When you tap “buy” on a medicine app, you are not simply making a purchase. You are placing your health — and your trust — in the hands of a system you cannot see.
Medicine By App And Its Implications
The seller might be licensed. The medicine might be genuine. The delivery rider might handle the package with care. Or none of these things might be true.
And in that gap between what you hope is happening and what is actually happening, your dignity as a patient hangs in the balance.
Nigeria’s new Electronic Pharmacy Regulations 2026 attempt to close that gap. Published in the Federal Gazette in February and formally launched in April, the rules provide a legal framework for online pharmacies, digital medicine platforms, and businesses that connect customers with pharmacy providers.
The ambition is important. Digital services can bring medicines and professional advice closer to people — including those who struggle to reach a pharmacy. But convenience must never come at the cost of safety or human dignity.
What The Law Requires
The Regulations set a basic standard for who may sell medicines online.
Providers must register and obtain a licence from the Pharmacy Council of Nigeria (PCN), with professional oversight through a designated Superintendent Pharmacist.
A platform that merely connects customers to multiple pharmacies — an aggregator — is not exempt. Aggregators must also be registered and licensed.
This matters because a seller’s presence on a familiar app, or the display of a pharmacist’s name, should not be treated as proof of a current licence. Appearance is not the same as authorisation.
That is why a clear way to check credentials is essential. The Regulations require online pharmacy sites to display:
The responsible pharmacist’s registration and licensing status
The linked pharmacy premises
The e-pharmacy licence number
Contact details
A route for complaints
Customers should look for these details — and ask questions when they are missing or unclear. The PCN, in turn, must make it easy for the public to confirm that the details are genuine.
Prescription Is Not A Formality
The Regulations put professional judgment back into the digital transaction.
A prescription-only medicine cannot lawfully be dispensed without a valid prescription. That prescription must identify the patient, the medicine, and the prescriber — including relevant professional registration and contact details.
A scanned written prescription may be accepted. Prescriptions arising from remote consultations are also permitted, provided the prescriber is authorised and the prescription meets the required standards.
A pharmacist must be available online for counselling. And the same prescription must not be dispensed repeatedly as if it were a new order. Any refill remains subject to the prescriber’s directions.
These are not bureaucratic hurdles. They are safeguards against the quiet erosion of medical oversight — the difference between pharmacy and mere commerce.
Delivery Is A Health Issue
Medicines are not ordinary packages.
The Regulations require that medicines be stored and transported at the appropriate temperature, handled according to good distribution practices, and delivered in tamper-evident packaging.
The provider must keep a traceable record of the order through delivery, including proof of receipt, and supply clear labels and instructions. These duties do not disappear when a business contracts a courier or delivery platform.
If a medicine is expired, or its package appears tampered with or mishandled, the customer is entitled to return it within a reasonable time. An expired returned medicine must not be put back into stock.
That is a meaningful protection. But it should not be overstated.
The Regulation provides a right to return in these circumstances; it does not expressly promise a general refund.
The Data Question: Who Can See Your Health Information?
The harder question is what happens to your information.
Under the Regulations, online drug orders are to pass through a National Electronic Pharmacy Platform (NEPP) linked to the systems of providers and aggregators. A user registers with an accepted form of identification and receives a unique number connected to their medication history.
An e-pharmacy may access that history only with the user’s explicit consent. Access to electronic health records also requires explicit consent.
The rules further require safeguards such as data minimisation, encryption, secure storage, access controls, and audit trails.
There is a practical benefit to a central system. It could help verify prescribers, trace medicine orders, and support oversight. But it also concentrates sensitive details: your identity, the medicines you request and receive, your prescriptions, and possibly consultation information.
A digital record may make care more coordinated. It may also make a privacy failure more damaging.
Both sides of that balance deserve attention.
The Regulations say that users may decline participation or disenrol from the platform, and may withdraw consent to the use of their data in telehealth interactions.
The Nigeria Data Protection Act 2023 also treats health status as sensitive personal data. It gives people rights that include access to and correction of their information, objection to processing, and the right to complain to the Nigeria Data Protection Commission.
When a breach is likely to create a risk to people’s rights, the data controller must notify the Commission within 72 hours. A breach creating a high risk must also be communicated to affected people.
These are strong protections on paper.
But here is the practical question: the Regulations also make the central platform the required route for online orders. So how, in practice, can someone who declines participation — or later disenrols — continue to obtain medicine online?
Does opting out mean refusing access to a medication history? Or leaving the platform altogether?
The law’s protections will mean little to patients unless the PCN explains, in plain language, what each choice does — and how privacy can be preserved without shutting people out of digital pharmacy services.
Three Gaps That Demand Answers
The Regulations are a significant step. But three gaps deserve urgent attention.
First, the public information gap. As of the PCN materials reviewed for this column, the Council’s website lists the new Regulations and general registration resources — but a dedicated public guide explaining how consumers use the central platform, and a public directory of licensed e-pharmacies and aggregators, could not be located.
That does not establish that the platform is not operating, or that no internal process exists. But it points to a public-information gap that should be closed. The regulator should publish a current register or practical verification method.
Second, the opt-out gap. Users may decline participation. But how does a person who opts out continue to obtain medicine online? The Regulations must be accompanied by clear guidance.
Third, the children’s gap. The rules require providers to ensure services are supplied to adults only. How, then, should a parent or caregiver order medicine online for a child?
The public needs a clear answer that protects children while allowing responsible adults to arrange legitimate care.
What You Can Do Now
Until the regulator closes these gaps, customers can take practical steps.
Check the licence. Look for the pharmacy’s PCN licence details and the responsible pharmacist’s registration.
Keep records. If a medicine looks suspicious, is expired, or arrives in damaged packaging, keep the packaging, order record, and receipt.
Report concerns. NAFDAC’s Med Safety App accepts reports about suspected substandard or falsified medicines and adverse drug reactions. The NAFDAC complaints line is 0800-1-NAFDAC (0800-1-623322).
Seek urgent care. If you experience serious symptoms, do not wait for an online resolution. Seek prompt medical attention.
The Dignity Question
Online pharmacy can be a genuine service to patients. The 2026 Regulations provide important safeguards: licensed oversight, prescription checks, counselling, safe handling, and a route to return certain unsafe medicines.
But a law on paper is only the beginning.
The dignity question is this: Can a patient exercise meaningful choice when they cannot verify the seller, understand the data trail, or know who to turn to when something goes wrong?
The measure of success is not how many platforms are licensed. It is whether a patient can order medicine with confidence — and receive it with safety and dignity.
Before a customer clicks “buy,” the law should make it possible to answer three simple questions:
Is this pharmacy authorised?
Will my medicine reach me safely?
Who can see my health information?
Building public trust means ensuring that the answers are just as clear as the app is convenient.
Know Your Rights
Licensing: Online pharmacies and aggregators must be licensed by the PCN. Check for the licence number and responsible pharmacist.
Prescription: Prescription-only medicines cannot be dispensed without a valid prescription from a licensed Nigerian practitioner.
Data: Your health data is protected under the NDPA 2023. You have the right to access, correct, and request deletion of your data.
Breach notification: Data controllers must notify the NDPC within 72 hours of a breach likely to create a risk to your rights.
Returns: You may return expired or tampered medicines within a reasonable time.
Complaints: Report suspected substandard medicines to NAFDAC via the Med Safety App or 0800-1-NAFDAC.
•Sanu is a Nigerian lawyer and health law scholar. This column breaks down complex health laws for everyday Nigerians.
