Privacy Policy
Last updated: September 2026
Medigrab India Private Limited (“MediGrab”, “we”, “us”, “our”) operates a WhatsApp-first medicine delivery marketplace connecting customers with licensed pharmacies in Pune, Maharashtra, together with our website at medigrab.in and related services (together, the “Services”).
This Privacy Policy explains what personal data we collect, why we collect it, how we use and share it, and the rights you have over it. It applies wherever you interact with us — on WhatsApp, on our website, or through any other channel we operate.
1. Information We Collect
| Category | What we collect |
|---|---|
| Contact & identity | Your name, WhatsApp-linked phone number, and delivery address |
| Order information | Medicines you request, prescription images you send us, order history, delivery preferences |
| Payment information | Payment method type and transaction status. We do not store your full card, UPI, or bank account details — these are processed directly by our payment aggregator, Easebuzz. |
| Location information | The delivery address you provide, and an approximate location used to route your order to a nearby pharmacy |
| Communications | Your messages to us on WhatsApp and any support conversations |
| Website usage | Pages visited, browser/device type, and similar technical information if you visit our website |
2. How We Use Your Information
- To route, verify, and fulfil your order — including using AI tools to help read and normalise the text of a prescription you send us
- To process payment via Easebuzz, or to enable cash payment at the point of delivery
- To coordinate pickup and delivery with our delivery partners
- To provide customer support and resolve order issues
- To comply with applicable law, including tax, licensing, and drug-dispensing record requirements
3. How We Share Your Information
We share the minimum information necessary, with the following parties, for the purposes stated:
- The Partner Pharmacy that accepts your order — an item summary, and, only for the fulfilling pharmacy, your prescription image, name, and delivery address, so the pharmacy can lawfully verify and dispense your order. Other nearby pharmacies see only the item summary, never your prescription image.
- Easebuzz, our payment aggregator, to process online payments
- Our delivery partner(s) (currently Adlogs, with backup partners as needed) to complete last-mile delivery
- Meta, as the provider of the WhatsApp Business Platform we use to communicate with you
- Anthropic, whose Claude AI models we use to help read and normalise prescription text. This tool does not make dispensing decisions — every prescription is independently verified by the fulfilling pharmacist
- Government or regulatory authorities, where required by law
We do not sell your personal data to third parties for their own marketing purposes.
4. Data Retention
We retain order-related data for as long as needed to fulfil your order, resolve any dispute, and meet our tax and regulatory record-keeping obligations. Prescription images are retained only for as long as needed for order fulfilment and a limited dispute-resolution window, after which they are deleted from our active systems, unless a longer period is required by applicable law.
5. Your Rights
Under the Digital Personal Data Protection Act, 2023 and the DPDP Rules, 2025, you have the right to:
- Access a summary of the personal data we hold about you and how we process it
- Correct inaccurate or incomplete data, or update outdated data
- Request erasure of your personal data, subject to our legal retention obligations
- Withdraw consent at any time — note that withdrawing consent for order-related data means we cannot process new orders until you consent again
- Nominate another individual to exercise these rights on your behalf in the event of your death or incapacity
- Lodge a grievance with our Grievance Officer (Section 9 below), and, if unresolved, escalate to the Data Protection Board of India
6. Data Security
We host order and account data on Supabase infrastructure, use encrypted connections for data in transit, and cryptographically verify every payment webhook before treating it as valid. Access to prescription images and customer data is restricted to what each system and team member needs to do their job.
7. Cookies & Website Analytics
Our website may use essential cookies necessary for it to function, and, where enabled, analytics cookies to help us understand how the website is used. You can control cookies through your browser settings.
8. Cross-Border Data Processing
Some of our service providers — including our AI and messaging infrastructure providers — may process data on servers located outside India. Where this happens, we require these providers to maintain appropriate security safeguards, consistent with the data transfer framework under the DPDP Act, 2023.
9. Grievance Officer & Contact
We aim to acknowledge grievances within a reasonable time and resolve them within the maximum period prescribed under the DPDP Rules, 2025 — currently ninety (90) days.
Grievance Officer
10. Children's Data
Our Services are intended for use by adults. We do not knowingly collect personal data from individuals under 18 years of age. If you believe a minor has provided us data without appropriate consent, please contact us and we will take steps to delete it.
11. Changes to This Policy
We may update this Privacy Policy from time to time. We will post the updated version on this page with a revised “last updated” date, and where changes are material, we will notify you via WhatsApp.
12. Governing Law
This Policy is governed by the laws of India.