Privacy Policy

1. Scope and data controller

This policy applies to coralpharmaceuticals.com, website enquiries, and personal information received through related telephone, email, postal, or in-person communications where Coral Pharmaceuticals Limited determines why and how that information is processed.

For these activities, Coral Pharmaceuticals Limited is the data controller under the Bahamas Data Protection (Privacy of Personal Information) Act, 2003 (opens in a new tab).

This policy does not govern independent websites, businesses, healthcare providers, pharmacies, manufacturers, or other third parties that may be linked from our website or separately involved in a transaction.

2. Personal information we handle

Information you choose to provide

Depending on how you contact or do business with us, this may include:

• your name and organization;
• business or personal contact details, including telephone number, email address, and postal address;
• the product, service, branch, or business need you ask about;
• the content of messages, correspondence, quotations, orders, service requests, complaints, and other communications;
• information needed to establish or manage a customer, supplier, or professional relationship; and
• records needed to meet legal, regulatory, accounting, safety, quality, or dispute-management obligations.

Technical website information

When you request a page or file, our web server and infrastructure providers may record technical information such as your Internet Protocol address, request date and time, requested URL, response status, browser or device information, referring page, and security or error events. We use this information to deliver, secure, troubleshoot, and maintain the website.

Sensitive and patient information

Please do not send prescriptions, diagnoses, medical records, patient identifiers, payment-card details, passwords, or other sensitive information through the public website or a general enquiry. The website is not a patient portal, prescribing service, or secure clinical-messaging system. If sensitive information is necessary for a lawful business or professional purpose, contact the appropriate branch first so an authorized method can be arranged.

Information we do not currently collect through the website

The website does not currently provide user accounts, online ordering, prescription uploads, payment processing, behavioural advertising, analytics tracking, or automated decisions about individuals.

3. Why we use personal information

We process personal information only for specified and lawful purposes, which may include:

• providing the website and responding to requests;
• communicating about products, services, quotations, availability, and branch operations;
• establishing and managing customer, supplier, contractor, and professional relationships;
• processing and administering transactions that are agreed outside this public website;
• maintaining product quality, safety, traceability, regulatory, accounting, and business records where applicable;
• protecting the website, our systems, personnel, customers, and property against misuse, fraud, security incidents, or unlawful activity;
• complying with legal duties, lawful requests, court orders, and regulatory requirements;
• establishing, exercising, or defending legal rights; and
• producing aggregated or de-identified operational information that does not identify individuals.

We will not use personal information in a manner incompatible with the purpose for which it was collected unless the use is authorized by law, reasonably expected in the circumstances, or you have been properly informed and any required consent has been obtained.

Direct marketing

We do not currently operate an email-marketing programme through this website. If that changes, marketing communications will identify the sender and provide a reasonable way to opt out. A written request to stop direct marketing will be handled in accordance with applicable Bahamian law.

4. Sharing and disclosure

We do not sell or rent personal information. We may disclose limited information where reasonably necessary to:

• authorized employees, branches, and representatives who need it to perform their duties;
• hosting, information-technology, communications, security, records-management, accounting, professional, delivery, and other service providers acting for us;
• manufacturers, suppliers, customers, healthcare-sector counterparties, or logistics providers where disclosure is necessary for a requested or agreed business activity and is lawful;
• legal, accounting, insurance, audit, and other professional advisers;
• courts, regulators, law-enforcement bodies, public authorities, or other persons where disclosure is required or permitted by law, necessary to protect health or safety, or necessary to establish or defend legal rights; and
• a successor or proposed successor in connection with a reorganization, financing, merger, acquisition, or transfer of all or part of the business, subject to appropriate confidentiality and data-protection safeguards.

Service providers and other processors are expected to use personal information only for authorized purposes, maintain appropriate security, and provide a comparable level of protection through contractual or other lawful safeguards.

5. Processing outside The Bahamas

Website hosting, technical support, communications, or other service providers may process limited personal information outside The Bahamas. External resources such as Google Fonts may also involve requests to servers outside The Bahamas.

Where personal information is transferred for processing outside The Bahamas, we will take reasonable steps appropriate to the circumstances to require protection comparable to Bahamian law, including contractual, technical, organizational, consent-based, or other lawful safeguards. Transfers may also occur where required or authorized by law.

6. How long we keep information

We keep personal information only for as long as reasonably necessary for the purpose for which it was collected and for any related legal, regulatory, accounting, quality, safety, contractual, or dispute-resolution requirement.

Retention periods vary by record. In deciding how long to keep information, we consider the nature and sensitivity of the information, the relationship and transaction involved, legal and regulatory duties, product-safety or traceability needs, limitation periods, security needs, and whether the information can be securely deleted or de-identified. When information is no longer required, we take reasonable steps to erase, destroy, anonymize, or securely archive it as appropriate.

7. Security and incident response

We use reasonable administrative, technical, and physical safeguards appropriate to the information and risk. These may include encrypted website connections, access restrictions, authentication controls, system maintenance, backups, logging, staff responsibilities, and service-provider controls.

No Internet transmission or storage method can be guaranteed completely secure. If we become aware of a suspected security incident involving personal information, we will investigate, contain, and remediate it as appropriate and make any notification required by applicable law or a competent authority.

8. Your privacy rights

Subject to the Data Protection (Privacy of Personal Information) Act, 2003 and its exceptions, you may make a written request to:

• ask whether we hold personal data relating to you and obtain a copy in intelligible form;
• have personal data rectified or, where appropriate, erased if it is handled contrary to the Act;
• ask us to stop using personal data for direct marketing; and
• raise a concern about how your personal information has been collected, used, kept, secured, or disclosed.

The Act generally provides a 40-day period for responding to qualifying access, correction, erasure, and direct-marketing requests. We may ask for reasonable information to verify your identity, locate the relevant records, protect another person’s information, and determine whether an exception applies. If a request is refused, we will provide the response required by applicable law.

To exercise a right, send a written request marked “Privacy Request” using the contact information below. Describe the information or action requested, the relevant relationship or dates, and the branch involved. Do not send original identity documents unless specifically requested through a secure method.

9. Children’s information

This public business website is not directed to children and is not designed to collect personal information from them. A parent or guardian who believes a child has provided personal information to us should contact us so we can investigate and take appropriate action.

10. Cookies, Google services, and external links

Cookies and local storage

Coral Pharmaceuticals does not currently set first-party cookies, use browser local storage, or operate analytics or advertising trackers on this website. If that changes, this policy and any consent controls required by applicable law will be updated before the technology is activated.

Google Fonts

The site requests typefaces from Google Fonts. Your browser therefore connects to Google-operated servers and may transmit technical request information such as your IP address and browser details. Google handles that information under its own privacy policy (opens in a new tab).

Google Maps and other external websites

Directions links open Google Maps only when you choose them. Other external links may take you to independent websites. Those third parties control their own services and privacy practices, and their policies apply once you visit them.

11. Changes to this policy

We may update this policy to reflect changes in the website, our practices, service providers, or applicable law. The revised policy will be posted here with a new “Last updated” date. If a change materially affects how previously collected personal information is used, we will take any additional notice or consent steps required by law.

12. Contact us or make a complaint

Please direct privacy questions, written rights requests, or complaints to Coral Pharmaceuticals Limited at either branch:

We encourage you to contact us first so we can address your concern. You may also complain in writing to the Office of the Data Protection Commissioner (opens in a new tab). The Office’s published complaint guidance lists dataprotection@bahamas.gov.bs and P.O. Box N-3017, Nassau, New Providence, The Bahamas.