1. SCOPE & LEGAL FRAMEWORK

This Policy applies to all customers, patients, and healthcare users accessing our web portal, mobile application, teleconsultation services, or prescription fulfillment channels. It complies with:

• The Information Technology Act, 2000, and the Information Technology (Reasonable Security Practices and Procedures and Sensitive Personal Data or Information) Rules, 2011.
• The Digital Personal Data Protection Act, 2023 (DPDP Act).
• The Drugs and Cosmetics Act, 1940, and the Drugs and Cosmetics Rules, 1945.
• The Pharmacy Act, 1948, and the National Medical Commission Telemedicine Practice Guidelines.

2. CATEGORIES OF INFORMATION COLLECTED

We collect only minimum necessary data required to dispense pharmaceutical products, verify prescriptions, and ensure patient safety:

• Identity & Contact Details: Full name, age, gender, delivery address, registered telephone number, and email address.
• Medical & Health Data (Sensitive Personal Data): Scanned prescription copies, medical histories, treating physician credentials, dosage schedules, diagnosis details, and pharmacy consultation records.
• Transaction & Logistics Data: Order receipts, billing records, tracking logs, and delivery receipts. Note: Payment card/banking details are handled through certified, RBI-licensed payment gateways and are never recorded on our direct servers.

3. PERMITTED PURPOSE OF DATA PROCESSING

Your data is processed strictly under informed, lawful consent for:

• Prescription verification, pharmaceutical drug compounding/dispensing, and door-step fulfillment.
• Health updates, critical dosage notifications, refilling reminders, and drug interaction safety warnings.
• Customer support, grievance resolution, and service inquiries.
• Mandatory compliance with pharmaceutical record-keeping rules and government health audits.

4. ZERO THIRD-PARTY SELLING & DATA DISCLOSURE RESTRICTIONS

Absolute Prohibition on Selling Data: We do not sell, rent, monetize, or trade your personal or health information to third-party ad networks, telemarketers, or commercial data brokers under any circumstances. Data sharing occurs solely with verified entities under strict confidentiality contracts:

• Registered Pharmacists: For validation of active prescriptions and dispensing compliance.
• Fulfillment & Logistics Partners: Restricted strictly to recipient name, contact number, and delivery address to enable physical drop-off.
• Statutory Authorities: Disclosed only upon receiving lawful warrants, notices, or subpoenas issued by authorized courts or state/central drug inspectors.

5. INFORMATION SECURITY & STORAGE SAFEGUARDS

Well Meds employs bank-grade security controls to prevent unauthorized access, tampering, or disclosure:

• End-to-End Encryption: Industry-standard TLS 1.3 encryption for data in transit and AES-256 bit encryption for stored electronic medical archives.
• Role-Based Access Control (RBAC): Access to sensitive prescription files is compartmentalized and accessible solely to authorized clinical pharmacists.
• Audit Trails & Anonymization: All access logs are timestamped and monitored to prevent insider leakage.

6. ONLINE PHARMACY COMPLIANCE & PRESCRIPTION VERIFICATION

In accordance with pharmaceutical regulations:

• Mandatory Prescription Requirement: No prescription-class drug will be supplied without a valid, unaltered prescription issued by a Registered Medical Practitioner (RMP).
• Pharmacist Inspection: All uploaded prescriptions are verified against state and national medical registers prior to packing.
• Prescription Verification Authority: We reserve the statutory right to verify prescription validity with the issuing medical practitioner or clinical facility in instances of ambiguous dosing or safety concerns.

7. Schedule H, H1 & Schedule X Drug Policy

• Schedule H & H1 Compliance: Dispensed only against explicit RMP prescriptions and recorded in electronic registers detailing patient identity, physician registration, batch numbers, and dispatch dates.
• Schedule X & NDPS Strict Exclusion: Well Meds strictly does NOT retail or dispense Schedule X habit-forming drugs, psychotropic substances, or narcotics governed by the NDPS Act, 1985 via online ordering.

8. TELECONSULTATION & DIGITAL ADVISORY GUIDELINES

Where teleconsultation or remote prescription generation is facilitated:

• Teleconsultations adhere to the Telemedicine Practice Guidelines issued under the National Medical Commission Act.
• Treating medical practitioners operate with independent clinical discretion. The decision to recommend or refrain from prescribing medication rests entirely with the attending physician.
• Digital consultation summaries and electronic prescriptions are treated as highly confidential medical records, accessible exclusively to the consulting doctor and the patient.
• Emergency Medical Disclaimer: Tele-advisory services are not configured for acute life-threatening situations. Patients experiencing emergencies must immediately seek in-person emergency hospital care.

9. DATA RETENTION & USER RIGHTS

• Mandatory Pharmacy Retention: Prescriptions and dispensing registers are retained for statutory periods mandated under drug control regulations (minimum 2 years) to satisfy regulatory inspections.
• User Rights: Users have the right to review their stored profile, demand correction of inaccurate personal details, and request deletion of personal information once legal retention requirements expire.

10. GRIEVANCE OFFICER & OFFICIAL CONTACT

For inquiries, complaints, or grievance redressal under the Digital Personal Data Protection Act and Information Technology Act, contact: