Privacy Policy

Apothecare Specialities Private Limited
Version 1.0 | Effective from 05.10.2026

I. Who We Are and What This Policy Covers

1. This Privacy Policy is issued by Apothecare Specialities Private Limited, a company incorporated under the Companies Act, 2013, bearing Corporate Identity Number U47720KA2025PTC204484 and Goods and Services Tax Identification Number 29ABDCA1724E1Z0, having its registered office at 1st Floor, No. 63, M S Ramaiah Road, Gokula Extension, Mathikere, Bengaluru – 560 054, Karnataka ("the Company", "we", "us", "our").

2. The Company holds licences under the Drugs and Cosmetics Act, 1940 and the Drugs and Cosmetics Rules, 1945 in Form 20, Form 20-B, Form 21 and Form 21-B bearing Licence Nos. KA-B12-279698, KA-B12-279699, KA-B12-279700, KA-B12-279701 each valid from 07.07.2025 to 06.07.2030. The Registered Pharmacist and Qualified Person on those licences is Sri Sunil Kumar S, Karnataka State Pharmacy Council Registration No. RP-50844.

3. This Policy applies to www.apothecare.in and to every application, page and service operated by the Company through it ("the Platform").

4. The Company is the Data Fiduciary in respect of all personal data processed through the Platform, within the meaning of the Digital Personal Data Protection Act, 2023. It alone determines the purpose and means of that processing.

II. Who Is the Data Fiduciary for Your Order

5. Your order is sold to you by the Company. It is fulfilled from the licensed location allocated to it under the Master Terms and Conditions ("the Fulfilment Location"). Where that location is operated by a company other than the Company, that company acts solely as the Company's agent for supplying the goods, and the Company remains the seller and remains answerable to you.

6. The Company is the Data Fiduciary in respect of all personal data processed through the Platform, including your account, your browsing, your consent, your order, its fulfilment and its delivery. It alone determines the purpose and means of that processing.

7. On allocation the Company makes available to the operator of the Fulfilment Location the personal data necessary for it to dispense and deliver, being your name, delivery address and mobile number, the products ordered and, where the order is for a prescription medicine, the prescription and the particulars appearing on it. That operator processes it as a Data Processor, on the Company's documented instructions and for no purpose of its own, under a written contract as Section 8(2) of the Digital Personal Data Protection Act, 2023 requires. Section 8(1) makes the Company responsible for compliance irrespective of any agreement to the contrary.

8. The operator of a Fulfilment Location is a Data Fiduciary in its own right, and not a Data Processor, only in respect of the prescription register and the Schedule H1 register which it is required by the Drugs and Cosmetics Rules, 1945 to maintain as the holder of the licence for those premises. It keeps those registers for the periods prescribed, uses them for no other purpose, and discloses them only to a person entitled by law to inspect them.

9. Because the disclosure described at paragraph 7 is, as regards the registers mentioned in paragraph 8, a disclosure to another Data Fiduciary, the Company ensures the completeness, accuracy and consistency of the personal data disclosed, as Section 8(3) of the Digital Personal Data Protection Act, 2023 requires. Every Fulfilment Location is bound by a written agreement recording the purposes for which it may process, the security safeguards it must apply, the prohibition on any use of its own, the six-hour breach intimation to the Company, and the bar on transfer outside India without written consent.

10. You may exercise every right under the said Act against the Company, whichever location fulfilled your order. You are not required to approach any other person.

III. The Legal Framework

11. This Policy is framed having regard to the following:

• the Digital Personal Data Protection Act, 2023 and the Digital Personal Data Protection Rules, 2025;
• the Information Technology Act, 2000, in particular Section 43A thereof, and the Information Technology (Reasonable Security Practices and Procedures and Sensitive Personal Data or Information) Rules, 2011 ("the 2011 Rules");
• the Consumer Protection Act, 2019 and the Consumer Protection (E-Commerce) Rules, 2020; and
• the Drugs and Cosmetics Act, 1940 and the Drugs and Cosmetics Rules, 1945, in particular Rule 65 thereof.

