Privacy Policy

At drugIndia (operated by Rayax Drug India Pvt. Ltd.), we are committed to protecting your privacy and ensuring the security of your personal information. This Privacy Policy explains how we collect, use, disclose, and safeguard your information when you use our website, mobile application, and services.

Information We Collect

Personal Information You Provide

When you use our Services, you may provide us with the following personal information: - Account Information: Name, phone number, email address, password - Identity Verification: Date of birth, gender (optional) - Delivery Information: Shipping addresses, pin codes, landmark details - Payment Information: UPI ID, card details (processed securely via payment gateways - we do not store full card numbers) - Health Information: Prescriptions, medical conditions (only when voluntarily uploaded for prescription verification) - Communication Data: Messages sent to customer support, feedback, reviews

Information Collected Automatically

When you access our Services, we automatically collect: - Device Information: Device type, operating system, unique device identifiers, browser type - Log Data: IP address, access times, pages viewed, app crashes, referring URLs - Location Data: Approximate location based on IP address or precise location (with your consent) for delivery services - Usage Data: Features used, products viewed, search queries, purchase history - Cookies & Similar Technologies: Session cookies, persistent cookies, pixels, and local storage (see our Cookie Policy)

Information from Third Parties

We may receive information from: - Payment Processors: Transaction status, payment confirmation - Delivery Partners: Delivery status, delivery confirmation - Analytics Providers: Aggregated usage statistics - Social Media Platforms: If you choose to link your social accounts

How We Use Your Information

Providing & Improving Services - Process and fulfill your orders for medicines and healthcare products - Verify prescriptions through our licensed pharmacists - Deliver products to your specified address - Process payments and refunds - Provide customer support and respond to inquiries - Personalize your experience with relevant product recommendations - Improve our website, app, and services based on usage patterns

Communication - Send order confirmations, shipping updates, and delivery notifications via SMS and email - Share important service announcements and policy updates - Send promotional offers and discounts (with your consent) - Respond to your questions and feedback - Send medicine reminders (if you opt-in to this feature)

Safety & Compliance - Verify your identity and prevent fraud - Ensure compliance with pharmaceutical regulations - Maintain records as required by the Drugs and Cosmetics Act, 1940 - Detect and prevent illegal activities - Enforce our Terms of Service - Comply with legal obligations and respond to lawful requests

Legal Basis for Processing (DPDPA 2023)

Under the Digital Personal Data Protection Act, 2023, we process your data based on: - Consent: For marketing communications, location access, and optional features - Contract Performance: To fulfill orders and provide requested services - Legal Obligations: To comply with pharmaceutical regulations and tax laws - Legitimate Interests: To improve services, prevent fraud, and ensure security

How We Share Your Information

Service Providers

We share information with trusted third parties who assist in operating our Services: - Payment Processors: Razorpay, PayU, and other payment gateways for secure transaction processing - Delivery Partners: Logistics companies for order delivery (name, address, phone number) - Cloud Services: AWS, Google Cloud for secure data storage and processing - Analytics Providers: Google Analytics for understanding usage patterns (anonymized data) - Communication Services: SMS and email service providers for notifications - Customer Support Tools: Helpdesk software for managing support tickets

Healthcare Partners - Licensed Pharmacists: For prescription verification and dispensing - Health Advisors: For consultation services (only when you request a consultation) - Diagnostic Partners: If you use any diagnostic services through our platform

All healthcare partners are bound by strict confidentiality obligations and medical ethics.

Legal & Regulatory Disclosure

We may disclose your information when required by law: - To comply with legal processes, court orders, or government requests - To regulatory authorities including Drug Controller General of India (DCGI) - To law enforcement agencies in case of suspected illegal activities - To protect the rights, property, or safety of drugIndia, our users, or others - In connection with mergers, acquisitions, or sale of assets (with notice to you)

We Do NOT Sell Your Data

drugIndia does not sell, rent, or trade your personal information to third parties for their marketing purposes. We only share data as described in this policy to provide and improve our Services.

How We Protect Your Information

Technical Safeguards - Encryption: All data transmitted between your device and our servers is encrypted using TLS 1.3 - Secure Storage: Personal data is stored in encrypted databases with access controls - Payment Security: We are PCI-DSS compliant and do not store full credit card numbers - Regular Audits: Periodic security assessments and vulnerability testing - Intrusion Detection: 24/7 monitoring for unauthorized access attempts - Secure Infrastructure: Data hosted on enterprise-grade cloud platforms with physical security

Organizational Safeguards - Access Controls: Only authorized personnel can access personal data on a need-to-know basis - Employee Training: Regular privacy and security training for all staff - Confidentiality Agreements: All employees and contractors sign NDAs - Vendor Assessment: Third-party vendors are evaluated for security compliance - Incident Response: Documented procedures for handling data breaches

Data Retention

We retain your personal information for as long as necessary to: - Maintain your account and provide services - Comply with legal obligations (e.g., 3-5 years for pharmaceutical records) - Resolve disputes and enforce agreements - Meet tax and accounting requirements

When data is no longer needed, we securely delete or anonymize it.

