Privacy & Data Protection Policy

1. Scope & Legal Framework

This Privacy Policy applies to the web and local software applications, cloud services, and support platforms provided by PharmaPulse India (collectively, the "Service").

PharmaPulse is designed to align with the applicable requirements of the Digital Personal Data Protection (DPDP) Act, 2023, the notified Digital Personal Data Protection Rules, 2025 (subject to their phased commencement schedule), the Information Technology Act, 2000, the Drugs and Cosmetics Act, 1940, and statutory pharmacy practice standards in India.

2. Categories of Personal Data Collected

We collect only the minimum personal information necessary to deliver high-speed pharmacy ERP billing, cloud backup, and account security:

3. Purposes of Data Processing

We process personal and store data strictly for defined, transparent operational purposes:

• Authentication & Account Protection: Verifying credentials, sending Multi-Factor One-Time Passcodes (OTP) via Email and SMS, and securing store access against unauthorized logins.
• Core POS & Inventory Operations: Computing real-time stock balances, batch expiry warnings, automated FEFO (First-Expiry, First-Out) deductions, and GST tax calculations.
• Transactional Communication: Dispatching digital invoice receipts to customer WhatsApp or email when explicitly instructed by the billing pharmacist at the counter.
• System Auditability: Maintaining immutable audit logs of administrative actions, billing returns, and inventory modifications to safeguard pharmacy business integrity.
• Customer Support: Assisting chemists with Marg ERP / Busy CSV migration, software setup, and technical troubleshooting upon direct request.

4. Lawful Grounds for Processing

PharmaPulse processes personal data based on recognized legal grounds under the DPDP Act, 2023:

• Affirmative Consent (Section 6): Obtained explicitly at user registration via affirmative checkbox selection for account creation and service delivery.
• Contractual & Operational Necessity (Section 7): Necessary for fulfilling software licensing, transaction processing, and cloud database synchronization.
• Compliance with Legal Obligations: Retaining sales records for Schedule H, H1, and narcotic drugs as mandated by the Drugs and Cosmetics Rules, 1945 and tax filing records under the Central Goods and Services Tax (CGST) Act, 2017.

5. Data Principal Rights

In accordance with the DPDP Act, 2023, registered users and data principals have specific statutory rights:

• Right to Access Information (Section 11): You may request a summary of the personal data currently processed, identities of authorized service providers, and export your entire store relational database at any time.
• Right to Correction & Erasure (Section 12): You may update outdated contact details, rectify inaccurate inventory, or request permanent account erasure upon subscription termination (subject to statutory record retention rules).
• Right of Grievance Redressal (Section 13): You may register concerns or privacy grievances directly with our designated Grievance Officer and receive formal resolution.
• Right to Nominate (Section 14): You may designate a nominee to exercise data protection rights on your behalf in the event of death or incapacity.
• Right to Withdraw Consent: Where processing is founded on voluntary consent, you may withdraw consent by contacting our Data Protection Desk. Withdrawal does not affect lawful processing conducted prior to revocation.

6. Data Retention & Erasure

PharmaPulse retains personal data only for as long as necessary to fulfill service operations and comply with Indian statutory requirements:

• Active Subscription: Pharmacist account credentials and store inventory records remain accessible throughout the duration of your active subscription.
• Statutory Pharmacy Retention: Under the Drugs and Cosmetics Rules, 1945, records of prescription medicine sales (Schedule H, H1, X) must be preserved by retail chemists for a minimum statutory period of two (2) years from the date of transaction. PharmaPulse stores this historical record in your partition to ensure inspection compliance.
• Account Deletion: Upon receiving a verified account deletion request from a store licensee, non-statutory personal data is permanently purged within 30 calendar days.

7. Technical Security Safeguards

We deploy robust organizational and technical safeguards to prevent unauthorized data access, loss, or disclosure:

• Cryptographic Password Protection: Passwords are never stored in plaintext; they are hashed using secure cryptographic algorithms with unique per-user random salt values.
• Session Security: Authentication tokens are transmitted in encrypted, HttpOnly; SameSite=Strict; Secure cookies that cannot be accessed by client-side browser scripts.
• Transport Layer Security: All API requests, cloud synchronizations, and data transmissions utilize modern HTTPS/TLS encryption.
• Counter Device Authorization: High-risk counter actions are bound to authorized hardware fingerprints, preventing unauthorized remote access.
• Defensive Rate Limiting: Automated rate-limiting algorithms block brute-force password guessing and rapid OTP flooding attempts.

8. Cookies & Local Storage Disclosure

PharmaPulse uses strictly functional cookies and browser storage. We do not use third-party behavioral tracking or ad-retargeting cookies:

• sessionToken (Cookie): Secure, HttpOnly token maintaining your authenticated session.
• sessionStorage: Temporary in-memory cache holding active store user profile during your open browser tab session.
• localStorage (pharmapulse_device_fp): Stored counter device identifier ensuring POS hardware verification.

9. Grievance Redressal Mechanism & Contact

If you have questions, wish to exercise your data principal rights, or have privacy concerns, please contact our designated Grievance Desk: