This Privacy Policy ("Policy") explains how Pillcart Pharmacy Solutions Private Limited ("Pillcart", "we", "us", or "our"), a company incorporated under the Companies Act, 2013 with its registered office at Inno8 CP2, 44, Backary Portion, 2nd Floor, Regal Building, Connaught Place, Central Delhi, New Delhi, Delhi – 110001, India, collects, uses, discloses, stores, secures, and processes your personal data and other information when you access, register on, browse, or use the Pillcart platform, including the website at https://pillcart.in, any associated mobile applications, APIs, or related services (collectively, the "Platform").
This Policy forms an integral part of the Pillcart Terms and Conditions ("Terms") and is published in accordance with Rule 3(1)(a) of the Information Technology (Intermediary Guidelines and Digital Media Ethics Code) Rules, 2021, and in compliance with the Digital Personal Data Protection Act, 2023 ("DPDP Act"), the Information Technology Act, 2000 (including SPDI Rules, 2011 where applicable), and other relevant Indian laws.
By accessing or using the Platform, you consent to the collection, use, disclosure, storage, and processing of your information as described in this Policy. If you do not agree with any part of this Policy, you must immediately discontinue use of the Platform.
We value your privacy and are committed to protecting the confidentiality, integrity, and availability of the information entrusted to us, particularly in the highly regulated pharmaceutical sector.
1. Scope and Applicability
1.1 This Policy applies to all Users (as defined in the Terms: Licensed Retail Pharmacies, Brands, Authorized Distributors) and any visitors who access the Platform without registration.
1.2 It covers digital personal data (as defined under the DPDP Act) and other business-related information collected through the Platform. This includes sensitive inferences from transaction data (e.g., types of medicines ordered that may indicate health needs).
1.3 This Policy does not apply to data processed by third-party Suppliers (Brands/Authorized Distributors), payment gateways, logistics providers, credit partners, or other entities with whom you directly transact. Such entities have their own privacy policies.
2. Information We Collect
We collect information in the following categories, limited to what is necessary for the purposes described in Section 3 (data minimization principle):
2.1 Information You Provide Directly (Voluntarily or Required for Services)
• Registration & Verification Data: Business name, registered address, GSTIN/PAN, Drug License number & validity (including scanned/uploaded copies), proof of authorization/distribution agreements (for Authorized Distributors), proof of brand ownership/IP rights (for Brands), contact person's name, mobile number, email address, landline (optional).
• Account & Transactional Data: Username, password (hashed), multi-user access details, Order history, Shortbook lists, substitute preferences, payment preferences, credit application information (e.g., business financials for third-party credit assessment).
• Communication & Support Data: Messages, queries, support tickets, feedback, uploaded documents.
2.2 Information Collected Automatically
• Device & Usage Data: IP address, device type/model, operating system, browser type/version, unique device identifiers, mobile network information, pages visited, time spent, clickstream data, search queries, features used (e.g., Geo-Based Distribution Logic, Order tracking).
• Location Data: Approximate location from IP address or device settings (used strictly for Geo-Based Distribution Logic enforcement and regulatory compliance; no precise geolocation without consent).
• Cookies & Tracking Technologies: Session/persistent cookies, web beacons, pixels, local storage for authentication, preferences, analytics, and limited advertising (detailed in Section 9).
2.3 Information Received from Third Parties
• Verification/KYC partners: Results from regulatory databases or third-party services (e.g., Drug License validation).
• Suppliers/Partners: Order fulfilment status, delivery updates from logistics providers.
• Payment Gateways/Credit Providers: Transaction confirmations (we do not store full card details, CVV, or expiry dates).
• Other: Limited data from integrated services (e.g., OTP verification providers).
We do not collect credit/debit card numbers or expiry dates directly; these are handled securely by third-party payment processors.
3. Purposes of Processing and Legal Basis
We process your information only for legitimate, specific, and explicit purposes, in accordance with the DPDP Act:
(a) To provide, maintain, improve, and personalize the Platform and Services (e.g., real-time catalog, Order placement/tracking, substitute recommendations, Geo-Based Distribution Logic). (b) To verify identity, Drug License authenticity, and eligibility (essential for compliance with the Drugs and Cosmetics Act, 1940). (c) To facilitate Orders, payments, credit extensions (via third-party lenders), promotions, returns, and refunds. (d) To communicate transactionally (e.g., OTPs, Order updates, delivery notifications, support responses). (e) To detect, prevent, and investigate fraud, misuse, security incidents, or violations of Terms/Applicable Laws. (f) To comply with legal/regulatory obligations (e.g., GST reporting, reporting to drug authorities, responding to government requests). (g) For internal purposes: analytics, product enhancement, auditing, risk management, and aggregated/de-identified reporting. (h) With your explicit consent (where required), for marketing Pillcart Services or relevant third-party offerings (you may withdraw consent at any time without affecting core Services).
