Digital Personal Data Protection (DPDP) Architecture
PharmaPulse is architected from the ground up to support the requirements of the Digital Personal Data Protection (DPDP) Act, 2023 and the notified Digital Personal Data Protection Rules, 2025. We provide transparent technical mechanisms that enable Indian retail and wholesale chemists to protect customer confidentiality while meeting statutory drug recordkeeping requirements.
Notice: PharmaPulse is designed to support applicable statutory data-protection obligations. This documentation provides technical architecture details and does not constitute formal legal advice.
1. DPDP Roles & Responsibilities
The DPDP Act, 2023 clearly delineates roles between the entity determining the purpose of processing (Data Fiduciary), the entity processing data on its behalf (Data Processor), and the individual to whom the personal data belongs (Data Principal):
The Chemist / Pharmacy Store
Role: Primary Data Fiduciary (Counter Records)
When a customer visits your pharmacy counter and provides their mobile number, name, or doctor prescription for billing, your pharmacy store determines the purpose of collecting that data. Your store acts as the Data Fiduciary under the Act.
PharmaPulse India Platform
Role: Technical Intermediary / Data Processor
PharmaPulse provides the encrypted local database, cloud synchronization, and POS interface. We process patient/counter records strictly on your store's behalf. For your pharmacist account credentials, PharmaPulse acts as a Data Fiduciary.
2. Core Privacy Engineering Principles
We incorporate 5 foundational principles into our daily software operations:
Purpose Limitation & Zero-Sale Guarantee
Data collected through PharmaPulse is utilized solely for authorized pharmacy ERP operations: counter billing, GST reporting, automated FEFO expiry deduction, and user-triggered receipts. We never sell or broker store or patient records to third-party ad networks or pharmaceutical distributors.
Data Minimisation
Registration collects only essential operational fields: Store Name, Pharmacist Name, Mobile, Email, and Drug License. We do not demand unnecessary permissions or intrusive background tracking.
Granular Consent Architecture
PharmaPulse records consent through immutable, versioned database records (`user_consents`) capturing timestamp, policy version, and one-way cryptographic telemetry hashes. Optional marketing communications remain strictly separate from required service operations and are never pre-checked.
Harm Prevention & Storage Limitation
Counter records are segregated in encrypted store partitions. Prescription sales records for Schedule H, H1, and X medicines are retained in accordance with the mandatory 2-year statutory retention mandated by the Drugs and Cosmetics Rules, 1945.
Cryptographic & Access Controls
Authentication utilizes PBKDF2/SHA-256 salted hashes, two-factor OTP verification, HttpOnly SameSite=Strict cookies, and hardware fingerprint binding for authorized counters.
3. Exercising Data Principal Rights
Under Chapter III of the DPDP Act, 2023, data principals have enforceable rights. Here is how PharmaPulse facilitates them:
- Right to Access Information (Section 11): Subscribers can request an itemized summary of personal data maintained on file or export their complete relational database at any time directly through the application.
- Right to Correction & Updation (Section 12): Chemist profile details, supplier registries, and customer records can be updated directly from the Store Settings and Master Ledgers.
- Right to Erasure (Section 12): Upon account cancellation, users may request permanent purging of account records. Non-statutory data is expunged within 30 days, while statutory drug registers are preserved only as mandated by the Drugs Control Authority.
- Right to Withdraw Consent: To withdraw consent for non-essential processing (such as marketing updates), email privacy@pharmapulseindia.com with your registered username.
- Right of Grievance Redressal (Section 13): Chemist subscribers or individuals whose contact data is processed may register grievances with our Data Protection Officer for prompt investigation and resolution.
4. Phased Commencement & Roadmap
The Government of India has notified the Digital Personal Data Protection Rules, 2025 with a phased implementation schedule. While certain provisions take effect immediately upon notification, others (such as formal Data Protection Board dispute protocols and specialized audit certifications) follow transitional commencement milestones.
PharmaPulse continually tracks official Ministry of Electronics and Information Technology (MeitY) gazette notifications to ensure our technical implementation remains aligned as rules become fully operative.
5. Data Protection Officer & Grievance Desk
For inquiries regarding our DPDP architecture or to register a formal data protection grievance:
Department: Legal & Data Protection Desk
Email: grievance@pharmapulseindia.com | support@pharmapulseindia.com
Helpline: +91 9810529871
Operational Hours: Monday – Saturday, 9:00 AM – 8:00 PM IST
Turnaround Commitment: Grievance acknowledgement within 24 hours; formal resolution within statutory timelines.