Privacy Policy

This Privacy Policy explains how Medigrab India Private Limited (operating as “MediGrab”, “we”, “us”, “our”) collects, uses, shares, and protects your personal data when you use medigrab.in or our healthcare delivery coordination service in Pune.

We are a Data Fiduciary as defined under the Digital Personal Data Protection Act, 2023 (DPDP Act).

1. Introduction

MediGrab is a technology and logistics service that connects patients with CDSCO-licensed local pharmacies. This policy covers all data we handle in the course of providing that service.

2. Information We Collect

• Personal data — name, phone number, email, delivery address.
• Order data — medicines ordered, prescription images, order history.
• Usage data — anonymised analytics, device type, browser, referral source, page views.
• Device data — IP address, operating system, approximate location (only when you grant permission for delivery routing).
• WhatsApp interaction data — order requests, prescription images, delivery location pins, and service responses sent through our WhatsApp Business number. Messages are processed by our WhatsApp Business API provider (AiSensy) and stored for order fulfilment, delivery coordination, and customer support.

3. How We Use Your Information

• To process, route, and deliver your medicine orders.
• To communicate order status, delivery updates, and refunds.
• To improve service quality, response times, and inventory accuracy.
• To meet legal, tax, and pharmacy compliance obligations.

4. Health Data

Prescription images and medicine lists are health-adjacent data and are treated with elevated security. They are stored encrypted, accessed only by the fulfilling pharmacist and our limited support staff, and never used for marketing.

5. Data Sharing

• Partner pharmacies — only the order details necessary to dispense.
• Delivery partners — only the address and contact info needed to deliver.
• Payment processors (Razorpay) — only the data required to process payment.
• WhatsApp Business API provider (AiSensy) — processes message delivery, template notifications, and inbound message routing. AiSensy does not store message content beyond delivery processing.
• Delivery logistics partners (Shadowfax, Porter) — receive only the delivery address, recipient contact number, and cash-on-delivery amount required to complete the delivery. No prescription or health data is shared with delivery partners.
• AI processing provider (Anthropic) — prescription images are processed for medicine name extraction only. Processing is stateless; no patient data is retained by the AI provider after processing completes.
• Analytics providers (Google Analytics, Meta Pixel) — anonymised usage data only.

We do not sell or rent your personal data to anyone.

6. Cookies & Tracking

We use essential cookies for site functionality, plus Google Analytics and Meta Pixel for anonymised usage measurement. You can disable non-essential cookies through your browser settings.

7. Data Retention

Order records and prescriptions are retained for the period required under Indian pharmacy and tax laws (typically 5–7 years). Personal data not legally required is deleted within 12 months of your last order or on your written request.

8. Your Rights under the DPDP Act 2023

• Right to access your personal data.
• Right to correction of inaccurate data.
• Right to erasure of data not legally required.
• Right to data portability.
• Right to grievance redressal — see Section 14 below.

9. Consent & Withdrawal

By sending your first message to our WhatsApp Business number, you provide consent for the collection and processing of personal data described in this policy for transactional purposes — including order processing, delivery coordination, payment handling, and customer support communications.

Marketing communications (such as reorder reminders) require separate, explicit opt-in. You will be prompted to opt in after your first successful delivery. You are never auto-enrolled in marketing messages.

To withdraw consent:

• Reply STOP to our WhatsApp Business number at any time to opt out of marketing messages.
• Email contact@medigrab.in to request withdrawal of transactional consent or complete data deletion.
• Note: Withdrawing transactional consent will prevent us from processing future orders on your behalf. Data required under Indian pharmacy and tax law will be retained as described in the Data Retention section.

Consent records are logged with timestamps in compliance with the DPDP Act, 2023.

10. Data Security

Data is transmitted over HTTPS/TLS, stored encrypted at rest, and access is restricted to authorised personnel on a need-to-know basis.

11. Children's Privacy

MediGrab is for adults (18+). We do not knowingly collect personal data from children under 18. If you believe we have, contact us immediately and we will delete it.

12. Third-Party Links

Our site may link to third-party websites. We are not responsible for their privacy practices.

13. Changes to This Policy

We will post any updates on this page with a revised “last updated” date. Material changes will be notified via WhatsApp or email.

14. Grievance Officer

Name: Shayan Kumar, Co-Founder
Email: contact@medigrab.in
Response timeline: within 48 hours of receipt.

15. Contact

Medigrab India Private Limited
73/2/2 Ramradha Bangala, Radhakrushna Society, Katraj, Pune - 411046, Maharashtra
Email: contact@medigrab.in
Phone: +91-8788876943