12. Commencement position and the Company's election: By notification G.S.R. 843(E), the Central Government appointed different dates for different provisions of the Digital Personal Data Protection Act, 2023. Sections 3 to 5, sub-sections (1) to (8) and (10) of Section 6, Sections 7 to 17, Section 27 (except clause (d) of sub-section (1)), Sections 28 to 34, Sections 36 and 37 and sub-section (2) of Section 44 come into force on the expiry of eighteen months from the date of publication of that notification. Sub-section (2) of Section 44, which omits Section 43A of the Information Technology Act, 2000, being deferred to the same date, Section 43A and the 2011 Rules continue to apply in the interim.

13. Notwithstanding that the substantive obligations of a Data Fiduciary have not yet commenced, the Company has elected to observe them from the effective date of this Policy as though they were in force, and this Policy is drawn accordingly. The Company does not thereby admit that any obligation applies to it earlier than the law provides, and the election may not be construed as a waiver of any statutory position.

IV. Notice Under Section 5 of the Act

14. Section 5(1) of the Act requires that every request for consent be accompanied or preceded by a notice informing the Data Principal of the personal data and the purpose for which it is proposed to be processed, the manner in which she may exercise her rights under Section 6(4) and Section 13, and the manner in which she may make a complaint to the Data Protection Board of India. Rule 3 of the Rules requires that the notice be presented and be understandable independently of any other information, that it give in clear and plain language an itemised description of the personal data and the specified purposes, and that it give the communication link and a description of the other means by which consent may be withdrawn, rights exercised and a complaint made to the Board.

15. The Company accordingly presents a standalone Consent Notice at the point of collection. That Notice is not part of this Policy and is not to be read as subsumed within it. This Policy is the fuller statement to which the Notice links.

16. The Company gives you the option, under Section 5(3) and Section 6(3) of the Act, to access the Consent Notice and this Policy in English or in any language specified in the Eighth Schedule to the Constitution of India. The languages presently published are Bengali, Gujarati, Hindi, Kannada, Telugu, Tamil, Malayalam, Marathi, Punjabi and Urdu, through the language selector on the Platform.

V. The Personal Data We Process

17. An itemised description follows. We process no category other than those listed.

18. Prescription and health-related information and payment-related information also constitute sensitive personal data or information within the meaning of Rule 3 of the 2011 Rules, and are handled with the heightened care those Rules require.

VI. The Grounds on Which We Process

19. We process personal data on the following grounds only:

• your consent, given for a specified purpose in accordance with Section 6 of the Act; and
• the legitimate uses set out in Section 7 of the Act, and in particular where you have voluntarily provided your personal data to us for a specified purpose and have not indicated that you do not consent to its use, and where processing is necessary for compliance with a judgment, decree, order or direction, or with any law for the time being in force.

20. Where the retention or processing of a record is required by the Drugs and Cosmetics Rules, 1945, the Companies Act, 2013, the Central Goods and Services Tax Act, 2017 or any other law in force, that processing is not founded on your consent and does not cease upon its withdrawal.

VII. Consent

21. Consent taken by us is, in accordance with Section 6(1) of the Act, free, specific, informed, unconditional and unambiguous, given by a clear affirmative action, and limited to such personal data as is necessary for the specified purpose. We do not use pre-ticked boxes, and we do not treat silence, inaction, continued browsing or disengagement as consent.

22. Consent for the processing necessary to fulfil your order is taken separately from consent for promotional communications. Consent to promotional communications is never a condition of purchase and is never bundled with any other consent. The Platform functions fully without it.

23. Any part of a consent which would infringe the Act, the Rules or any other law in force is invalid to the extent of the infringement, as provided by Section 6(2). Nothing on the Platform requires you to waive any right conferred by the Act, and any purported waiver is void.

