Privacy Policy & Data Security Standards

1. Scope & Definitions

DoseBox (referred to as "we", "us", "our", or the "Platform") is owned and operated by DoseBox Smart Specialty Distribution. The platform serves as a secure smart-pharmacy fulfillment bridge, digital consultation facilitator, and cold-chain shipping orchestrator.

This Policy covers all users of our digital platforms, including our web platform, mobile applications, API endpoints, and direct communication services. We act as both a **data fiduciary** (managing your preferences) and a **data processor** (fulfilling clinical instructions and pharmacy shipments under certified supervisor review).

2. Information We Collect

To provide safe pharmacy services and secure online consultations, we must collect information that falls into the following categories:

2.1 Personal Identifiable Information (PII)

Information that allows us to identify, contact, or deliver to you directly:

• Identity Details: Full legal name, date of birth, biological sex (required for accurate medication dosage calculations).
• Contact Details: Verified mobile phone number, email address, and alternative shipping contact numbers.
• Delivery & Delivery Logs: Shipping coordinates, door addresses, landmark directions, and courier delivery signatures.
• Payment Metadata: Transaction reference IDs, invoice details, and payment tokens (we do not store raw card numbers, CVVs, or bank logins; all operations are processed securely via PCI-DSS compliant payment gateways).

2.2 Protected Health Information (PHI) & Prescriptions

Due to the life-saving and controlled nature of specialty oncology, transplant, and nephrology medications:

• Uploaded Prescription Files (Rx): High-resolution images or PDFs of prescriptions issued by registered medical practitioners (RMPs), including doctor seals, license numbers, and clinic headers.
• Diagnostic & Lab Reports: Vital readings, lab reports (e.g. kidney panel, blood counts) uploaded by you to enable clinical safety checks by pharmacists.
• Consultation Artifacts: Audio-visual logs, chat messages, clinical prescriptions, and assessment histories from your online video doctor consultations.

3. Purpose & Legal Basis of Data Processing

We process your personal and health data strictly for the following purposes:

• Prescription Validation: By law under the Drugs and Cosmetics Act, generic and brand-name schedule prescription drugs can only be dispensed after a registered pharmacist validates a genuine prescription.
• Clinical Telehealth: To connect you with general practitioners and specialists via our consultation service, ensuring they have access to relevant symptoms and history.
• Cold-Chain Validation Logs: Processing address data to calculate temperature-sensitive transit durations, ensuring oncology and temperature-controlled items arrive within safe 2°C - 8°C guidelines.
• Patient Assistance Programs (PAP): Sharing required transaction data with certified pharmaceutical manufacturer PAP agents, strictly upon your written request, to claim subsidised specialty medicines.

4. Data Sharing & Disclosure

We do not sell, license, lease, or rent your personal health data to marketing companies or third-party aggregators. Your information is shared only on a **need-to-know basis** with the following parties:

• Licensed Partner Pharmacists: Local, licensed retail and wholesale pharmacies processing your specific order fulfillment, and certified pharmacists validating your prescription validity.
• Verified Delivery Providers: Cold-chain and express couriers who receive only the necessary delivery address, recipient name, and mobile number. They never receive prescription summaries or diagnosis data.
• Consulting Practitioners: Doctors and clinical consultants assigned to your consultation, who are bound by professional code of conduct and medical confidentiality.
• Legal Mandate: Authorized government bodies if required by a valid search warrant, subpoena, court order, or national health safety directive.

5. Data Retention & Preservation Mandates

Under statutory rules governing pharmacy operations in India (specifically the Drugs and Cosmetics Rules, Pharmacy Practice Regulations, and digital health records policies):

Non-regulated, non-transactional personal data (such as temporary profile assets, session details, and unused contact records) will be purged within **180 days** of receiving a valid account deletion request.

6. Security & Encryption Standards

To maintain the integrity of our platform, we apply high-tier security parameters:

• Encryption in Transit: All communication, prescription uploads, and clinical records are encrypted using 256-bit TLS (Transport Layer Security) protocol.
• Encryption at Rest: Database assets, prescription images, and diagnostic records are stored on secure cloud services encrypted with AES-256 standards.
• Access Control: Highly restricted access to clinical data based on role-based profiles. Pharmacists only see prescription data, and logistics coordinators only see shipping details.
• Payment Compliance: Secure checkouts are handled through third-party PCI-DSS compliant aggregators. No payment credentials or CVVs touch our servers.

7. Your Statutory Rights

Under the Digital Personal Data Protection (DPDP) Act and telecommunication privacy guidelines, you hold the following controls:

• Right to Correct & Update: Modify your personal identity, contact, or delivery address settings through the user panel at any time.
• Right to Withdraw Consent: You can refuse or withdraw consent for data processing. Note that this may terminate our ability to dispense or process your prescription orders.
• Right to Request Deletion: Request deletion of your user account and personal profiles. To initiate deletion, visit our dedicated Data Deletion Portal or contact our Grievance Officer.

8. Grievance Officer

In accordance with the Information Technology Act 2000 and rules made there under, the name and contact details of the Grievance Officer are provided below:

• Mobile Number: 9718541733