Privacy Policy

This policy explains what personal data RxStock (“RxStock”, “we”) collects through the RxStock pharmacy management service, why we collect it, and the choices and rights you have. It is written to align with India’s Digital Personal Data Protection Act, 2023 and the rules made under it.

1. Two different roles — please read this first

RxStock handles two distinct categories of data, and our responsibilities differ between them:

• Your account and pharmacy data. When you sign up, we decide what is collected and why. For this data we act as the Data Fiduciary, and this policy governs it.
• Your customers’ data. When you record a customer’s name, mobile number or address in order to raise a bill or track credit (udhaar), you decide what to collect and why. For that data your pharmacy is the Data Fiduciary and RxStock acts as a Data Processor on your instructions. You are responsible for giving your customers appropriate notice and for having a lawful basis to record their details. We process it only to provide the service to you.

2. What we collect

Data	Why	Required?
Your name, email, mobile	Create and secure your account, sign you in, contact you about the service	Yes
Password	Authentication. Stored only as a salted hash — we cannot read it	Yes
Pharmacy name, address, city, state, pincode, phone	Identify your shop and print it on invoices	Name required; rest optional
GST number, drug licence number	Printed on GST invoices where you choose to provide them	Optional
Staff accounts you create	Role-based access for your team	Only if you add staff
Customer records you enter	Billing, credit tracking. See section 1 — you control this	Optional; you decide
Business records (sales, invoices, stock, purchases)	Operating the product you bought	Yes
Payment records (Razorpay order/payment identifiers, amount, status)	Take and reconcile subscription payments	Only if you subscribe
IP address and browser user-agent	Security, audit logging, and recording consent	Yes
Consent records	Evidence of what you agreed to and when	Yes

We do not collect Aadhaar, PAN, bank account numbers, or patient medical or prescription records. Card and UPI details are entered directly with our payment gateway and never reach our servers.

3. Legal basis

We process your account and pharmacy data on the basis of the consent you give when creating an account, and to perform our contract with you. Marketing messages are sent only on the basis of separate, optional consent that you can withdraw at any time without losing access to the product.

4. Who else processes your data

We keep the list of third parties deliberately short. As of version 1.0:

Service	Purpose	What it sees
Amazon Web Services (Mumbai, ap-south-1)	Application hosting and database	All service data
Razorpay	Subscription payments	Billing contact and payment details you enter at checkout
jsDelivr CDN, Google Fonts	Serving stylesheets, scripts and the web font	Your IP address and browser, as with any external asset

We do not use analytics, advertising or tracking services — there is no Google Analytics, no advertising pixel and no cross-site tracking in RxStock. We do not sell personal data.

5. Where your data is stored

RxStock is hosted in Amazon Web Services’ Mumbai (ap-south-1) region, so service data is stored in India. Traffic to and from the application is encrypted in transit using HTTPS/TLS.

6. Retention

We keep data only as long as there is a reason to:

• Account and pharmacy data — for as long as your account is open.
• Invoices, sales, purchases and ledger entries — retained for 4 years after account closure, because these are financial records subject to tax and accounting retention requirements. They are kept in a form that no longer identifies the closed account, and are deleted at the end of that period.
• Consent records — retained as evidence of consent, including after withdrawal.
• Security and audit logs — retained for 1 year.

7. Your rights

Under the DPDP Act you may:

• Access a copy of your personal data — available instantly in the app under Settings → Privacy & Data → Download my data.
• Correct or complete inaccurate data — most fields are directly editable in Settings; anything else can be requested from the Privacy Centre.
• Withdraw consent — marketing consent can be switched off in the Privacy Centre at any time, as easily as it was given.
• Erase your personal data — request account deletion from the Privacy Centre. Note that financial records are retained as described in section 6.
• Nominate another individual to exercise your rights in the event of death or incapacity — contact us at the address below.
• Complain to us, and to the Data Protection Board of India if you are unsatisfied.

Requests raised in the app are tracked with a reference number so you can follow their progress.

8. Security

Measures currently implemented in the product include:

• Passwords stored only as salted hashes, never in plain text or recoverable form.
• HTTPS/TLS for all traffic; secure, HTTP-only, same-site session cookies in production.
• CSRF protection on state-changing requests and rate limiting on authentication endpoints.
• Strict tenant isolation — every record is scoped to your pharmacy, enforced server-side.
• Role-based access control for staff accounts, and an audit log of significant actions.

No system is perfectly secure. If you believe your account has been compromised, contact us immediately at hello@rxstock.in.

9. Children

RxStock is a business tool intended solely for use by adults operating a licensed pharmacy. It is not directed at children and we do not knowingly create accounts for anyone under 18.

10. Changes

If we materially change how we handle personal data we will publish an updated version here with a new version number, and where the change requires it, ask you to review the updated notice in the app.

11. Contact and grievances

For any privacy request or complaint, contact our Grievance Officer [name to be confirmed]:

• Email: hello@rxstock.in
• Operating entity: RxStock
• Address: Jaipur, Rajasthan, India

We aim to acknowledge requests promptly and resolve them within the timelines required by law. If you are not satisfied with our response you may escalate to the Data Protection Board of India.