Privacy Policy · MediStore

1. Who we are

MediStore is operated by MediStore, [registered address] (“we”, “us”). This policy explains what personal data we process when you visit http://localhost:3000 or use the MediStore app, and your rights under the Digital Personal Data Protection Act, 2023 (the “DPDP Act”) and the Information Technology Act, 2000.

2. Our two roles

For your own account, your store's subscription and messages you send us, we decide how the data is used — we are the Data Fiduciary.

For records your store keeps in the app about other people — for example a customer's name and mobile number on a bill, or your staff's logins — your store is the Data Fiduciary. We process those records only on your store's behalf and only to provide the service. Customers of a store should contact that store first; we will help the store answer them.

3. What we collect

Account details: your name, email address and profile photo from Google when you sign in with Google, and a mobile number if you add one.
Store details: store name, address, GSTIN, drug licence number and branch details.
Business records you enter: medicines, batches, stock, suppliers, purchases and sales bills — including a customer's name and mobile number if you choose to add them to a bill.
Staff accounts your store creates: name, email address and role.
Security records: sign-in times, the IP address and browser of each session, and an activity log of important actions in your store.
Payment records: plan, amounts, coupon used, payment method type and Razorpay payment and subscription IDs. Card, UPI and bank details are entered on Razorpay's checkout and never reach us.
Messages you send us: the name, mobile number, email, store, city and message from our contact form, emails and WhatsApp chats.

4. Why we use it

To provide the service: sign you in, keep your store's records and show them to the people you allow.
To keep accounts secure: detect misuse, investigate problems and show you who did what in your activity log.
To bill you: take payments through Razorpay, apply GST where it applies and keep payment records.
To reply to you: answer questions, demo requests and support messages.
To tell you about your account: for example that your trial or plan is ending.
To meet our legal duties: for example tax and accounting records.

We do not sell personal data, we do not show advertising, and we do not use your store's records for anything other than providing the service to you.

We process your account data with the consent you give when you create your account, and for the legitimate uses the DPDP Act allows, such as meeting a legal duty. You can withdraw consent at any time by asking us to close your account (see “Your rights”). Withdrawing does not affect what was done before, and some records must be kept by law.

We share personal data only with service providers that help us run MediStore, and only what each needs:

Google — to sign you in with your Google account.
Razorpay — to take subscription payments.
Our hosting provider, [hosting provider and region, e.g. AWS Mumbai (ap-south-1)] — stores the app, its database and backups.

We also disclose data when Indian law requires it, for example to comply with a lawful order. We never share your sales, stock or customer records with pharma companies, distributors, data brokers or advertisers.

7. Cookies

The website sets no cookies and uses no analytics or tracking tools. When you sign in to the app we set a session cookie that keeps you signed in; it is needed for the app to work. Your light or dark theme choice is saved in your own browser's local storage and never sent to us. Because there are no optional cookies, we don't show a cookie banner.

8. How long we keep it

Your account and your store's records: while your account is open, and [number of days] days after it is closed or your plan ends without renewal, so you can come back. Then they are deleted.
Payment records: as long as tax and accounting laws require.
Activity log and session records: [retention period, e.g. 1 year].
Messages you send us: [retention period, e.g. 2 years] after our last reply.

Deleted data can remain in backups for up to [backup retention, e.g. 30 days] before the backups roll over.

9. How we protect it

Each store's records are walled off from every other store and checked on every request, all traffic uses HTTPS, staff see only what their role allows, and important actions are logged. The details are on our Security & Privacy page. No system is perfectly secure; if a breach affects your personal data we will tell you and the Data Protection Board of India as the law requires.

10. Your rights

Under the DPDP Act you can ask us to:

give you a summary of the personal data we hold about you and how we use it;
correct, complete or update it;
erase it, unless the law requires us to keep it;
resolve a complaint about how we handle it; and
let a person you nominate exercise these rights if you die or can't act yourself.

Write to [email address] from your account's email address. We may ask you to confirm who you are. If you are not satisfied with our answer, contact our Grievance Officer; after that you may complain to the Data Protection Board of India.

11. Children

MediStore is a business tool for medical stores. It is not meant for anyone under 18, and we don't knowingly collect children's data for our own purposes.

12. Changes to this policy

If we change this policy we will update the date above. If a change matters, store owners will be told in the app or by email before it takes effect.

13. Contact

Questions about privacy: [email address]. Complaints: our Grievance Officer.