24. You may withdraw any consent at any time. In accordance with Section 6(4), the ease of withdrawal is comparable to the ease with which the consent was given: a consent given by a single action within your account may be withdrawn by a single action in the same place. Every promotional communication carries a one-click unsubscribe link, and your account carries a master toggle by which all marketing communications across electronic mail, short message service, WhatsApp and push notification may be stopped by a single action, taking effect within twenty-four hours. Withdrawal may also be effected by writing to privacy@apothecare.in.

25. On withdrawal we shall, within a reasonable time, cease and cause our Data Processors to cease processing your personal data, save where the processing is required or authorised under the Act, the Rules or any other law in force, as provided by Section 6(6). Withdrawal does not affect the lawfulness of processing carried on before it, and its consequences are borne by you, as provided by Section 6(5). By way of illustration, if you withdraw consent after an order has been placed and paid for, we may cease to enable further ordering but shall complete the supply of the goods already ordered and paid for.

26. Because Section 6(10) places on us the burden of proving that notice was given and consent was obtained in accordance with the Act, we maintain a record of the version of the Consent Notice displayed, the purposes consented to, the mechanism used, the date and time, and the date and time of any withdrawal.

VIII. Disclosure, and Our Data Processors

27. Section 8(2) of the Act permits a Data Fiduciary to engage a Data Processor only under a valid contract, and Section 8(1) makes the Data Fiduciary responsible for compliance irrespective of any agreement to the contrary. Each of the following is engaged under a written contract containing the safeguards required by Rule 6(1)(f) of the Rules, processes personal data only on our documented instructions, and does not process it for any purpose of its own.

28. We do not sell personal data. We do not disclose prescription or health-related information to any advertiser, insurer or data broker. We disclose personal data otherwise only where required by law or by the order of a court or competent authority.

29. Where personal data processed by us is likely to be used to make a decision affecting you, or to be disclosed to another Data Fiduciary, we ensure its completeness, accuracy and consistency, as required by Section 8(3).

IX. Security Safeguards

30. Section 8(5) of the Act requires a Data Fiduciary to protect personal data in its possession or under its control, including in respect of processing undertaken on its behalf by a Data Processor, by taking reasonable security safeguards to prevent a personal data breach. Rule 6(1) of the Rules prescribes the minimum content of those safeguards. The measures presently implemented are:

• data security measures, being encryption of personal data in transit and masking of identifiers in interfaces and reports, corresponding to Rule 6(1)(a);
• control of access to the computer resources used by us and by our Data Processors, on a role basis, with administrative access restricted to named individuals, corresponding to Rule 6(1)(b);
• visibility on the accessing of personal data through logs, monitoring and periodic review, so that unauthorised access can be detected, investigated and remedied, corresponding to Rule 6(1)(c);
• measures for continued processing in the event of loss or compromise, by way of backups taken at daily intervals and held on a secure virtual private server located in India, corresponding to Rule 6(1)(d);
• retention of those logs and of the associated personal data for one year, corresponding to Rule 6(1)(e) and Rule 8(3);
• provision in each contract with a Data Processor requiring it to take reasonable security safeguards, corresponding to Rule 6(1)(f); and
• organisational measures, being documented standard operating procedures, defined responsibility for data protection, and periodic security testing of the Platform, the most recent vulnerability assessment and penetration test having been carried out in April 2026 by Cyberpact Solutions, Bengaluru, corresponding to Rule 6(1)(g).

31. The Platform maintains an audit trail of consent, account and order events, with access restricted to authorised personnel, retained for five years.

32. Personal data is hosted on secured cloud infrastructure on a dedicated virtual private server, protected by a firewall at the network perimeter.

33. Rule 8 of the 2011 Rules provides that a body corporate which has implemented the IS/ISO/IEC 27001 standard, or a code of best practice approved and notified under that Rule, and which has that implementation audited by an approved independent auditor at least once a year, shall be deemed to have complied with reasonable security practices and procedures. The Company does not hold such certification and does not claim to. Nothing in this Policy is a representation that it does.

