Privacy Policy

1. Who This Policy Covers

DrugRx is installed and operated by a Clinic. The Clinic — through its administrator and staff — decides what patient information to record and controls access to it within the software. Where patient data is concerned, the Clinic acts as the data controller and DrugRx acts as a service provider processing that data on the Clinic's instructions, strictly to deliver the software's features. If you are a patient with questions about your medical records, please contact your treating clinic directly — DrugRx does not have an independent relationship with patients.

2. Information We Collect

• Account & clinic information — clinic name, address, staff names, usernames, roles, and contact details set up by your administrator.
• Clinical data entered by your clinic — patient demographics, visit history, prescriptions, lab orders, diagnoses, and billing records entered by your staff into the software.
• Device & usage information — app version, device identifiers used for licensing and LAN device pairing, and basic diagnostic logs used to keep the software running reliably.
• Website & contact form data — name, phone number, email, and profession, when you fill in our contact form to enquire about DrugRx.

3. How We Use Information

We use the information above to:

• Operate the core features of the software — patient records, OPD/IPD, prescriptions, billing, and reporting.
• Sync data between your devices and, where enabled, back it up to our cloud service so it isn't lost if a device is damaged or replaced.
• Provide customer support and respond to enquiries submitted through our website.
• Enforce your subscription plan (such as usage limits) and prevent misuse of the software.
• Improve reliability and fix issues, using aggregated, non-identifying diagnostic information wherever possible.

4. Where Your Data Lives

DrugRx is offline-first by design. Patient and clinic data is stored primarily on your own computer, in a locally encrypted database. When your clinic enables sync, a copy of that data is also sent to our cloud service so it can be shared across your clinic's devices and recovered if a local device is lost. You remain in control of when sync happens and which devices are connected to your clinic.

5. How We Protect Information

We apply industry-standard safeguards appropriate to the sensitivity of clinical data, including encryption of the local database, hashed PINs and passwords (never stored in plain text), role-based access control within the software, and authenticated, token-based access to our cloud APIs. Access to production systems is restricted to authorised personnel on a need-to-know basis. That said, no software, storage medium, or transmission method can be guaranteed completely secure, and we cannot warrant absolute security against every possible threat — including risks outside our control, such as compromised local devices, shared logins, or misuse of clinic access by an authorised user.

6. Sharing of Information

We do not sell clinic or patient data. We share information only with:

• Infrastructure and hosting providers who store or transmit data on our behalf, under confidentiality obligations.
• Professional advisors (such as auditors or legal counsel) where necessary.
• Authorities, where required by applicable law, regulation, or a valid legal process.

7. Data Retention & Deletion

Clinical data is retained for as long as your clinic's subscription is active, or as needed to comply with applicable medical record-keeping requirements. Your clinic administrator can request deletion of clinic-level data on account closure, subject to any legal retention obligations that may apply to medical records in India.

8. Your Rights

Depending on applicable law, including the Digital Personal Data Protection Act, 2023, you may have rights to access, correct, or request deletion of personal data. Patients should raise such requests with their treating clinic, who can action them within the software. Clinic administrators can reach us directly using the contact details below for account-level requests.

9. Children's Data

DrugRx is a professional tool used by clinics and is not directed at children. Clinics may enter patient records for minors as part of routine medical care; this is done under the clinic's own consent and guardianship processes, not directly by DrugRx.

10. Cookies

Our website uses only the minimal cookies required for it to function correctly, such as maintaining form security. We do not use third-party advertising or tracking cookies.

11. Changes to This Policy

We may update this Privacy Policy from time to time to reflect changes in our practices or applicable law. We'll update the "Last updated" date above when we do. Continued use of DrugRx after changes take effect means you accept the revised policy.

12. Contact Us

For privacy questions or data requests, reach out via our contact form or write to us through drugrx.in.