1. Scope & Commitment to Privacy
This Privacy Policy outlines the practices and obligations of DR. Khokha ("Platform") and its network of licensed retail pharmacies, hospital dispensaries, and digital delivery partners ("Pharmacy Partners") regarding the collection, processing, protection, and retention of pharmacy business data and patient health records.
2. Information Collected from Pharmacy Partners
During onboarding and active operation, DR. Khokha collects and processes the following partner data:
- Business & Licensing Data: Legal entity name, trade name, registered pharmacy address, state drug license numbers, validity certificates, GSTIN, and PAN.
- Pharmacist & Contact Information: Name, photo identification, State Pharmacy Council registration number, registered mobile number, and official email address.
- Financial & Settlement Data: Bank account numbers, IFSC codes, cancelled cheques, wallet balances, transaction logs, and payout histories.
- Operational Data: Product catalog listings, stock availability, pricing updates, order fulfillment metrics, and dispatch timestamps.
3. Protection of Patient Data & Prescription Confidentiality
Pharmacy Partners receive access to sensitive patient health information solely for order fulfillment purposes:
- Strict Purpose Limitation: Patient names, contact details, delivery addresses, doctor prescriptions, and medical histories are shared strictly for dispensing and delivery logistics.
- Zero Secondary Marketing: Pharmacy Partners are strictly prohibited from using customer telephone numbers or addresses for secondary promotions, cross-selling, marketing SMS/calls, or building proprietary commercial databases.
- Non-Disclosure: Patient prescriptions and medical diagnoses must never be disclosed to unauthorized third parties or unverified staff members.
4. Data Security & Storage Standards
DR. Khokha implements robust industry-standard safeguards to secure pharmacy and patient records:
- End-to-end transport layer security (TLS 1.3 encryption) for all API communications and mobile/web portal access.
- Role-based access controls ensuring only authorized pharmacists and staff can review prescription orders.
- Compliance with the Digital Personal Data Protection Act (DPDPA), 2023, Information Technology Act, 2000, and Pharmacy Practice Regulations.
5. Statutory Record Retention
In accordance with the Drugs and Cosmetics Act, 1940 and applicable pharmaceutical laws, records of Schedule H/H1 dispensations and digital prescriptions will be archived securely for the statutory mandatory retention period (typically 2 to 5 years), after which they are securely expunged or anonymized.
6. Information Sharing & Third Parties
Pharmacy Partner information is shared only under specific circumstances:
- With registered delivery personnel and courier partners to the extent required to execute shipment pickup and handover.
- With banking partners and payment gateways to execute wallet payouts and direct bank deposits.
- With drug regulatory authorities, state drug inspectors, or law enforcement bodies upon receipt of a lawful warrant or regulatory inquiry.
7. Grievance Officer & Contact
If you have any questions, concerns, or requests regarding this Privacy Policy or data handling practices, please contact our Data Protection and Grievance Officer at:
Email: privacy@healthboat.org / support@healthboat.org
Platform: DR. Khokha Healthcare Network (healthboat.org)