Legal Bases (DPDP Act-compliant):
• Performance of contract (core Services under Terms).
• Compliance with legal obligations (e.g., Drug License records, GST).
• Legitimate interests (e.g., fraud prevention, security – balanced against your rights).
• Consent (for marketing, non-essential tracking).
4. Sharing and Disclosure
We do not sell your personal data. Sharing is limited and purpose-bound:
4.1 With Service Providers (processors): Payment gateways, logistics, cloud providers, analytics tools, KYC/verification services, credit assessment partners – under strict contracts ensuring confidentiality, security, and DPDP Act compliance.
4.2 With Suppliers (Brands/Authorized Distributors): Necessary transactional data (e.g., pharmacy name, delivery address, Order details) solely for fulfilment and returns.
4.3 Regulatory/Government Authorities: As required by law, court order, or to protect public health (e.g., under Drugs and Cosmetics Act).
4.4 Corporate Transactions: In mergers, acquisitions, or asset sales (with notice where feasible).
4.5 Legal Protection: To enforce Terms, defend rights, or protect safety of Pillcart/Users/third parties.
All sharing is on a need-to-know basis with appropriate safeguards (e.g., contracts, encryption).
5. Data Retention
We retain data only as long as necessary:
• Account/Drug License data: During active account + 7 years post-termination (for tax, GST, regulatory audits, legal defense).
• Transaction/Order data: 7 years from transaction date (GST/compliance requirements).
• Logs/Analytics: Up to 2 years (or as required by law).
• Upon account deletion or erasure request: Data deleted/anonymized except where legally required to retain (e.g., financial records).
We periodically review and delete unnecessary data.
6. Your Rights (DPDP Act)
You have the following rights (subject to verification and exceptions under law): (a) Access: Obtain confirmation of processing and a summary of your data. (b) Correction: Update inaccurate/incomplete data. (c) Erasure ("Right to be Forgotten"): Request deletion (subject to legal retention). (d) Nomination: Designate a person to receive data in case of death/incapacity. (e) Withdrawal of Consent: For consent-based processing (does not affect prior lawful processing). (f) Grievance Redressal: See Section 11.
Requests should be sent to the Grievance Officer. We will respond within timelines prescribed under the DPDP Act (generally 30 days).
7. Data Security
We implement reasonable and appropriate technical, organizational, and physical safeguards proportionate to the risks, including:
• Encryption of sensitive uploads (e.g., Drug Licenses) in transit (TLS) and at rest.
• Role-based access controls, multi-factor authentication, regular audits.
• Monitoring for unauthorized access, vulnerability scanning.
• Incident response plan with breach notification to affected Users and the Data Protection Board as required by DPDP Act.
No system is 100% secure; we cannot guarantee absolute security.
8. Cookies and Tracking Technologies
We use essential cookies (for authentication/security), functional cookies (preferences), and analytics cookies (usage insights). Third-party tools (e.g., Google Analytics) may be used. You can manage preferences via browser settings, but disabling essential cookies may impair functionality. See our Cookie Notice (linked on the Platform).
9. International Transfers
The Platform is hosted in India. Where data is transferred outside India (e.g., to certain cloud/analytics providers), we ensure adequate safeguards (e.g., standard contractual clauses, consent, or government-prescribed requirements under DPDP Act).
10. Children's Data
The Platform is not intended for individuals under 18. We do not knowingly collect data from children. Verifiable parental/guardian consent is required for any incidental processing (as per DPDP Act).
11. Grievance Redressal
For privacy queries, complaints, or rights exercises:
Grievance Officer Name: Girish Tripathi Email: care@pillcart.in Address: Inno8 CP2, 44, Backary Portion, 2nd Floor, Regal Building, Connaught Place, Central Delhi, New Delhi, Delhi – 110001, India Phone: +91 9804475786
We will acknowledge receipt within 24 hours and resolve within statutory timelines.
12. Changes to this Policy
We may update this Policy to reflect changes in practices, technology, or law. Material changes will be notified via email or prominent Platform notice at least 30 days in advance. Continued use constitutes acceptance.
13. Contact Us
For questions: care@pillcart.in or Inno8 CP2, 44, Backary Portion, 2nd Floor, Regal Building, Connaught Place, Central Delhi, New Delhi, Delhi – 110001, India.
This Policy is governed by the laws of India. Disputes are subject to the exclusive jurisdiction of courts at Mumbai, India.
Thank you for trusting Pillcart with your information.