Privacy policy
Effective from 9 November 2026
This notice explains how MedicineFlow (“we”) processes personal data on this website, in your customer account and when the MedicineFlow software checks its license. We act as data fiduciary under the Digital Personal Data Protection Act, 2023 (the “DPDP Act”).
What we collect and why
| Data | Purpose |
|---|---|
| Name, email, mobile number, city and state | Your account, sign-in, service emails (confirmations, invoices, renewal and security notices), support |
| Pharmacy name, address, GSTIN, drug licence number | Licenses and GST invoices; tax records |
| Orders, amounts, payment status and the payment or bank reference | Processing payments, invoices, refunds and accounting. Card, UPI and bank credentials go only to Razorpay or your bank; we never receive them. |
| License checks: license id, an anonymous computer fingerprint, computer name, operating system, software version, IP address | Activating computers, enforcing the computer limit, preventing key sharing and fraud, offering updates |
| Messages and support tickets | Answering you |
| Sign-in and security logs (IP address, time) | Protecting accounts against misuse |
We process this data to perform our contract with you, to comply with law (for example GST record keeping), and with your consent, which you give when you create an account. We do not sell personal data and do not use it for third-party advertising. We use only the cookies needed to keep you signed in and protect forms; no tracking cookies.
What we never collect
Your pharmacy's business data (sales, stock, patients, prescriptions, suppliers and accounts) stays on your computer. The software does not send it to us. If you send us a backup or screenshot for support, we use it only to help you and delete it when the ticket is closed.
Who we share it with
Only service providers who help us run the service, under contracts that protect your data: Razorpay (payments), our hosting provider and our email provider; and authorities when the law requires it.
How long we keep it
Account data: while your account exists. Invoices and payment records: eight years, as required by tax law. Security logs: up to 180 days. When you delete your account we erase or anonymise everything else.
Your rights
Under the DPDP Act you may ask for a summary of your personal data and how we process it, have it corrected, completed or updated, have it erased, withdraw your consent (this may end the service), nominate a person to exercise your rights, and complain to us and then to the Data Protection Board of India. Write to [email protected]; we reply within 30 days. You can correct most details yourself in your account.
Security
All traffic uses HTTPS. Passwords are stored as one-way Argon2id hashes, license keys encrypted, and administrator access is limited by role and logged. If a breach affects your data we will tell you and the Data Protection Board as the law requires.
Children
The service is for businesses; we do not knowingly collect data of anyone under 18.
Changes
We will post any change here and email you about material changes.
Seller and grievance officer
MedicineFlow
Email: [email protected]
For complaints about our products, payments, your personal data or this website, contact our grievance officer. Email [email protected].
We acknowledge every complaint within 48 hours and resolve it within one month of receipt.