34. No method of transmission or storage is entirely secure and we do not warrant absolute security.

X. If There Is a Personal Data Breach

35. Section 8(6) of the Act requires intimation of a personal data breach to the Data Protection Board of India and to each affected Data Principal. Rule 7 prescribes the manner.

36. On becoming aware of a personal data breach we shall, without delay, intimate each affected person through her user account or a mode of communication registered by her with us, in concise, clear and plain language, giving a description of the breach including its nature, extent and timing; the consequences likely to arise for her; the measures we have implemented and are implementing to mitigate risk; the safety measures she may take to protect her interests; and the business contact information of a person able to respond to her queries.

37. We shall also intimate the Board without delay with a description of the breach including its nature, extent, timing and location and its likely impact, and shall furnish to the Board, within seventy-two hours of becoming aware of the breach or such longer period as the Board may allow on a written request, the updated and detailed information, the broad facts as to the events, circumstances and reasons leading to the breach, the measures implemented or proposed to mitigate risk, any findings regarding the person who caused the breach, the remedial measures taken to prevent recurrence, and a report of the intimations given to affected persons.

38. Our internal procedure for meeting these timings is set out in our Personal Data Breach Response Standard Operating Procedure, and every contract with a Data Processor requires that Processor to inform us immediately and in any event within six hours of becoming aware of a breach, so that we may comply.

XI. How Long We Keep Personal Data

39. Section 8(7) of the Act requires a Data Fiduciary, unless retention is necessary for compliance with any law in force, to erase personal data upon withdrawal of consent or as soon as it is reasonable to assume that the specified purpose is no longer being served, whichever is earlier, and to cause its Data Processor to erase personal data made available to it. Section 8(8) deems the purpose no longer served where the Data Principal neither approaches the Data Fiduciary for its performance nor exercises her rights for the prescribed period.

40. The Third Schedule to the Rules prescribes a period of three years for a Data Fiduciary which is an e-commerce entity having not less than two crore registered users in India. The Company does not presently fall within that class. The Company has nevertheless elected to adopt the same three-year inactivity period, and shall erase personal data where you have neither approached us for the performance of the specified purpose nor exercised your rights for three years, save for the data required to enable you to access your user account and save where retention is required by law. At least forty-eight hours before the expiry of that period we shall inform you that the data will be erased unless you log in or otherwise initiate contact.

41. Retention required by law, which continues notwithstanding withdrawal of consent, is as follows:

42. On the expiry of the applicable period the data is erased or irreversibly anonymised, and we cause our Data Processors to erase the corresponding data, as required by Section 8(7)(b).

XII. Children

43. A child, for the purposes of the Act, is an individual who has not completed the age of eighteen years.

44. The Platform is intended for use by adults. At registration you are asked to declare that you have completed the age of eighteen years. That declaration is a self-declaration and is not verification. It is described as such here so that no greater assurance is implied than is in fact given, and it is not relied upon by us as verifiable consent for any purpose.

45. We do not knowingly process the personal data of a child. Where it comes to our knowledge that a user is a child, we shall cease processing and shall either obtain the verifiable consent of the parent or lawful guardian in the manner required by Section 9(1) of the Act read with Rule 10 of the Rules, or erase the data. Rule 10 requires that verifiable consent be obtained by due diligence to check that the individual identifying herself as the parent is an adult who is identifiable, by reference to reliable identity and age details already held by us, or to identity and age details voluntarily provided by that individual or through a virtual token mapped to such details issued by an authorised entity, including by way of a Digital Locker service provider.

46. Where a medicine is dispensed against a prescription written for a child, the order is placed by, the account is held by and the consent is given by the adult concerned, and it is that adult's personal data, together with the prescription, that we process.

47. We do not undertake any processing that is likely to cause a detrimental effect on the well-being of a child, as prohibited by Section 9(2). We do not undertake tracking or behavioural monitoring of children and do not direct targeted advertising at children, as prohibited by Section 9(3). Those prohibitions are absolute and are observed even where a parent has consented.

