- place an order on our website, in our app, or in one of our branches;
- create an account or update your account details;
- ask us to notify you when a product is back in stock;
- subscribe to our emails or agree to receive WhatsApp messages from us;
- submit our contact form, which asks for your name, email address, telephone number, governorate and — where relevant — your order number;
- contact us by email, telephone, WhatsApp, Instagram or Facebook;
- return or exchange an item, or make a warranty claim;
- enter a competition, giveaway, promotion or survey;
- leave a product review or send us a photograph of yourself wearing our products;
- apply for a job with us.
7.2 Automatically , as you use our website and app. We collect technical and usage information through cookies, similar technologies and server logs. Section 9 explains this in detail.
7.3 From third parties , in a limited set of cases:
- our delivery partners tell us the outcome of a delivery attempt and may update an address or telephone number that turned out to be incorrect;
- Meta and Google provide aggregated advertising measurement, and — where you have permitted it on their platforms — tell us that an advertisement led to a visit or purchase;
- Apple and Google provide app installation and crash information;
- if you contact us through Instagram or Facebook, we receive the profile name and any information you send in your message.
7.4 We may ask you to verify your identity before we act on a request about your personal information. This protects you: it stops someone else obtaining or deleting your data by pretending to be you.
8. How and why we use your information
8.1 We use your personal information only where we have a lawful reason to do so. The table below sets out what we do, and why we are permitted to do it.
Create and manage your account, and let you sign in across our website and apps
Why we are permitted to do it: Performance of our contract with you
Take, process, pack and deliver your order, including passing your details to a courier and collecting payment on delivery
Why we are permitted to do it: Performance of our contract with you
Send you transactional messages about an order you have placed — order confirmation, dispatch, delivery, delay and collection notices — by email, SMS or WhatsApp
Why we are permitted to do it: Performance of our contract with you
Handle returns, exchanges, refunds and warranty claims
Why we are permitted to do it: Performance of our contract with you; compliance with consumer protection obligations
Answer your questions and resolve complaints
Why we are permitted to do it: Performance of our contract with you; our legitimate interest in running a business customers can rely on
Keep accounting, tax and stock records
Why we are permitted to do it: Compliance with a legal obligation
Detect and prevent fraud, non-genuine orders, abuse of promotions, and repeated refusal of cash-on-delivery orders
Why we are permitted to do it: Our legitimate interest in protecting the business from loss, and in keeping prices fair for customers who do complete their orders
Operate, secure, test, troubleshoot and improve our website, apps and internal systems
Why we are permitted to do it: Our legitimate interest in running a secure and reliable service
Understand how customers use our site and app, and which products and pages perform well
Why we are permitted to do it: Our legitimate interest in improving what we offer; your consent where this relies on non-essential cookies
Send you marketing about products, offers, new arrivals and events by email or WhatsApp
Why we are permitted to do it: Your consent, which you can withdraw at any time
Show you advertising on Meta and Google platforms, and measure whether it worked
Why we are permitted to do it: Your consent through our cookie and tracking settings
Publish a review, testimonial or customer photograph you have sent us
Why we are permitted to do it: Your consent, given at the point you send it
Operate CCTV at our branches and warehouse
Why we are permitted to do it: Our legitimate interest in the safety of customers and staff, and the prevention and detection of crime
Assess your application to work with us
Why we are permitted to do it: Steps taken at your request before entering into a contract; compliance with employment law obligations
Respond to a lawful request from a court, regulator or law enforcement body
Why we are permitted to do it: Compliance with a legal obligation
8.2 We may rely on more than one basis for the same activity. If you would like to know which basis applies to a particular use of your information, contact us and we will tell you.
8.3 We do not make decisions about you by automated means alone that produce a legal or similarly significant effect. Where we flag an order for manual review — for example because of a delivery history that suggests a risk of non-collection — a member of our team makes the final decision, and you can ask us to review it.
8.4 If we ever want to use your information for a purpose not described here, we will tell you first, and where consent is required we will ask for it before we proceed.
9. Cookies, tracking and advertising
9.1 What we use. Our website and app use cookies and similar technologies — including pixels, tags, software development kits and local storage — in four categories:
- Strictly necessary. These make the site work: keeping you signed in, remembering the contents of your cart, routing you to the right regional content, and protecting against fraudulent activity. The site cannot function without them, so they are always on.
