Privacy Policy

1. Who we are

PharmaBandhu is a discovery directory that helps pharmacies in India find pharmaceutical distributors. It is operated by Kakshlink Private Limited ("PharmaBandhu", "we", "us"). For the purposes of the Digital Personal Data Protection Act, 2023 ("DPDP Act") and the Information Technology Act, 2000 and its rules, we are the data fiduciary for the personal data described in this policy.

2. Scope of this policy

This policy applies to the website at pharmabandhu.in, the PharmaBandhu mobile apps for Android and iPhone, and any communication you have with us. It does not apply to websites or services of other companies, including distributors you contact through PharmaBandhu.

3. Personal data we collect

Data you give us

• Account details: your name, mobile number, email address, account type (pharmacy owner or distributor) and password. Passwords are stored only as a one-way hash.
• Business details: pharmacy or firm name, contact person, business address, state, district, city, PIN code, drug licence type and number, business phone and WhatsApp number, logo, and for distributors the areas you serve and the companies, brands and medicines you deal in.
• Licence and business documents: photos or PDFs of your drug licence and, for distributors, other documents needed for verification.
• Consents: the version of these terms and this policy you accepted, the time and the IP address used.
• Messages to us: the name, email, mobile number and message you send through our contact form or support channels.

Data we receive from others

• Google sign-in: if you choose it, Google shares your Google account identifier, name and verified email address. We never receive your Google password.

Data collected automatically

• Verification codes: one-time codes sent by SMS or email. We store only a hash of each code; codes expire after a few minutes and work once.
• Sign-in data: secure tokens for each device you sign in on, the device name you approve, and the time of your last sign-in.
• Technical and security data: IP address, device and browser type, app version and server logs, used to keep the service secure and fix problems.
• Location: only if you choose a nearby (radius) search and allow it on your device. You can always search by state, city or PIN code instead.
• Profile visits and searches: when a pharmacy opens a distributor's profile we record the visit (at most once a day per distributor), how the pharmacy got there and what it was looking for. Visits are kept for 180 days. What pharmacies search for is also counted per day and state, without recording who searched.
• Search data: what you search for, so we can return results and improve the catalogue. Searches that find nothing may be kept without your identity.

Data we do not collect

• Fingerprint or face data. App unlock with fingerprint or Face ID happens entirely on your device; we only learn whether it succeeded.
• Patient or prescription information. PharmaBandhu is a business directory and must not be used to share patient data.
• Payment card, bank or UPI details. Pro payments are made on PhonePe's secure pages; we receive only the result, a transaction reference, the payment method type and the amount. PharmaBandhu does not process payments between users.

4. How we use your data

We process personal data on the basis of your consent, given when you register or contact us, and for legitimate uses permitted by section 7 of the DPDP Act, such as complying with law. We use it to:

• create, verify and secure your account, including mobile and email verification;
• check licence and GST numbers and documents, show trust badges, and review reports about listings;
• show distributor profiles to pharmacies, and return relevant search results;
• send verification codes, account and security notices, and service updates;
• respond to your messages and requests;
• prevent fraud, abuse and unlicensed activity, and keep the service secure;
• improve the catalogue and the service, using aggregated or de-identified data where possible;
• meet legal obligations and respond to lawful requests from authorities.

We will not use your data for a new, unrelated purpose without telling you and, where required, asking for your consent.

5. What other users can see

• Distributors: your firm name, business address area, city, service areas, business phone and WhatsApp number, licence type, trust badges and the companies, brands and medicines you list are shown to pharmacies using PharmaBandhu.
• Pharmacies: your profile is not shown in public listings. Only if you turn on "Show my shop to distributors" in the app, signed-in distributors can find your pharmacy name, owner name, address, licence type, trust badges and business phone (or your mobile number if you have not added a business phone), and call or message you. You can turn this off at any time. When you call or message a distributor, they will see the number or account you contact them from.
• Profile visits: distributors see how many pharmacies visited their profile and what those pharmacies were looking for, as numbers. Distributors on the paid Pro plan also see the name and city of pharmacies that turned on "Show my shop to distributors"; any other pharmacy appears only as "a pharmacy" in its city.
• Callback requests: if a pharmacy taps "Request a callback" on a distributor's profile, that one distributor sees the pharmacy's name, owner name, area and phone number (with any note it wrote), whatever the distributor's plan, so it can call back. Distributors are also told, as numbers or by city, when pharmacies' searches show them; no pharmacy is named unless it turned on "Show my shop to distributors".
• Never shown: licence documents, passwords, email addresses you have not made public, verification codes and private notes made by our review team.

6. Sharing with service providers

We do not sell personal data. We share it only with service providers that process it for us under contract and only for the purposes in this policy:

We may also disclose personal data when required by law, court order or a lawful request from a government authority; to protect the rights, safety or property of our users or the public; or as part of a merger or sale of the business, in which case the new owner must protect your data as this policy describes.

7. Advertising

PharmaBandhu is free for pharmacies and is funded by advertising and by distributors' optional Pro plan. The app may show ads from Google AdMob as well as our own ads, always labelled "Ad", and Featured listings of Pro distributors, always labelled "Featured". Ad providers may use your device's advertising identifier and approximate location according to their own privacy policies. You can reset or limit the advertising identifier in your phone's settings. Payment never affects a badge.

8. Cookies and similar technologies

Our website uses only cookies that are needed for it to work: a session cookie and a security token that protects forms. We do not use analytics or advertising cookies on the website. The mobile app stores your sign-in token securely on your device so you stay signed in.

9. Storage and security

• All traffic to our website and app uses encrypted HTTPS connections.
• Passwords and one-time codes are stored only as hashes. Sign-in tokens expire and can be revoked by signing out.
• Licence documents are kept in private storage, never on a public web address, and only authorised staff can view them for verification.
• Staff access is limited by role, and only people who need the data for their work can see it.

No system is perfectly secure. If a personal data breach affects you, we will inform you and the Data Protection Board of India as the DPDP Act requires.

10. How long we keep data

We keep personal data only as long as we need it for the purposes above or as the law requires, then delete or anonymise it.

11. Your rights

Under the DPDP Act you have the right to:

• Access: ask for a summary of the personal data we hold about you and how we use it.
• Correction and erasure: ask us to correct, complete or update your data, or to delete it. Most profile details can be edited in the app.
• Withdraw consent: withdraw consent at any time. This does not affect processing already done, and some features may stop working.
• Grievance redressal: complain to our Grievance Officer, and if unresolved, to the Data Protection Board of India.
• Nominate: nominate another person to exercise your rights in case of death or incapacity.

To use these rights, write to us through the contact form using your registered mobile number or email. We may verify your identity, for example with a one-time code, before acting. To delete your account, see Delete your account.

12. Children

PharmaBandhu is for businesses and is not meant for anyone under 18. We do not knowingly collect data from children. If you believe a child has given us personal data, contact us and we will delete it.

13. Grievance Officer

If you have a concern about how we handle your personal data, contact our Grievance Officer. We acknowledge complaints within 24 hours and aim to resolve them within 15 days.

14. Changes to this policy

We may update this policy as PharmaBandhu changes or the law changes. The date at the top shows the latest version. If a change is significant, we will tell you in the app or by email and, where needed, ask for your consent again before it applies to you.