Privacy policy

Who is responsible

KAUSHAL KAMAL HEALTHCARE SOLUTIONS PRIVATE LIMITED operates Medicine Now and is the data fiduciary for the personal data described here. Registered office: Second Floor, Shop No-18, Atal Smriti Vendor Market, Kachery Road, Ridhi Sidhi Tower, Ahirtoli, Ranchi, Jharkhand, 834001. GSTIN 20AAKCK1571B1Z4.

Medicine Now is a technology platform. The chemist shown on your order is the seller and dispenser, and is a data fiduciary in their own right for the dispensing record they are required by law to keep.

What we collect

• Your mobile number, because it is how you sign in. There is no password. An email address is optional.
• Who the medicine is for — a name, and optionally date of birth and gender. You can hold more than one profile, so a prescription for a parent or child is kept against that person rather than muddled into yours.
• Delivery addresses, including recipient name and phone, landmark, PIN code and, if you choose to share it, the map coordinates that help a rider find you.
• Prescriptions you upload, and what is written on them: the medicines, the prescriber's name and registration number, and the dates. This is health data and is treated as the most sensitive thing we hold.
• Your orders — what was bought, from which chemist, at what price, and what happened to the order.
• A record of each consent: which document, which version, when, and the IP address it came from. The Act requires us to be able to show this.
• Sign-in sessions — browser, IP address and last-seen time, so you can be kept signed in and so a session can be cut off if something looks wrong.

Why we hold it, and on what basis

To take your order to a chemist who can fill it, to let a registered pharmacist check a prescription before anything is dispensed, to get the order to your door, to take payment, to answer you when something goes wrong, and to keep the records that the Drugs and Cosmetics Rules and tax law require us and the chemist to keep.

The basis is your consent, given at sign-in and recorded with its version. Where a record must be kept by law, that obligation continues even after you withdraw consent — we cannot un-dispense a medicine, and the dispensing record is the chemist's to keep.

Who else sees it

• The chemist who accepts your order, and the registered pharmacist who verifies the prescription. They see what they need to dispense it. You see their name and licence number on the order, so the exchange is not one-way.
• The delivery partner carrying your order. They get a name, a phone number and an address. They are not told what is in the package.
• The payment gateway, for the amount and the order reference. We never see or store your card number, UPI PIN or bank credentials.
• The messaging provider that sends your one-time codes and order updates — a phone number and the text of the message.
• Google Analytics, which counts visits for us. It is told that a page in a section of the site was opened — never which medicine, never what you searched for, and never anything that identifies you. See Things we deliberately do not do below for exactly what is removed.
• We do not sell your personal data, and we do not share it for anyone else's advertising.

Things we deliberately do not do

No medicine name ever appears in a notification. An SMS lands on a lock screen, and “your olanzapine has arrived” tells whoever is holding the phone something about you that you did not choose to tell them. Our message templates are built so that they cannot carry a medicine name even by mistake — the only things they can be told are an order number and a code expiry.

A prescription image is never served from a public link. Links to a prescription are signed, short-lived and bound to one purpose, and the file itself is fetched by our server rather than handed to your browser as a link that would work for anybody who got hold of it.

Marketing is off unless you turn it on. It is a separate consent at sign-in, never bundled into the ones you must give to open an account.

A cheaper substitute is never swapped in silently. Substitution is its own consent, taken per order, and the pharmacist checks it against your prescription.

Google Analytics is used, and is never told which medicine you looked at. The address of every page is shortened before it is sent, so a page about a particular medicine arrives at Google as /medicine/[redacted], and a search arrives as /search with the question removed. Google is told that somebody opened a page in a section, roughly where they came from and what kind of device they used. It is not told which medicine, what you searched for, your name, your number or your address. There is no advertising pixel here, and nothing on this site is shared for anyone else's advertising.

The count that tells us which medicines people want is our own. It is kept on our servers and holds no visitor, no session, no IP address and no time more precise than the date — so it can tell us that a medicine was looked at forty times on a Tuesday, and can never tell us, or anyone, who looked. Your search terms are not part of it either: the question you typed is stripped before the count is recorded.

Where it is kept

In India. The patient database and prescription files are held in the ap-south-1 (Mumbai) region, and the application refuses to start in production if either is configured anywhere else — so this is a constraint the software enforces on itself, not only a promise on a page.

Prescription files are held on the application's own encrypted storage.

How long we keep it

Order and dispensing records, and the prescriptions behind them, are kept for as long as the Drugs and Cosmetics Rules and tax law require — this is not a period we are free to shorten. Our internal audit log, which records who did what to an order, is kept for three years. Sign-in sessions expire on their own and can be revoked sooner.

Everything we are not required to keep, we delete when you ask us to.

What you can ask for

Under the Digital Personal Data Protection Act you can ask us for a copy of what we hold about you, ask us to correct or complete it, ask us to erase what we are not required to keep, withdraw a consent you have given, and nominate someone to exercise these rights if you cannot.

Today, the way to do any of these is to raise it through your account or write to our grievance officer below. We are building a screen that lets you see and withdraw each consent yourself; until it is there, a request by either route reaches the same people and is put on the same clock.

Withdrawing a consent does not undo processing that already lawfully happened, and does not remove a record we are legally required to keep.

Children

Medicine Now is for adults. You may order for a child in your care, and hold a profile in their name, but the account and the consent are yours as the parent or guardian.

If this policy changes

The version at the top changes with it, and because that version is the one recorded against your consent, a material change means you are asked again rather than quietly carried over.

Complaints

Our grievance officer is Amit Kumar — grievance@medicinenow.in, +917970797177. We acknowledge within 48 hours and aim to resolve within 30 days.

If we have not answered you properly, you may complain to the Data Protection Board of India. Full details are on our grievance officer page.