- Preferences. These remember choices you have made, such as your language and the currency you view prices in.
- Analytics. These tell us how many people visit, which pages and products they view, and where they leave the checkout, so we can fix what is not working.
- Advertising. These allow us to show you our products on Meta platforms (Facebook and Instagram) and on Google, and to measure whether an advertisement led to a visit or a purchase. They involve sharing information about your activity with those platforms.
9.2 Your control. Analytics and advertising technologies are not essential, and you can decline them. You can manage your choices through the cookie preferences control on our website, and change them at any time. You can also block or delete cookies through your browser settings, and reset or limit your advertising identifier in your mobile device settings. Blocking strictly necessary cookies will stop parts of the site from working.
9.3 Advertising platforms. We advertise on Meta and Google. Where you have permitted advertising technologies, information about your activity on our site — such as products viewed and purchases completed — is shared with those platforms so that our advertising reaches people likely to be interested and so we can measure results. Those platforms act as independent controllers of the information they receive and process it under their own privacy policies. You can control how they use your information through Meta's Ad Preferences and Google's My Ad Center.
9.4 Do Not Track. Most browsers offer a Do Not Track (DNT) setting. There is still no agreed technical standard for how websites should interpret DNT signals, and we do not currently respond to them. We honour your privacy choices through our cookie preferences control instead, which gives you clearer and more specific control than a DNT signal does. If a recognised DNT standard is adopted, we will support it and update this Notice.
9.5 Our mobile apps. Our iOS and Android apps collect the technical and usage information described in section 5, together with crash and performance diagnostics. Our apps do not track you across other companies' apps and websites. If we ever introduce such tracking on iOS, we will ask your permission first through Apple's App Tracking Transparency prompt, and you will be free to decline. The disclosures we make in Apple's App Privacy labels and Google Play's Data Safety section are consistent with this Notice.
10. Marketing, WhatsApp and your choices
10.1 Transactional messages. When you place an order, we send you messages about that order — confirmation, dispatch, delivery arrangements and collection. These are part of fulfilling your order rather than marketing, and you will receive them for as long as your order is active.
10.2 Marketing messages. We send marketing only where you have opted in. We will never add you to a marketing list simply because you bought something from us or gave a member of staff your number in a branch.
10.3 WhatsApp. Where you have opted in, we use the WhatsApp Business Platform to send you order updates and, separately, marketing messages. When we ask for this consent we will identify ourselves as Medico Store, state that the messages will arrive on WhatsApp specifically, and tell you what kinds of messages you will receive. Your consent to order updates is separate from your consent to marketing, and agreeing to one does not sign you up to the other. Your telephone number and message content are processed by WhatsApp, which is part of Meta, under Meta's own terms and privacy policy.
10.4 Stopping messages. You can opt out at any time, at no cost, by:
- clicking the unsubscribe link in any marketing email;
- replying STOP to any WhatsApp or SMS marketing message;
- changing your preferences in your account settings; or
- contacting us using the details in section 18.
10.5 Withdrawing consent stops future marketing. It does not affect anything we lawfully did before you withdrew it, and it does not stop messages about an order that is already in progress.
11. Who we share your information with
11.1 We share personal information only where we need to, and only with parties who are contractually bound to protect it. We do not sell your personal information , and we do not share it with third parties for their own independent marketing.
11.2 The categories of recipient are:
E-commerce platform and hosting. Our online store and apps run on Shopify, which hosts our store data and processes orders on our instructions. Shopify's handling of information is governed by its own privacy policy in addition to this Notice.
Delivery and courier partners. To get an order to you, we give the courier your name, delivery address, telephone number, order contents where required, and — for cash-on-delivery orders — the amount to collect. They need this to reach you; they may contact you directly to arrange delivery.
Payment providers. Where an online payment method is used, the provider receives the information needed to process the payment. As explained in section 6.2, we do not receive or store your full card details.
Messaging and communications providers. The platforms we use to send email, SMS and WhatsApp messages process your contact details and message content in order to deliver those messages on our behalf.
Advertising, analytics and measurement partners. Meta and Google, as described in section 9, together with the analytics tools we use to understand site and app performance.