Breach Notification

In the event of a data breach that poses a risk to your rights and freedoms, we will: - Notify the Data Protection Board of India within 72 hours as required by DPDPA 2023 - Inform affected users without undue delay - Take immediate steps to contain and remediate the breach - Document the incident and corrective actions taken

Your Privacy Rights

Rights Under DPDPA 2023

As a Data Principal under the Digital Personal Data Protection Act, 2023, you have the right to: - Right to Access: Request a summary of your personal data and how it's being processed - Right to Correction: Request correction of inaccurate or incomplete data - Right to Erasure: Request deletion of your personal data (subject to legal retention requirements) - Right to Grievance Redressal: Lodge complaints about data processing - Right to Nominate: Nominate another person to exercise your rights in case of death or incapacity

Additional Rights - Withdraw Consent: You can withdraw consent for optional data processing at any time - Opt-out of Marketing: Unsubscribe from promotional communications - Data Portability: Request your data in a commonly used format - Object to Processing: Object to certain types of data processing - Restrict Processing: Request limitation of processing in certain circumstances

How to Exercise Your Rights

To exercise any of these rights, you can: - Use the privacy settings in your account dashboard - Email us at privacy@drugindia.com with your request - Contact our Grievance Officer (details below)

We will respond to your request within 30 days. We may ask for identity verification before processing your request.

Grievance Officer

In accordance with DPDPA 2023 and IT Act 2000, our Grievance Officer is:

Mr. Shekhar Kumar Mishra GM – Operations Rayax Drug India Pvt. Ltd.

Email: grievance@drugindia.com Phone: +91 93119 22135

Address: 13P, Captain Ganpat Ram Yadav Marg, Block D, Indira Colony, Sector 52, Gurgaon, Haryana, India – 122003

Response Time: Within 30 days of receiving your complaint

Children's Privacy

Age Restriction

Our Services are not intended for individuals under 18 years of age. We do not knowingly collect personal information from children under 18.

If you are a parent or guardian and believe your child has provided us with personal information, please contact us immediately at privacy@drugindia.com.

Parental Consent

If we learn that we have collected personal information from a child under 18 without parental consent, we will take steps to delete that information as quickly as possible.

For ordering medicines for minors, we require the order to be placed by a parent or legal guardian who can provide valid prescriptions and accept responsibility for the order.

Special Protections

In compliance with DPDPA 2023, we implement additional safeguards for any data that may belong to minors: - No targeted advertising to minors - No tracking or behavioral profiling of minors - Enhanced parental controls where applicable - Immediate deletion upon request from parents/guardians

International Data Transfers

Data Location

Your personal data is primarily stored and processed in India. However, some of our service providers may process data in other countries.

When data is transferred outside India, we ensure appropriate safeguards are in place as required by DPDPA 2023 and other applicable laws.

Cross-Border Safeguards

For international data transfers, we implement: - Standard contractual clauses with data recipients - Assessment of data protection laws in recipient countries - Technical and organizational security measures - Compliance with Indian government notifications on permitted transfer destinations

Third-Party Services

Some third-party services we use may store data globally: - Cloud Infrastructure: May have servers in multiple regions with data redundancy - Analytics Services: Aggregated, anonymized data may be processed internationally - Payment Gateways: Transaction data processed according to PCI-DSS standards globally

We only partner with providers who maintain appropriate security standards.

Contact Information

Privacy Inquiries

For any questions or concerns about this Privacy Policy or our data practices:

Email: privacy@drugindia.com Phone: +91 93119 22135

Rayax Drug India Pvt. Ltd. 13P, Captain Ganpat Ram Yadav Marg, Block D, Indira Colony, Sector 52, Gurgaon, Haryana, India – 122003

Data Protection Requests

To exercise your data rights (access, correction, deletion, etc.): - Log into your account and visit Privacy Settings - Email: privacy@drugindia.com with subject "Data Request" - Include your registered phone number for verification

We aim to respond to all requests within 30 days.

Grievance Redressal

If you are not satisfied with our response or have a complaint:

Grievance Officer: Mr. Shekhar Kumar Mishra Email: grievance@drugindia.com Phone: +91 93119 22135

You also have the right to lodge a complaint with the Data Protection Board of India if you believe your rights have been violated.

Policy Updates

We may update this Privacy Policy from time to time. When we make significant changes: - We will update the "Last Updated" date at the top - We will notify you via email or in-app notification for material changes - Continued use of our Services after changes constitutes acceptance

We encourage you to review this policy periodically.

By using drugIndia, you acknowledge that you have read and understood this Privacy Policy. If you have any questions, please contact us.