XIII. Your Rights

48. You have the following rights under the Act:

• under Section 11, to obtain from us a summary of the personal data of yours being processed and the processing activities undertaken, the identities of the Data Fiduciaries and Data Processors with whom it has been shared together with a description of the data so shared, and such other information as may be prescribed;
• under Section 12, to the correction, completion and updating of your personal data, and to its erasure where it is no longer necessary for the purpose for which it was processed, unless retention is necessary for the specified purpose or for compliance with a law in force;
• under Section 13, to a readily available means of registering a grievance with us, and, where you are not satisfied with our response or where we do not respond within the published period, to approach the Data Protection Board of India; and
• under Section 14, to nominate one or more individuals to exercise your rights under Sections 11 to 13 in the event of your death or of your incapacity by reason of unsoundness of mind or infirmity of body.

49. Rule 14(1) requires us to publish prominently the means by which a request may be made and the particulars required to identify you. Those means and particulars are published on the "Your Privacy Rights" page of the Platform, which is linked from the footer of every page. The identifier required is your registered electronic mail address or registered mobile number together with your order number, where applicable.

50. Your account carries a Privacy Dashboard showing your current consent state for each purpose, a log of every consent given and withdrawn with its date and time, a facility to make an access, correction, erasure or nomination request, and a downloadable record of your consent history.

51. Rule 14(3) requires us to publish the period, not exceeding ninety days, within which our grievance redressal system will respond. The Company has elected to publish and observe a period of thirty days, which is shorter than the maximum permitted.

52. You also have duties under Section 15 of the Act, which include not impersonating another person, not suppressing material information while providing personal data for any document or identifier issued by the State, not registering a false or frivolous grievance or complaint, and furnishing only such information as is verifiably authentic.

53. The exercise of any right is free of charge.

XIV. The Persons to Contact

54. Section 8(9) of the Act requires publication of the business contact information of a Data Protection Officer, where applicable, or of a person able to answer questions about the processing of personal data. Rule 9 requires that information to be published prominently on the website and displayed in any response to a communication for the exercise of rights. The Company is not a Significant Data Fiduciary and is not required to appoint a Data Protection Officer; the designation below is made voluntarily.

55. A consumer complaint is acknowledged within twenty-four hours of receipt and resolved within fifteen days, and in any event within the forty-eight hours and one month prescribed by Rule 4(5) of the Consumer Protection (E-Commerce) Rules, 2020. A grievance under Rule 5(9) of the 2011 Rules is redressed within one month. A grievance concerning personal data is responded to within thirty days, as stated at paragraph 51.

56. Once the provisions of the Act conferring that jurisdiction are in force, a complaint may be made to the Data Protection Board of India where you are not satisfied with our response or where we fail to respond within the published period.

XV. Processing Outside India

57. Section 16 of the Act permits the transfer of personal data outside India save to a country or territory notified by the Central Government as restricted. Google Analytics, and the infrastructure of certain other service providers, may process data outside India. Any such processing is confined to the data described against that provider at paragraph 27, is not undertaken in any country or territory notified as restricted, and is otherwise governed by the contract with the provider concerned. No prescription or health-related data is processed outside India.

XVI. Cookies

58. Cookies and similar technologies are described in our Cookie Policy, which forms part of this Policy. Cookies which are not strictly necessary for the functioning of the Platform are set only after consent given by a clear affirmative action, and not before.

XVII. Changes to This Policy

59. We may amend this Policy. The version number and effective date at the head of this document are updated on each amendment. Where an amendment changes the purposes for which personal data is processed, we shall give a fresh notice and obtain fresh consent, consent being specific to the purpose for which it was given.

XVIII. Contact

60. Apothecare Specialities Private Limited, 1st Floor, No. 63, M S Ramaiah Road, Gokula Extension, Mathikere, Bengaluru – 560 054, Karnataka.
Electronic mail: ceo@apothecare.in.
Telephone: +91 63649 03613 (Monday to Saturday, 10:00 to 18:00 IST).