Technology and business service providers. The suppliers who host, maintain, secure and support our website, apps and internal systems, including our warehouse and order management software, and providers of customer service and review tools.
Professional advisers. Our accountants, auditors, insurers and lawyers, where they need the information to advise us.
Authorities. Courts, regulators, tax authorities and law enforcement, where we are legally required to disclose information or where disclosure is necessary to establish, exercise or defend legal claims, or to prevent fraud or crime. We assess each request individually and disclose only what is genuinely required.
Business partners in a corporate transaction. If our business is sold, restructured or merged in whole or in part, customer information may transfer to the acquiring party. We would tell you before this happened, and the acquirer would remain bound by this Notice.
11.3 Where we engage a service provider, we give them only the information they need for the specific task, we require them by contract to use it only on our instructions and to keep it confidential and secure, and we require them to delete or anonymise it when our relationship ends.
12. International transfers of your information
12.1 Because we operate in Iraq using international technology providers, and because our legal entity is registered in the United States, your personal information will be transferred to and stored on servers outside Iraq — principally in the United States and the European Union.
12.2 In particular, our store platform, hosting, messaging, advertising and analytics providers all operate infrastructure outside Iraq.
12.3 Where we make such a transfer, we require the recipient to apply protections equivalent to the standards described in this Notice. For providers established in or transferring from the European Economic Area or the United Kingdom, we rely on the European Commission's Standard Contractual Clauses, the UK International Data Transfer Addendum, or a relevant adequacy decision, as applicable to that provider.
13. How long we keep your information
13.1 We keep personal information only for as long as we need it for the purpose we collected it, plus any period we are legally required to retain it. In practice:
Order and transaction records
How long we keep it: 7 years from the date of the order, to meet accounting and tax obligations
Customer account information
How long we keep it: For as long as your account is open, and for 3 years after your last order or sign-in, after which we delete or anonymise it
Returns, exchange and warranty records
How long we keep it: 2 years from the date the claim is closed
Customer service correspondence
How long we keep it: 3 years from the date the matter is closed
Marketing preferences and consent records
How long we keep it: For as long as you remain opted in, and for 2 years after you withdraw consent so we can demonstrate that we honoured your withdrawal
Website and app analytics
How long we keep it: Up to 26 months
CCTV footage
How long we keep it: 30 days, unless a specific recording is needed for an ongoing investigation or legal claim
Job applications from unsuccessful candidates
How long we keep it: 12 months, so we can consider you for future roles, unless you ask us to delete it sooner
Fraud and non-collection records
How long we keep it: 3 years from the last incident
13.2 At the end of the applicable period we securely delete the information, or anonymise it so that it can no longer identify you and can be used only for statistics and business planning.
14. How we protect your information
14.1 We use technical, organisational and physical measures to guard against the loss, misuse, unauthorised access, alteration or disclosure of your personal information. These include:
- Technical measures — encryption of traffic to and from our website and apps using HTTPS/TLS; encryption of passwords so that no one, including our own staff, can read them; role-based access controls in our internal systems; rate limiting and protection against automated attacks; and logging of administrative activity.
- Organisational measures — access granted strictly on a need-to-know basis, confidentiality obligations for staff and contractors, security and data protection training, and contractual security requirements imposed on our suppliers.
- Physical measures — controlled access to our branches, warehouse and offices, secure storage of paper records, and alarm and CCTV systems.
14.2 We review our systems for vulnerabilities and address weaknesses that we identify.
14.3 We have procedures in place to deal with a suspected data breach. If a breach occurs that is likely to pose a significant risk to you, we will tell you and any authority we are required to notify.
14.4 No system is completely secure, and the transmission of information over the internet always carries some risk. Please help us protect your account by using a strong, unique password, and by never sending sensitive information such as passwords or full card numbers to us by email or social media message.
15. CCTV at our branches
15.1 We operate CCTV in and around our retail branches and our warehouse. Signage is displayed where cameras are in use.
15.2 We use CCTV to protect the safety of customers and staff and to prevent and detect crime. We do not use it to monitor individual customers, and we do not use facial recognition or any other biometric analysis of the footage.
15.3 Footage is stored securely, access is restricted to authorised personnel, and recordings are retained for 30 days and then overwritten, unless a specific recording is required for an ongoing investigation or legal claim.
15.4 You can request a copy of footage in which you appear. Contact us using the details in section 18, telling us the branch, the date and approximate time. We may need to obscure other people who appear in the footage in order to protect their privacy.
16. Job applicants
16.1 When you apply to work with us, we process the information in your application, our assessment of it, the outcome of any interview, and — where relevant — references and documentation confirming your right to work.
16.2 We use this information only to assess your suitability for the role and to meet our obligations as an employer. We do not use it for marketing.
16.3 If you tell us about a disability or health condition so that we can make adjustments to the recruitment process, we use that information only for that purpose and delete it once it is no longer needed.
16.4 If your application is unsuccessful, we keep it for 12 months in case a suitable role arises, then delete it. You can ask us to delete it sooner at any time.
17. Your rights
17.1 You have the following rights over the personal information we hold about you:
- Access — to be told whether we hold information about you and to receive a copy of it.
- Correction — to have inaccurate information corrected and incomplete information completed.
- Erasure — to have your information deleted where we no longer have a good reason to keep it.
- Restriction — to ask us to pause our use of your information while a concern is investigated.
- Objection — to object to our use of your information where we rely on legitimate interests, and to object at any time to direct marketing.
- Portability — to receive the information you gave us in a structured, commonly used, machine-readable format, and to have it sent to another provider where technically feasible.
- Withdrawal of consent — to withdraw consent at any time where we rely on it, without affecting anything we lawfully did beforehand.
17.2 How to exercise them. Use the contact form in section 18, or speak to us at any branch. Tell us which right you want to exercise and give us enough detail to find your records. Exercising your rights is free. We may ask you to verify your identity first.
17.3 Our response time. We aim to respond within 30 days. If your request is complex or you have made several requests, it may take us longer — in that case we will tell you within 30 days and keep you updated.
17.4 Limits. These rights are not absolute. We may not be able to delete information we are legally required to keep, such as transaction records needed for tax purposes, or information we need to establish or defend a legal claim. If we cannot fully meet a request, we will explain why. If a request is clearly unfounded or excessive, we may charge a reasonable fee or decline it, and we will tell you if we do.
17.5 Closing your account. You can close your account at any time through your account settings or by contacting us. We will deactivate it and delete the associated information, other than what we must retain under section 13.
17.6 If you are in California. California residents have specific rights under California law, including the right to know what personal information we collect and how we use and disclose it, the right to request deletion, the right to correct inaccurate information, and the right not to be discriminated against for exercising those rights. We do not sell or share personal information for cross-context behavioural advertising in the sense used by California law, and we have not done so in the preceding twelve months. To exercise these rights, contact us using the details below.
18. Contact us and how to complain
18.1 If you have a question, a concern, or wish to exercise any of your rights, please use our contact form. It reaches our team directly and is the fastest route to a response.
- Legal entity: Medico Store LLC
- Contact form: medicostoreiq.com/pages/contact — please write "Privacy request" in your message so we route it correctly
- WhatsApp / Telephone: +964 783 555 5005
- Or in person: at any of our branches listed in section 3.2
18.2 If you are not satisfied with our response, tell us and we will escalate your concern internally and respond again. We would always rather hear from you directly and put something right than have you go elsewhere first.
18.3 You also have the right to complain to the data protection authority in your country, where one exists.
18.4 Please do not send passwords, full payment card numbers or other sensitive information by email or social media message, as these channels are not encrypted end to end.
19. Children
19.1 Our products, website and apps are intended for adults, principally healthcare professionals and students. They are not directed at children.
19.2 We do not knowingly collect personal information from anyone under the age of 16. If you believe a child has given us their information, contact us and we will delete it promptly.
20. Links to other websites
20.1 Our website and apps contain links to other websites and services, including brand partners and social media platforms. This Notice does not apply to them.
20.2 We do not control those sites and are not responsible for their content or their privacy practices. When you leave our site, we encourage you to read the privacy notice of any site you visit before giving it your information.
21. Keeping your information accurate
21.1 We take reasonable steps to keep the information we hold accurate, complete and current.
21.2 Please help us by telling us when your details change — particularly your telephone number and delivery address, as an out-of-date number or address is the most common reason an order fails to reach a customer. You can update your details in your account or by contacting us.
CONTACT US
If you have questions or comments about this Privacy Policy, please contact us.
